,,ii ,cal5d> ,no4 #cfe #aai? ,,congress #b;d ,session ,s4 #ccae ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,decemb] #b1 #bjbe,mr4 ,cassidy 7= himself1 ,ms4 ,hassan1 ,mr4 ,cornyn1 & ,mr4 ,w>n]7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ,m>* #bc1 #bjbf,report$ by ,mr4 ,cassidy1 ) an amendment,strike out all aft] ! enact+ clause & ins]t ! "p pr9t$ 9 italic ,a ,,bill ,to require ! ,secret>y ( ,heal? & ,human ,s]vices & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy to coord9ate to improve cyb]security 9 ! heal? c>e & public heal? sectors1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbe4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,ag5cy ,! t]m ,ag5cy means ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7#b7 ,cyb]security incid5t ,! t]m cyb]security incid5t has ! mean+ giv5 ! t]m incid5t 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code4 7#c7 ,cyb]security ,/ate ,coord9ator ,! t]m ,cyb]security ,/ate ,coord9ator means a ,cyb]security ,/ate ,coord9ator appo9t$ "u section #bbag7;a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ffe;c7a774 7#d7 ,director ,! t]m ,director means ! ,director ( ! ,ag5cy4 7#e7 ,heal?c>e & ,public ,heal? ,sector ,! t]m ,heal?c>e & ,public ,heal? ,sector means ! ,heal?c>e & ,public ,heal? sector1 z id5tifi$ 9 ,presid5tial ,policy ,directive #ba 7,febru>y #ab1 #bjac2 relat+ to critical infra/ructure security & resili5ce74 7#f7 ,in=mation ,%>+ & ,analysis ,organization ,! t]m ,in=mation ,%>+ & ,analysis ,organization has ! mean+ giv5 su* t]m 9 section #bbjj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej74 7#g7 ,in=mation sy/em ,! t]m in=mation sy/em has ! mean+ giv5 su* t]m 9 section #ajb ( ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae 7#f ,u4,s4,c4 #aeja74 7#h7 ,secret>y ,! t]m ,secret>y means ! ,secret>y ( ,heal? & ,human ,s]vices4 #c4 ,dep>tm5t coord9ation ) ! ,ag5cy 7a7 ,9 g5]al ,! ,secret>y & ! ,director %all coord9ate1 includ+ by ent]+ into a coop]ative agreem5t1 z appropriate1 to improve cyb]security 9 ! ,heal?c>e & ,public ,heal? ,sector4 7b7 ,assi/ance 7#a7 ,9 g5]al ,! ,secret>y %all coord9ate ) ! ,director to make res\rces available to entities t are receiv+ in=mation %>$ ?r\gh programs manag$ by ! ,director or ! ,secret>y1 includ+ ,in=mation ,%>+ & ,analysis ,organizations1 in=mation %>+ & analysis c5t]s1 & non-,f$]al entities4 7#b7 ,scope ,! coord9ation "u p>agraph 7#a7 %all include-- 7,a7 develop+ products specific to ! ne$s ( ,heal?c>e & ,public ,heal? ,sector entities2 & 7,b7 %>+ in=mation relat+ to cyb] ?reat indicators & appropriate def5sive measures4 #d4 ,cl>ify+ cyb]security responsibilities at ! ,dep>tm5t ( ,heal? & ,human ,s]vices ,"p ,a ( title ,,iii ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bda et seq47 is am5d$ by add+ at ! end ! foll[+3 #caj;,c4 ,ov]sight ( cyb]security activities ,! ,secret>y1 act+ ?r\gh ! ,assi/ant ,secret>y = ,prep>$ness & ,response1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy pursuant to section #bbah ( ! ,homel& ,security ,act ( #bjjb1 %all lead ov]sight & coord9ation ( activities )9 ! ,dep>tm5t ( ,heal? & ,human ,s]vices to support cyb]security resili5cy )9 ! ,heal?c>e & ,public ,heal? ,sector 7z def9$ 9 section #b ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbe71 includ+ coord9ation & communication ) o!r public & private entities relat$ to prep>$ness =1 & responses to1 cyb]security incid5ts1 consi/5t ) applicable provisions ( ?is ,act1 o!r applicable laws1 & ,presid5tial ,policy ,directive #ba 7,febru>y #ab1 #bjac2 relat+ to critical infra/ructure security & resili5ce74 4 #e4 ,cyb]security incid5t response plan ,section #dje ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aecc7 is am5d$-- 7#a7 9 subsection 7a7-- 7,a7 9 p>agraph 7#d7-- 7i7 9 ! p>agraph head+1 by ins]t+ in=mation sy/em2 aft] ,f$]al entity22 & 7ii7 by ins]t+ in=mation sy/em1 aft] ,f$]al entity12 7,b7 by r$esignat+ p>agraphs 7#d7 ?r\gh 7#g7 z p>agraphs 7#f7 ?r\gh 7#i71 respectively2 & 7,c7 by ins]t+ aft] p>agraph 7#c7 ! foll[+3 7#d7 ,cyb]security incid5t ,! t]m cyb]security incid5t has ! mean+ giv5 ! t]m incid5t 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code4 7#e7 ,cyb]security risk ,! t]m cyb]security risk has ! mean+ giv5 su* t]m 9 section #bbjj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej74 2 & 7#b7 9 subsection 7d71 by add+ at ! end ! foll[+3 7#d7 ,plan 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbe1 ! ,secret>y %all develop & implem5t a cyb]security incid5t response plan to in=m applicable p]sonnel )9 ! ,dep>tm5t ( ,heal? & ,human ,s]vices ( processes & protocols to prep>e =1 & respond to1 cyb]security incid5ts involv+ in=mation1 includ+ h>dw>e1 s(tw>e1 databases1 & networks1 us$ or ma9ta9$ by1 or on behalf (1 ! ,dep>tm5t1 includ+ /rategies-- 7i7 to assess cyb]security risks2 7ii7 to prev5t cyb]security incid5ts2 7iii7 to detect & id5tify cyb]security incid5ts2 7iv7 to m9imize damage 9 ! ev5t ( a cyb]security incid5t2 7v7 to protect data2 & 7vi7 to recov] f any cyb]security incid5ts exp$iti\sly4 7,b7 ,consultation ,9 develop+ ! plan "u subp>agraph 7,a71 ! ,secret>y %all consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,director ( ! ,(fice ( ,managem5t & ,budget1 & ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 & relevant exp]ts1 z appropriate4 7,c7 ,report ,n lat] ?an #fj days be=e ! date on :i* ! ,secret>y beg9s implem5t+ ! plan "u subp>agraph 7,a71 ! ,secret>y %all submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce1 ! ,committee on ,ov]sight & ,re=m1 & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report t describes su* plan4 4 #f4 ,brea* report+ portal 7a7 ,updates to brea* report+ portal ,section #acdjb ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agicb7 is am5d$ by add+ at ! end ! foll[+3 7k7 ,updates to regulations ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbe1 ! ,secret>y %all update ! regulations promulgat$ pursuant to subsection 7j7 to require t in=mation requir$ to be publicly display$ 9 ! brea* report+ portal e/abli%$ pursuant to ?is section includes-- 7#a7 in=mation on any corrective action tak5 aga9/ a cov]$ entity t provid$ notification ( a brea* "u ?is section2 7#b7 in=mation on :e!r & to :at ext5t1 z appropriate1 recogniz$ security practices 7z def9$ 9 section #acdab7;b77#a77 7 consid]$ 9 ! inve/igation ( su* a brea*2 & 7#c7 su* additional in=mation ab\t su* a brea* z ! ,secret>y may require4 4 #g4 ,cl>ify+ brea* report+ obligations ,section #acdjb7;f7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agicb7;f77 is am5d$ by add+ at ! end ! foll[+3 7#f7 ,! numb] ( individuals affect$ by ! brea*4 4 #h4 ,enhanc+ recognition ( security practices 7a7 ,recogniz$ security practices ,section #acdab7;b77#a7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agida7;b77#a77 is am5d$1 9 ! fir/ s5t5ce1 by ins]t+ 1 inve/m5ts1 aft] o!r programs4 7b7 ,guidance ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y %all issue guidance on ! implem5tation ( section #acdab ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agida71 :i* %all include-- 7#a7 recogniz$ security practices 7z def9$ 9 subsection 7b77#a7 ( su* section7 t ! ,secret>y may consid] :5 det]m9+ f9es "u su* section2 7#b7 ! ext5t to :i* su* recogniz$ security practices %\ld be 9 place = consid]ation by ! ,secret>y2 & 7#c7 proc$ural requirem5ts or in=mation t %all be submitt$ by a cov]$ entity or bus9ess associate 7z su* t]ms are def9$ 9 section #acdjj ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agiba77 to ! ,secret>y = consid]ation4 7c7 ,annual report ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,secret>y %all include 9 ! annual report requir$ "u section #acdbd7;a7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agiec7;a77 in=mation on implem5tation ( section #acdab ( su* ,act 7#db ,u4,s4,c4 #agida71 includ+ an acc\nt+ ( e case 9 :i* ! ,secret>y consid]$ recogniz$ security practices 7z def9$ 9 subsection 7b77#a7 ( su* section7 :5 effectuat+ audits & assess+ f9es "u su* section4 #i4 ,requir$ cyb]security /&>ds 7a7 ,9 g5]al ,! ,secret>y %all update ! privacy1 security1 & brea* notification regulations "u p>ts #afj & #afd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulation7 to require cov]$ entities & bus9ess associates to adopt ! foll[+ cyb]security practices3 7#a7 ,multifactor au!ntication1 or a successor te*nology1 = access to any in=mation sy/ems t may include protect$ heal? in=mation4 7#b7 ,safegu>ds to encrypt protect$ heal? in=mation4 7#c7 ,requirem5ts to conduct audits1 includ+ p5etration te/+1 to ma9ta9 ! protections ( in=mation sy/ems4 7#d7 ,o!r m9imum cyb]security /&>ds1 z det]m9$ by ! ,secret>y1 9 consultation ) private sector entities1 bas$ on l&scape analysis ( em]g+ & exi/+ cyb]security vuln]abilities & cons5sus-bas$ be/ practices4 7b7 ,effective dates ,! ,secret>y %all specify 9 ! regulations ! effective date = ea* ( ! new requirem5ts "u ! regulations updat$ 9 accordance ) subsection 7a74 ,ea* su* effective date %all provide reasonable "t = ! entities subject to ! requirem5t to come into compliance4 #aj4 ,guidance on rural cyb]security read9ess ,section #dje7;d7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aecc7;d77 7z am5d$ by section #e7b77 is am5d$ by add+ at ! end ! foll[+3 7#e7 ,rural cyb]security guidance 7,a7 ,def9ition ( rural ,9 ?is p>agraph1 ! t]m rural has ! mean+ giv5 su* t]m by ! ,heal? ,res\rces & ,s]vices ,adm9i/ration4 7,b7 ,guidance on rural cyb]security read9ess ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbe1 ! ,secret>y %all issue guidance to rural entities on be/ practices to improve cyb] read9ess1 includ+ /rategies-- 7i7 to improve cyb] infra/ructure1 includ+ any te*nical safegu>ds to mitigate cyb]security risk2 7ii7 to integrate be/ practices issu$ by ! ,secret>y to improve cyb]security prep>$ness2 7iii7 to improve employee prep>ation to mitigate any cyb]security risks1 includ+ exi/+ public-private programs to support educational initiatives2 & 7iv7 to implem5t policies to facilitate m&atory cyb]security incid5t report+ requirem5ts "u law4 7,c7 ,,gao /udy & report 7i7 ,9 g5]al ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbe1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all conduct1 & submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report t describes ! results (1 a /udy to exam9e h[ rural entities h implem5t$ ! recomm5dations includ$ 9 ! guidance "u subp>agraph 7,b74 7ii7 ,requirem5ts ,! /udy "u clause 7i7 %all assess-- 7,i7 h[ rural entities h implem5t$ any te*nical safegu>ds & any *all5ges fac$ by su* rural entities 9 areas = :i* safegu>ds 7 n implem5t$2 7,,ii7 /eps to fur!r support cyb] resili5ce = rural entities2 7,,iii7 areas to improve coord9ation betwe5 ,f$]al ag5cies1 includ+ = ! purposes ( requir$ cyb] report+2 & 7,,iv7 any opportunities to support public-private collaboration 9 ! area ( cyb] read9ess4 4 #aa4 ,grants to enhance cyb]security 9 ! heal? & public heal? sectors ,"p ,p ( title ,,iii ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bhj;g et seq47 is am5d$ by add+ at ! end ! foll[+3 #cii,v-#h4 ,grants 7a7 ,9 g5]al ,! ,secret>y may aw>d grants to eligible entities = ! adoption & use ( cyb]security be/ practices4 7b7 ,eligible entity ,to be eligible to receive a grant "u subsection 7a7 an entity %all be-- 7#a7 a public or nonpr(it private heal? c5t] 7includ+ a ,f$]ally qualifi$ heal? c5t] 7z def9$ 9 section #ahfa7;aa77#d7 ( ! ,social ,security ,act772 7#b7 a heal? facility op]at$ by or pursuant to a contract ) ! ,indian ,heal? ,s]vice2 7#c7 a hospital2 7#d7 a canc] c5t]2 7#e7 a rural heal? cl9ic2 7#f7 an academic heal? c5t]2 or 7#g7 a nonpr(it entity t ent]s into a p>tn]%ip or coord9ates ref]rals ) an entity describ$ 9 any ( p>agraphs 7#a7 ?r\gh 7#f74 7c7 ,use ( funds ,9 adopt+ & us+ cyb]security be/ practices pursuant to a grant "u subsection 7a71 an eligible entity may use grant funds-- 7#a7 to hire & tra9 p]sonnel 9 su* cyb]security be/ practices2 7#b7 to update electronic data sy/ems1 su* z by migrat+ to cl\d bas$ plat=ms2 7#c7 to jo9 & p>ticipate 9 heal? cyb]security ?reat in=mation %>+ organizations2 7#d7 to r$uce ! use ( legacy sy/ems2 & 7#e7 to contract ) ?ird p>ties to assi/ ) ! activities describ$ 9 p>agraphs 7#a7 ?r\gh 7#e74 7d7 ,grant p]iod ,! ,secret>y may aw>d a grant "u ?is section = a p]iod ( n m ?an #c ye>s4 7e7 ,application ,an eligible entity seek+ a grant "u subsection 7a7 %all submit to ! ,secret>y an application at su* "t1 9 su* mann]1 & conta9+ su* in=mation z ! ,secret>y may require includ+1 at a m9imum a description ( h[ ! eligible entity w e/abli% basel9e measures & b5*m>ks t meet ! ,secret>y's requirem5ts to evaluate program outcomes4 7f7 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to c>ry out ?is section su* sums z may be necess>y = ea* ( fiscal ye>s #bjbe ?r\gh #bjcj4 4 #ab4 ,heal?c>e cyb]security work=ce 7a7 ,tra9+ = heal?c>e exp]ts ,! ,secret>y1 9 coord9ation ) ! ,cyb]security ,/ate ,coord9ators ( ! ,ag5cy & private sector heal? c>e exp]ts1 z appropriate1 %all provide tra9+ to ,heal?c>e & ,public ,heal? ,sector asset own]s & op]ators on-- 7#a7 cyb]security risks to in=mation sy/ems )9 ! ,heal?c>e & ,public ,heal? ,sector2 & 7#b7 ways to mitigate ! risks to in=mation sy/ems 9 ! ,heal?c>e & ,public ,heal? ,sector4 7b7 ,cross-,ag5cy educational tools 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y1 act+ ?r\gh ! ,adm9i/rator ( ! ,heal? ,res\rces & ,s]vices ,adm9i/ration1 9 coord9ation ) ! ,ag5cy1 %all develop a /rategic plan to support gr[+ ! cyb]security work=ce = heal? c>e entities4 7#b7 ,inclusions ,! /rategic plan "u p>agraph 7#a7 %all include-- 7,a7 recomm5dations = exi/+ educational programs t c be us$ to support cyb]security tra9+2 7,b7 dissem9ation & developm5t ( educational mat]ials on h[ to improve cyb]security resili5ce2 7,c7 developm5t ( be/ practices to tra9 ! heal? c>e work=ce on cyb]security be/ practices2 & 7,d7 opportunities = public-private collaboration to /r5g!n ! cyb]security work=ce4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbf4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,ag5cy ,! t]m ,ag5cy means ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7#b7 ,bus9ess associate ,! t]m bus9ess associate has ! mean+ giv5 su* t]m 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or a successor regulation74 7#c7 ,cov]$ entity ,! t]m cov]$ entity has ! mean+ giv5 su* t]m 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or a successor regulation74 7#d7 ,cyb]security incid5t ,! t]m cyb]security incid5t has ! mean+ giv5 ! t]m incid5t 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code4 7#e7 ,cyb]security ,/ate ,coord9ator ,! t]m ,cyb]security ,/ate ,coord9ator means a ,cyb]security ,/ate ,coord9ator appo9t$ "u section #bbag7;a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ffe;c7a774 7#f7 ,director ,! t]m ,director means ! ,director ( ! ,ag5cy4 7#g7 ,heal?c>e & ,public ,heal? ,sector ,! t]m ,heal?c>e & ,public ,heal? ,sector means ! ,heal?c>e & ,public ,heal? sector1 z id5tifi$ 9 ,national ,security ,memor&um-#bb 7,april #cj1 #bjbd2 relat+ to critical infra/ructure security & resili5ce74 7#h7 ,in=mation ,%>+ & ,analysis ,organization ,! t]m ,in=mation ,%>+ & ,analysis ,organization has ! mean+ giv5 su* t]m 9 section #bbjj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej74 7#i7 ,in=mation sy/em ,! t]m in=mation sy/em has ! mean+ giv5 su* t]m 9 section #bbjj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej74 7#aj7 ,recogniz$ security practices ,! t]m recogniz$ security practices has ! mean+ giv5 su* t]m 9 section #acdab7;b77#a7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agida7;b77#a774 7#aa7 ,secret>y ,! t]m ,secret>y means ! ,secret>y ( ,heal? & ,human ,s]vices4 #c4 ,dep>tm5t coord9ation ) ! ,ag5cy 7a7 ,9 g5]al ,! ,secret>y & ! ,director %all coord9ate1 includ+ by ent]+ into a coop]ative agreem5t1 z appropriate1 to improve cyb]security 9 ! ,heal?c>e & ,public ,heal? ,sector4 7b7 ,assi/ance 7#a7 ,9 g5]al ,! ,secret>y %all coord9ate ) ! ,director to make res\rces available to entities t are receiv+ in=mation %>$ ?r\gh programs manag$ by ! ,director or ! ,secret>y1 includ+ ,in=mation ,%>+ & ,analysis ,organizations1 sector coord9at+ c\ncils1 & non-,f$]al entities4 7#b7 ,scope ,! coord9ation "u p>agraph 7#a7 %all include-- 7,a7 develop+ products specific to ! ne$s ( ,heal?c>e & ,public ,heal? ,sector entities2 7,b7 %>+ in=mation relat+ to cyb] ?reat indicators & appropriate def5sive measures1 includ+ automat+ cyb] ?reat in=mation %>+1 9 a mann] t adequately protects aga9/ unau?oriz$ access or disclosure2 & 7,c7 provid+ te*nical assi/ance to cov]$ entities & bus9ess associates to improve cyb]security prep>$ness4 7c7 ,jo9t cyb]security plann+ 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y & ! ,director %all e/abli% a jo9t cyb]security capability plan to coord9ate responses to significant cyb]security incid5ts affect+ ! ,heal?c>e & ,public ,heal? ,sector4 7#b7 ,elem5ts ,! jo9t cyb]security capability plan e/abli%$ "u p>agraph 7#a7 %all include-- 7,a7 protocols = rapid in=mation %>+ dur+ sector-wide cyb]security incid5ts2 7,b7 coord9ation me*anisms ) ! sector coord9at+ c\ncil = ! ,heal?c>e & ,public ,heal? ,sector2 & 7,c7 coord9ation ) ,cyb]security ,/ate ,coord9ators = incid5ts affect+ multiple ,/ates4 7#c7 ,submission to ,congress 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y %all submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives ! f9al jo9t cyb]security capability plan prep>$ "u p>agraph 7#a7 & a description ( h[ su* plan implem5ts ! elem5ts requir$ "u p>agraph 7#b74 7,b7 ,updates ,if ! ,secret>y & ! ,director update ! jo9t cyb]security capability plan requir$ "u ?is subsection1 ! ,secret>y %all submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives su* updat$ plan & a description ( h[ su* plan implem5ts ! elem5ts requir$ "u p>agraph 7#b74 #d4 ,cl>ify+ cyb]security responsibilities at ! ,dep>tm5t ( ,heal? & ,human ,s]vices 7a7 ,9 g5]al ,! ,secret>y %all delegate a repres5tative to lead ov]sight & coord9ation ( activities )9 ! ,dep>tm5t ( ,heal? & ,human ,s]vices to support int]nal & ext]nal cyb]security resili5ce )9 ! ,heal?c>e & ,public ,heal? ,sector1 includ+ coord9ation & communication ) o!r public & private entities relat$ to prep>$ness =1 & responses to1 cyb]security incid5ts1 consi/5t ) applicable provisions ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bja et seq471 o!r applicable laws1 & ,national ,security ,memor&um-#bb 7,april #cj1 #bjbd2 relat+ to critical infra/ructure security & resili5ce74 ,su* activities %all n include implem5tation or en=cem5t ( "p #afj & subp>ts ,a & ,c ( "p #afd ( title #de1 ,code ( ,f$]al ,regulations 7or successor regulations7 7commonly kn[n z ! ,,hipaa ,security ,rule74 7b7 ,reports 7#a7 ,report on delegation ,n lat] ?an #fj days aft] delegat+ a repres5tative "u subsection 7a71 & any "t a new repres5tative is delegat$ "u su* subsection1 ! ,secret>y %all submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report t describes h[ su* repres5tative w implem5t /eps to improve int]nal & ext]nal cyb]security resili5ce )9 ! ,heal?c>e & ,public ,heal? ,sector4 7#b7 ,annual report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,secret>y %all submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report on ! /ate ( cyb]security 9 ! ,heal?c>e & ,public ,heal? ,sector1 includ+-- 7,a7 an assessm5t ( ! mo/ significant cyb]security ?reats & vuln]abilities fac+ ! ,heal?c>e & ,public ,heal? ,sector2 7,b7 a summ>y ( major cyb]security incid5ts affect+ ! ,heal?c>e & ,public ,heal? ,sector dur+ ! prec$+ ye>2 7,c7 an assessm5t ( ! ov]all cyb]security po/ure ( ! ,heal?c>e & ,public ,heal? ,sector2 7,d7 a description ( actions tak5 by ! ,dep>tm5t ( ,heal? & ,human ,s]vices to improve cyb]security2 & 7,e7 recomm5dations to improve ,heal?c>e & ,public ,heal? ,sector cyb]security4 #e4 ,cyb]security incid5t response plan ,section #dje ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aecc7 is am5d$-- 7#a7 9 subsection 7a7-- 7,a7 9 p>agraph 7#d7-- 7i7 9 ! p>agraph head+1 by ins]t+ in=mation sy/em2 aft] f$]al entity22 & 7ii7 by ins]t+ in=mation sy/em1 aft] ,f$]al entity12 7,b7 by r$esignat+ p>agraphs 7#d7 ?r\gh 7#g7 z p>agraphs 7#f7 ?r\gh 7#i71 respectively2 & 7,c7 by ins]t+ aft] p>agraph 7#c7 ! foll[+3 7#d7 ,cyb]security incid5t ,! t]m cyb]security incid5t has ! mean+ giv5 ! t]m incid5t 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code4 7#e7 ,cyb]security risk ,! t]m cyb]security risk has ! mean+ giv5 su* t]m 9 section #bbjj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej74 2 & 7#b7 9 subsection 7d71 by add+ at ! end ! foll[+3 7#d7 ,plan 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbf1 ! ,secret>y %all exp& & implem5t ! ,cyb] ,annex ( ! ,all ,haz>ds ,plan ( ! ,dep>tm5t ( ,heal? & ,human ,s]vices to in=m applicable p]sonnel )9 ! ,dep>tm5t ( ,heal? & ,human ,s]vices ( processes & protocols to prep>e =1 & respond to1 cyb]security incid5ts4 7,b7 ,scope ,! plan "u subp>agraph 7,a7 %all address cyb]security incid5ts involv+ in=mation sy/ems1 includ+ h>dw>e1 s(tw>e1 databases1 & networks1 us$ or ma9ta9$ by1 or on behalf (1 ! ,dep>tm5t4 7,c7 ,elem5ts ,! plan "u subp>agraph 7,a7 %all include /rategies-- 7i7 to assess cyb]security risks2 7ii7 to prev5t cyb]security incid5ts2 7iii7 to detect & id5tify cyb]security incid5ts2 7iv7 to m9imize damage 9 ! ev5t ( a cyb]security incid5t2 7v7 to protect data2 7vi7 to recov] f any cyb]security incid5ts exp$iti\sly2 & 7vii7 to communicate & %>e non-s5sitive in=mation ab\t cyb]security incid5ts ) entities 9 ! ,heal?c>e & ,public ,heal? ,sector 7z def9$ 9 section #b ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbf74 7,d7 ,consultation ,9 develop+ ! plan "u subp>agraph 7,a71 ! ,secret>y %all consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,director ( ! ,(fice ( ,managem5t & ,budget1 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 & relevant exp]ts1 z appropriate4 7,e7 ,updates ,! ,secret>y %all review & update ! plan "u subp>agraph 7,a7-- 7i7 n less frequ5tly ?an once e #b ye>s2 & 7ii7 aft] any significant cyb]security incid5t affect+ ! ,dep>tm5t ( ,heal? & ,human ,s]vices or a ,f$]al heal? program4 7,f7 ,report ,n lat] ?an #fj days be=e ! date on :i* ! ,secret>y beg9s implem5t+ ! plan "u subp>agraph 7,a71 ! ,secret>y %all submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce1 ! ,committee on ,ov]sight & ,re=m1 & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report t describes su* plan4 4 #f4 ,cl>ify+ brea* report+ obligations ,section #acdjb7;f7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agicb7;f77 is am5d$ by add+ at ! end ! foll[+3 7#f7 ,! numb] ( individuals affect$ by ! brea*4 4 #g4 ,enhanc+ recognition ( security practices 7a7 ,recogniz$ security practices ,section #acdab7;b77#a7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agida7;b77#a77 is am5d$1 9 ! fir/ s5t5ce1 by ins]t+ 1 inve/m5ts1 aft] o!r programs4 7b7 ,regulation ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y %all promulgate regulations implem5t+ section #acdab ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agida71 :i* %all include-- 7#a7 recogniz$ security practices t ! ,secret>y may consid] :5 det]m9+ f9es "u su* section2 7#b7 ! ext5t to :i* su* recogniz$ security practices %\ld be 9 place = consid]ation by ! ,secret>y2 7#c7 proc$ural requirem5ts or in=mation t %all be submitt$ by a cov]$ entity or bus9ess associate to ! ,secret>y = consid]ation2 & 7#d7 h[ ! ,secret>y w take into acc\nt su* recogniz$ security practices :5 det]m9+ f9es1 e>li] favorable t]m9ation ( audits1 or mitigat+ rem$ies t w\ld o!rwise be agre$ to 9 any agreem5t ) respect to resolv+ pot5tial violations ( "p #afj & subp>ts ,a & ,c ( "p #afd ( title #de1 ,code ( ,f$]al ,regulations 7or successor regulations7 7commonly kn[n z ! ,,hipaa ,security ,rule7 betwe5 ! cov]$ entity or bus9ess associate & ! ,dep>tm5t ( ,heal? & ,human ,s]vices4 7c7 ,annual report ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,secret>y %all include 9 ! annual report requir$ "u section #acdbd7;a7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agiec7;a77 in=mation on implem5tation ( section #acdab ( su* ,act 7#db ,u4,s4,c4 #agida71 includ+ an acc\nt+ ( e case 9 :i* ! ,secret>y consid]$ recogniz$ security practices :5 effectuat+ audits & assess+ f9es "u su* section4 #h4 ,requir$ cyb]security /&>ds 7a7 ,9 g5]al ,! ,secret>y %all update ! security regulations "u "p #afj & subp>ts ,a & ,c ( "p #afd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulation71 to require non-gov]nm5tal entities 9 ! ,heal?c>e & ,public ,heal? ,sector & cov]$ entities & bus9ess associates to adopt m9imum risk-bas$ cyb]security practices1 includ+-- 7#a7 multifactor au!ntication1 or a successor te*nology2 7#b7 encryption ( protect$ heal? in=mation1 or a successor te*nology2 7#c7 requirem5ts to conduct monitor+1 includ+ p5etration te/+1 to ma9ta9 ! protections ( in=mation sy/ems2 & 7#d7 o!r m9imum cyb]security /&>ds1 z reflect$ 9 national cyb]security frameworks4 7b7 ,requirem5ts ,! m9imum risk-bas$ cyb]security practices adopt$ pursuant to subsection 7a7 %all be bas$ on-- 7#a7 national cyb]security frameworks1 z appropriate1 su* z-- 7,a7 ! ,national ,in/itute ( ,/&>ds & ,te*nology ,risk ,managem5t ,framework 7or a successor framework72 7,b7 ! ,national ,in/itute ( ,/&>ds & ,te*nology ,cyb]security ,framework 7or a successor framework72 7,c7 ! ,national ,in/itute ( ,/&>ds & ,te*nology ,,sp #hjj-ec r#e ,security & ,privacy ,controls = ,in=mation ,sy/ems & ,organizations 7or a successor special publication71 ) relevant compon5ts ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,privacy ,framework2 or 7,d7 ! ,national ,in/itute ( ,/&>ds & ,te*nology ,artificial ,intellig5ce ,risk ,managem5t ,framework2 7#b7 ! ,heal? ,sector ,coord9at+ ,c\ncil ,cyb]security ,heal?c>e & ,public ,heal? ,cyb]security ,p]=mance ,goals2 & 7#c7 ! heal? c>e-specific cyb]security p]=mance goals ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7c7 ,effective dates ,! regulations updat$ 9 accordance ) subsection 7a71 includ+ ea* new requirem5t e/abli%$1 %all take effect on ! date t is #cf mon?s aft] ! date ( enactm5t ( ?is ,act4 7d7 ,en=cem5t ,! ,secret>y may ex]cise en=cem5t discretion = entities exp]i5c+ extraord9>y circum/ances 9 comply+ ) ! requirem5ts ( subsection 7a74 #i4 ,guidance on rural cyb]security read9ess ,section #dje7;d7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aecc7;d77 7z am5d$ by section #e7b77 is am5d$ by add+ at ! end ! foll[+3 7#e7 ,rural cyb]security guidance 7,a7 ,def9ition ( rural ,9 ?is p>agraph1 ! t]m rural has ! mean+ giv5 su* t]m by ! ,f$]al ,(fice ( ,rural ,heal? ,policy4 7,b7 ,guidance on rural cyb]security read9ess ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbf1 ! ,secret>y %all issue guidance to rural entities on be/ practices to improve cyb]security read9ess1 includ+ /rategies-- 7i7 to improve cyb]security infra/ructure1 includ+ any te*nical safegu>ds to mitigate cyb]security risk2 7ii7 to integrate be/ practices issu$ by ! ,secret>y to improve cyb]security prep>$ness2 7iii7 to improve work=ce prep>ation to mitigate any cyb]security risks1 includ+ exi/+ public-private programs to support educational initiatives2 7iv7 to implem5t policies to facilitate m&atory cyb]security incid5t report+ requirem5ts "u law2 & 7v7 to explore & recomm5d be/ practices1 includ+-- 7,i7 outs\rc+ in=mation te*nology & *ief in=mation security (fic] functions to ?ird p>ties on a "p-"t basis2 7,,ii7 p>ticipat+ 9 regional rural heal? c>e in=mation te*nology managem5t %>+ programs2 & 7,,iii7 migrat+ data to secure cl\d-bas$ plat=ms4 7,c7 ,te*nical assi/ance ,! ,secret>y %all provide te*nical assi/ance to rural entities to implem5t ! recomm5dations includ$ 9 ! guidance "u subp>agraph 7,b74 7,d7 ,,gao /udy & report 7i7 ,9 g5]al ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ! ,heal? ,c>e ,cyb]security & ,resili5cy ,act ( #bjbf1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all conduct a /udy1 & submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report1 on h[ rural entities h implem5t$ ! recomm5dations includ$ 9 ! guidance "u subp>agraph 7,b74 7ii7 ,cont5ts ,! /udy "u clause 7i7 %all assess-- 7,i7 h[ rural entities h implem5t$ any te*nical safegu>ds & any *all5ges fac$ by su* rural entities 9 areas = :i* safegu>ds 7 n implem5t$2 7,,ii7 /eps to fur!r support cyb]security resili5ce = rural entities2 7,,iii7 areas to improve coord9ation betwe5 ,f$]al ag5cies1 includ+ = ! purposes ( requir$ cyb] report+2 & 7,,iv7 any opportunities to support public-private collaboration 9 ! area ( cyb]security read9ess4 4 #aj4 ,grants to enhance cyb]security 9 ! heal? & public heal? sectors 7a7 ,9 g5]al ,! ,secret>y may aw>d grants to eligible entities = ! adoption & implem5tation ( cyb]security be/ practices4 7b7 ,eligible entity ,to be eligible to receive a grant "u subsection 7a71 an entity %all be-- 7#a7 a ,f$]ally qualifi$ heal? c5t] 7z def9$ 9 section #ahfa7;aa77#d7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #aciex7aa77#d7772 7#b7 a heal? facility op]at$ by or pursuant to a contract ) ! ,indian ,heal? ,s]vice2 7#c7 a nonpr(it hospital2 7#d7 a rural heal? cl9ic 7z def9$ 9 section #ahfa7;aa77#b7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #aciex7aa77#b7772 or 7#e7 a nonpr(it entity t ent]s into a p>tn]%ip or coord9ates ref]rals ) an entity describ$ 9 any ( p>agraphs 7#a7 ?r\gh 7#d74 7c7 ,use ( funds ,9 adopt+ & implem5t+ cyb]security be/ practices pursuant to a grant "u subsection 7a71 an eligible entity may use grant funds-- 7#a7 to hire individuals ) demon/rat$ cyb]security exp]tise & tra9 p]sonnel 9 su* cyb]security be/ practices2 7#b7 to update electronic data sy/ems1 su* z by migrat+ to cl\d-bas$ plat=ms2 7#c7 to jo9 & p>ticipate 9 heal? cyb]security ?reat in=mation %>+ organizations2 7#d7 to contract ) ?ird p>ties to assi/ ! eligible entity 9 c>ry+ out ! activities describ$ 9 ?is subsection2 7#e7 to conduct cyb]security risk assessm5ts & vuln]ability assessm5ts2 & 7#f7 to develop or improve cyb]security incid5t response plans4 7d7 ,grant p]iod ,a grant aw>d$ "u ?is section %all be = a p]iod ( n m ?an #c ye>s4 7e7 ,priority ,9 aw>d+ grants "u ?is section1 ! ,secret>y may give consid]ation to ! demon/rat$ ne$ ( eligible entities4 7f7 ,application ,an eligible entity seek+ a grant "u subsection 7a7 %all submit to ! ,secret>y an application at su* "t1 9 su* mann]1 & conta9+ su* in=mation z ! ,secret>y may require1 includ+-- 7#a7 a description ( h[ ! eligible entity w e/abli% basel9e measures & b5*m>ks t meet ! ,secret>y's requirem5ts to evaluate p]=mance outcomes2 & 7#b7 a /rategic plan = h[1 aft] ! end ( ! grant p]iod1 ! eligible entity w su/a9 ! activities fund$ "u ! grant & cont9ue to adopt cyb]security be/ practices4 7g7 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to c>ry out ?is section su* sums z may be necess>y = ea* ( fiscal ye>s #bjbf ?r\gh #bjcj4 #aa4 ,heal?c>e cyb]security work=ce 7a7 ,tra9+ = heal?c>e exp]ts ,! ,secret>y1 9 coord9ation ) ! ,cyb]security ,/ate ,coord9ators ( ! ,ag5cy1 ! ,(fice ( ! ,national ,cyb] ,director1 & private sector heal? c>e exp]ts1 z appropriate1 %all provide tra9+ to ,heal?c>e & ,public ,heal? ,sector entities on-- 7#a7 cyb]security risks to in=mation sy/ems )9 ! ,heal?c>e & ,public ,heal? ,sector2 & 7#b7 ways to mitigate ! risks to in=mation sy/ems 9 ! ,heal?c>e & ,public ,heal? ,sector4 7b7 ,/rategic plan 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y1 act+ ?r\gh ! ,adm9i/rator ( ! ,heal? ,res\rces & ,s]vices ,adm9i/ration1 9 coord9ation ) ! ,ag5cy1 %all develop a /rategic plan to support gr[+ ! cyb]security work=ce = heal? c>e entities4 7#b7 ,cont5ts ,! /rategic plan "u p>agraph 7#a7 %all include-- 7,a7 recomm5dations = exi/+ educational programs t c be us$ to support cyb]security tra9+2 7,b7 dissem9ation & developm5t ( educational mat]ials on h[ to improve cyb]security resili5ce2 7,c7 developm5t ( be/ practices to tra9 ! heal? c>e work=ce on cyb]security be/ practices2 7,d7 developm5t ( recomm5dations specific to rural facilities2 7,e7 developm5t ( be/ practices to lev]age artificial intellig5ce to support cyb]security prep>$ness2 7,f7 opportunities = public-private collaboration to /r5g!n ! cyb]security work=ce2 & 7,g7 alignm5t ) ! ,national ,initiative = ,cyb]security ,education ,work=ce ,framework4 #ab4 ,cyb]security incid5t report+ coord9ation work+ gr\p 7a7 ,work+ gr\p 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y %all conv5e a work+ gr\p to exam9e h[ to /reaml9e & r$uce duplicative report+ = cyb]security incid5ts4 7#b7 ,memb]%ip ,! work+ gr\p describ$ 9 p>agraph 7#a7 %all include repres5tatives (-- 7,a7 ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,b7 ! ,securities & ,ex*ange ,commission2 7,c7 ! ,(fice ( ! ,national ,cyb] ,director2 7,d7 ! ,f$]al ,bureau ( ,inve/igation2 7,e7 ! ,f$]al ,trade ,commission2 7,f7 ,/ate attorneys g5]al2 7,g7 ,/ate heal? dep>tm5ts2 & 7,h7 private sector heal? c>e entities4 7#c7 ,conclusion ,! work+ gr\p %all conclude n lat] ?an #ah mon?s aft] ! date ( ! fir/ meet+ ( ! work+ gr\p4 7b7 ,report ,n lat] ?an #a ye> aft] ! conclusion ( ! work+ gr\p "u subsection 7a77#c71 ! ,secret>y %all submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report t-- 7#a7 id5tifies areas ! work+ gr\p has id5tifi$ to /reaml9e & r$uce duplicative report+2 7#b7 includes recomm5dations to ,congress on fur!r /reaml9+ su* report+2 & 7#c7 addresses coord9ation ) ,/ate brea* notification laws4 ,m>* #bc1 #bjbf,report$ ) an am5dm5t