,,ii  #aai? ,,congress  #b;d ,session   
,s4 #eeda  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,septemb] #bd1         
#bjbf,mr4 ,m>key introduc$ ! foll[+     
bill2 :i* 0 read twice & ref]r$ to !    
,committee on ,comm]ce1 ,sci5ce1 &      
,transportation  ,a ,,bill  ,to e/abli% 
! ,cyb]security & ,,ai ,bo>d (          
,inve/igations1 & = o!r purposes4  #a4  
,%ort title ,?is ,act may be cit$ z !   
,cyb]security & ,,ai ,bo>d (            
,inve/igations ,act ( #bjbf4  #b4       
,f9d+s2 purpose  7a7 ,f9d+s ,congress   
f9ds ! foll[+3 7#a7 ,robu/ cyb]security 
infra/ructure & in/itutions are integral
 to national security & economic        
security4  7#b7 ,cyb] ?reats h become m 
p]vasive & pot5tially m disruptive )    
cont9u$ digitization across economic    
sectors4  7#c7 ,! advancem5t & increas$ 
accessibility ( artificial intellig5ce c
 /r5g!n cyb]security controls :ile also 
increas+ ! volume & sophi/ication ( cyb]
 ?reats4  7#d7 ,critical infra/ructure  
sectors1 su* z clean & wa/ewat]         

utilities & telecommunications networks1
 are susceptible to artificial          
intellig5ce-enabl$ cyb] incid5ts4  7#e7 
,z artificial intellig5ce sy/ems cont9ue
 to evolve1 ^! tr5ds 9 cyb]security     
?reats w accel]ate4  7#f7 ,o!r em]g+    
te*nologies1 includ+ quantum comput+1   
are likely to pose additional1 novel    
cyb]security ?reats t w comp\nd on      
artificial intellig5ce-driv5 risks4     
7#g7 ,! ,f$]al ,gov]nm5t has an int]e/ 9
 und]/&+ cyb] incid5ts 9 ?is %ift+ ?reat
 l&scape & advanc+ be/ practices 9      
cyb]security4  7b7 ,purpose ,! purposes 
( ?is ,act are-- 7#a7 to e/abli% !      
,cyb]security & ,,ai ,bo>d (            
,inve/igations2 &  7#b7 to bol/] ! cyb] 
def5ses ( public & private in/itutions 9
 respond+ to ! cyb] risks pos$ by       
artificial intellig5ce & o!r em]g+      
te*nologies4  #c4 ,cyb]security & ,,ai  
,bo>d ( ,inve/igations  7a7 ,def9itions 
,9 ?is section3 7#a7 ,artificial        
intellig5ce ,! t]m artificial           
intellig5ce has ! mean+ giv5 ! t]m 9    

section #bch7;g7 ( ! ,national ,def5se  
,au?orization ,act = ,fiscal ,ye> #bjai 
7#aj ,u4,s4,c4 note prec4 #djfa2 ,public
 ,law #aae-bcb74  7#b7 ,bo>d ,! t]m     
,bo>d means ! ,cyb]security & ,,ai ,bo>d
 ( ,inve/igations e/abli%$ "u subsection
 7b77#a74  7#c7 ,*air ,! t]m ,*air means
 ! ,*air ( ! ,bo>d designat$ "u         
subsection 7c77#c77;,a77i74  7#d7       
,cyb]security purpose2 cyb]security     
?reat2 in=mation sy/em2 security        
control2 security vuln]ability ,! t]ms  
cyb]security purpose1 cyb]security      
?reat1 in=mation sy/em1 security        
control1 & security vuln]ability h !    
mean+s giv5 ^? t]ms 9 section #bbjj ( ! 
,homel& ,security ,act ( #bjjb 7#f      
,u4,s4,c4 #fej74  7#e7 ,f$]al ag5cy ,!  
t]m ,f$]al ag5cy means any executive    
dep>tm5t1 milit>y dep>tm5t1             
,gov]nm5t-controll$ corporation1 or o!r 
e/abli%m5t 9 ! executive bran* ( !      
,f$]al ,gov]nm5t1 includ+ ! ,executive  
,(fice ( ! ,presid5t or any indep5d5t   
regulatory ag5cy4  7#f7 ,f$]al civilian 

executive bran* ag5cy  7,a7 ,9 g5]al    
,except z provid$ 9 subp>agraph 7,b71 ! 
t]m ,f$]al civilian executive bran*     
ag5cy means a ,f$]al ag5cy4  7,b7       
,exception ,! t]m ,f$]al civilian       
executive bran* ag5cy does n include !  
,dep>tm5t ( ,def5se or any ,f$]al ag5cy 
t is an elem5t ( ! intellig5ce          
community1 z def9$ 9 section #c7d7 ( !  
,national ,security ,act ( #aidg 7#ej   
,u4,s4,c4 #cjjc7d774  7#g7 ,f$]al       
civilian executive bran* in=mation sy/em
  7,a7 ,9 g5]al ,except z provid$ 9     
subp>agraph 7,b71 ! t]m ,f$]al civilian 
executive bran* in=mation sy/em means   
any in=mation sy/em op]at$ by a ,f$]al  
civilian executive bran* ag5cy4  7,b7   
,exception ,! t]m ,f$]al civilian       
executive bran* in=mation sy/em does n  
include-- 7i7 a national security sy/em1
 z def9$ 9 section #ceeb7;b7 ( title    
#dd1 ,unit$ ,/ates ,code2 or  7ii7 a    
sy/em describ$ 9 p>agraph 7#b7 or 7#c7 (
 section #ceec7;e7 ( title #dd1 ,unit$  
,/ates ,code4  7#h7 ,incid5t ,! t]m     

incid5t means an occurr5ce t actually or
 imm95tly jeop>dizes1 )\t lawful        
au?ority-- 7,a7 ! integrity1            
confid5tiality1 or availability (       
in=mation on an in=mation sy/em2 or     
7,b7 an in=mation sy/em4  7#i7 ,ne>-miss
 ,! t]m ne>-miss means a circum/ance--  
7,a7 9 :i* a kn[n or newly discov]$     
security vuln]ability is exploit$ 9 an  
attempt to jeop>dize ! integrity1       
confid5tiality1 or availability (       
in=mation on an in=mation sy/em2 &  7,b7
 ?r\gh :i* no h>m am\nt+ to a           
significant cyb] incid5t1 z def9$ by !  
,bo>d1 is realiz$4  7#aj7 ,relevant     
congressional committees ,! t]m relevant
 congressional committees means-- 7,a7 !
 ,committee on ,comm]ce1 ,sci5ce1 &     
,transportation ( ! ,s5ate2  7,b7 !     
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate2  7,c7 !
 ,committee on ,en]gy & ,comm]ce ( !    
,h\se ( ,repres5tatives2 &  7,d7 !      
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives4  7b7           

,e/abli%m5t2 purposes2 organization     
7#a7 ,e/abli%m5t ,on ! date t is #ij    
days aft] ! date ( enactm5t ( ?is ,act1 
!re is e/abli%$ z an indep5d5t          
e/abli%m5t1 z def9$ 9 section #ajd (    
title #e1 ,unit$ ,/ates ,code1 !        
,cyb]security & ,,ai ,bo>d (            
,inve/igations4  7#b7 ,*>t] ,! ,bo>d    
e/abli%$ "u p>agraph 7#a7 %all e/abli% a
 *>t]1 :i* %all be made publicly        
available1 t includes non-exhau/ive     
crit]ia =1 & in=m ! prioritization (1 ! 
"w ( ! ,bo>d1 includ+-- 7,a7 initiat+   
reviews & assessm5ts ( incid5ts2  7,b7  
conduct+ tr5d analyses2 &  7,c7 plac+ a 
limitation on incid5ts eligible = review
 to incid5ts = :i* all evid5ce1 factual 
f9d+s1 & recomm5dations are unclassifi$ 
or declassifi$ to ! be/ k ( ! ,bo>d at !
 "t ( selection4  7#c7 ,purposes ,!     
purposes ( ! ,bo>d are to-- 7,a7 advance
 ! safety1 reliability1 & resili5ce ( ! 
digital & communications infra/ructure (
 ! ,unit$ ,/ates1 :i* supports comm]ce1 
innovation1 & public safety2  7,b7      

conduct indep5d5t & imp>tial reviews &  
assessm5ts ) respect to-- 7i7 incid5ts  
affect+ ,f$]al civilian executive bran* 
in=mation sy/ems or non-,f$]al in=mation
 sy/ems1 p>ticul>ly su* sy/ems t support
 critical infra/ructure sectors2  7ii7  
ne>-misses 9 :i* a significant          
cyb]security incid5t 0 n>r[ly av]t$2    
7iii7 sy/emic cyb]security              
vuln]abilities across sectors1 v5dors1  
or te*nology categories1 includ+ )9 !   
artificial intellig5ce sector1 t give   
rise to incid5ts affect+ relevant ,f$]al
 civilian executive bran* & non-,f$]al  
in=mation sy/ems2 &  7iv7 breakd[ns 9   
regulatory ov]sight1 coord9ation1 or    
response processes ) respect to incid5ts
 & sy/emic risks affect+ critical       
infra/ructure sectors2  7,c7 id5tify    
contribut+ te*nical1 organizational1 &  
sy/emic failures relat+ to ea* review & 
assessm5t conduct$ "u subp>agraph 7,b7 9
 ord] to produce actionable             
recomm5dations = implicat$ public &     
private entities on improv+ ! resili5ce 

( ! ,unit$ ,/ates ) respect to          
cyb]security ?reats & security          
vuln]abilities2  7,d7 9 coord9ation ) ! 
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology & ! ,assi/ant       
,secret>y ( ,comm]ce = ,communications &
 ,in=mation1 e/abli% & ma9ta9 ! ne>-miss
 sy/em e/abli%$ "u p>agraph 7#d7 to     
collect & analyze confid5tial reports ( 
incid5ts & ne>-misses f public & private
 entities = ! purpose ( improv+ !       
resili5ce ( ! ,unit$ ,/ates ) respect to
 security vuln]abilities2  7,e7         
facilitate le>n+ & transp>5cy across !  
public & private sectors by publicly    
releas+ timely reports ( ! reviews &    
assessm5ts conduct$ "u subp>agraph 7,b72
  7,f7 issue tr5d analyses ) respect to 
recurr+ cyb]security ?reats1 security   
vuln]abilities1 & sy/emic risk patt]ns1 
) att5tion paid to ! novel & int5sifi$  
risks relat+ to ! cont9u$ developm5t &  
adoption ( artificial intellig5ce2  7,g7
 ma9ta9 a hi/orical record ( major      
incid5ts & contribut+ risk patt]ns )    

respect to ^? major incid5ts to promote 
! proactive r$uction ( cyb]security     
?reats & security vuln]abilities across 
critical infra/ructure sectors2 &  7,h7 
op]ate indep5d5tly f regulatory review &
 en=cem5t actions )\t assign+ legal     
fault or liability = any review &       
assessm5t conduct$ "u subp>agraph 7,b74 
7#d7 ,(fices1 bureaus1 & divisions ( !  
,bo>d ,! ,bo>d %all e/abli% su* di/9ct &
 appropriately /aff$ (fices1 bureaus1 & 
divisions z may be necess>y to c>ry out 
?is section & inve/igate & report on    
incid5ts1 :i* %all include ! foll[+3    
7,a7 ,! ,(fice ( ,inve/igations1 :i*    
%all be responsible =-- 7i7 conduct+    
inve/igations into significant incid5ts1
 failures ( in=mation sy/ems1 intrusions
 into in=mation sy/ems1 & ne>-misses2   
7ii7 develop+ ! factual record necess>y 
= ! ,bo>d to det]m9e ! causes (1 &      
contribut+ factors to1 ! matt]s describ$
 9 clause 7i72 &  7iii7 support+ !      
developm5t ( reports1 f9d+s1 &          
recomm5dations ( ! ,bo>d "u ?is section4

  7,b7 ,! ,(fice ( ,tr5d ,analysis &    
,le>n+1 :i* %all be responsible =-- 7i7 
adm9i/]+ ! ne>-miss report+ sy/em       
e/abli%$ "u p>agraph 7#e71 :i* may in=m 
wid] tr5d analyses2  7ii7 issu+ public  
tr5d reports to promote proactive       
r$uction ( cyb]security ?reats &        
security vuln]abilities across critical 
infra/ructure sectors2 &  7iii7 conduct+
 ongo+ analysis ( ! novel & int5sify+   
cyb]security risks pos$ by em]g+        
te*nologies1 includ+ artificial         
intellig5ce4  7,c7 7i7 ,! ,(fice (      
,coord9ation1 :i* %all be responsible   
=-- 7,i7 s]v+ z ! pr9cipal liaison      
betwe5 ! ,bo>d & ,f$]al ag5cies1 includ+
 = ! purpose ( facilitat+ secure        
in=mation %>+ & coord9ation dur+        
inve/igations conduct$ by ! ,bo>d2      
7,,ii7 s]v+ z ! pr9cipal liaison betwe5 
! ,bo>d & private sector entities2 &    
7,,iii7 coord9at+ ) ! ,(fice (          
,inve/igations to ensure timely &       
effici5t access to relevant ,f$]al1     
,/ate1 local1 & private sector p]sonnel1

 sy/ems1 & in=mation = ! purposes ( an  
inve/igation conduct$ by ! ,bo>d2 &     
7ii7 ,! ,(fice ( ,coord9ation %all      
e/abli% sep>ate int]nal functional      
units1 z appropriate1 to manage         
coord9ation ) ,f$]al entities &         
coord9ation ) private sector entities1  
respectively1 9 ord] to ensure cle>     
*annels ( communication & pres]ve !     
indep5d5ce ( inve/igative activities    
conduct$ by ! ,bo>d4  7#e7 ,volunt>y    
ne>-miss report+ sy/em ,! ,bo>d %all    
e/abli% a volunt>y1 anonymiz$ ne>-miss  
report+ sy/em1 :i* %all-- 7,a7 all[     
individuals & organizations to          
confid5tially report ne>-misses )9      
critical infra/ructure sectors1 includ+ 
ev5ts t c\ld h disrupt$ critical        
communications or comm]ce sy/ems or     
expos$ private data2  7,b7 protect f    
disclosure ! id5tity ( ea* individual or
 organization submitt+ a report "u      
subp>agraph 7,a72  7,c7 be design$ to   
id5tify sy/emic security vuln]abilities 
across te*nologies1 sectors1 & gov]nance

 models2 &  7,d7 support proactive risk 
managem5t & le>n+ )\t attribution (     
fault or liability4  7c7 ,memb]%ip  7#a7
 ,bo>d memb]s  7,a7 ,9 g5]al ,! ,bo>d   
%all be compos$ ( #e memb]s1 ea* ( :om  
%all be appo9t$-- 7i7 by ! ,presid5t1 by
 & ) ! advice & cons5t ( ! ,s5ate2 &    
7ii7 on ! basis ( te*nical              
qualification1 pr(essional /&+1 &       
demon/rat$ k 9 cyb]security or relat$   
fields4  7,b7 ,limitation ,n m ?an #c   
memb]s ( ! ,bo>d may be memb]s ( ! same 
political p>ty4  7#b7 ,t]ms ( (fice &   
removal  7,a7 ,9 g5]al ,ea* memb] ( !   
,bo>d %all hold (fice = a t]m ( #e ye>s4
  7,b7 ,vacancies ,a memb] ( ! ,bo>d    
appo9t$ to fill a vacancy occurr+ be=e !
 expiration ( ! t]m = :i* ! pr$ecessor (
 t memb] 0 appo9t$ %all be appo9t$ = !  
rema9d] ( t t]m4  7,c7 ,end ( t]m ,:5 ! 
t]m ( (fice ( a memb] ( ! ,bo>d ends1 ! 
memb] may cont9ue to s]ve until a       
successor is appo9t$ pursuant to        
p>agraph 7#a77;,a74  7,d7 ,removal ,!   
,presid5t may remove a memb] ( ! ,bo>d =

 ineffici5cy1 neglect ( duty1 or        
malfeasance 9 (fice4  7,e7 ,pay ,ea*    
memb] ( ! ,bo>d %all be paid an annual  
rate ( basic pay n to exce$ ! rate paid 
= a position at level ,,iv ( !          
,executive ,s*$ule "u section #ecae (   
title #e1 ,unit$ ,/ates ,code4  7#c7    
,*air & ,vice ,*air  7,a7 ,*air  7i7 ,9 
g5]al ,! ,presid5t %all designate1 by & 
) ! advice & cons5t ( ! ,s5ate1 a ,*air 
( ! ,bo>d4  7ii7 ,duties & p[]s ,! ,*air
 %all-- 7,i7 s]ve z ! *ief executive &  
adm9i/rative (fic] ( ! ,bo>d2 &  7,,ii7 
subject to ! g5]al policies & decisions 
( ! ,bo>d-- 7aa7 appo9t & sup]vise      
(fic]s & employees1 o!r ?an regul> &    
full-"t employees ( ! (fices ( o!r      
memb]s ( ! ,bo>d1 necess>y to c>ry out  
?is section2  7bb7 fix ! pay ( (fic]s & 
employees :o are appo9t$ to c>ry out ?is
 section2  7cc7 di/ribute bus9ess among 
! (fic]s1 employees1 & adm9i/rative     
units ( ! ,bo>d2 &  7dd7 sup]vise !     
exp5ditures ( ! ,bo>d4  7,b7 ,vice ,*air
 ,! ,presid5t %all designate a ,vice    

,*air ( ! ,bo>d1 by & ) ! advice &      
cons5t ( ! ,s5ate4  7,c7 ,t]ms ,! ,*air 
& ,vice ,*air %all ea* hold (fice = a   
t]m ( #c ye>s4  7,d7 ,vacancy ,:5 !     
,*air is abs5t or unable to s]ve1 or :5 
! position ( ,*air is vacant1 ! ,vice   
,*air %all s]ve z ,*air4  7#d7 ,p]sonnel
 matt]s  7,a7 ,9 g5]al ,subject to      
subp>agraph 7,b71 ea* memb] ( ! ,bo>d   
%all appo9t & sup]vise employees 9 !    
(fice ( t memb]1 provid$ t ea* su*      
employee has be5 approv$ = employm5t ) !
 ,bo>d by ! designat$ ag5cy e?ics       
(ficial ) respect to ! ,bo>d "u ! same  
guidel9es t apply to all employees ( !  
,bo>d4  7,b7 ,limitation ,except )      
respect to ! (fice ( ! ,*air ( ! ,bo>d1 
! au?ority "u subp>agraph 7,a7 %all be  
limit$ to ! numb] ( full-"t equival5t   
positions 7plus #a s5ior pr(essional    
position1 ! annual rate ( basic pay (   
:i* %all be n great] ?an t = /ep #aj (  
grade #ae ( ! ,g5]al ,s*$ule71 z        
allocat$ annually by ! ,*air ( ! ,bo>d  
?r\gh ! int]nal /aff+ plan ( ! ,bo>d4   

7d7 ,conv5+ ! ,bo>d  7#a7 ,9 g5]al ,!   
,bo>d-- 7,a7 %all meet n few] ?an #d    
times ea* cal5d> ye> at a "t & date to  
be det]m9$ by ! ,*air2 &  7,b7 may meet 
at additional times at ! call ( ! ,*air4
  7#b7 ,quorum ,?ree memb]s ( ! ,bo>d   
%all con/itute a quorum = conduct+ !    
bus9ess ( ! ,bo>d4  7e7 ,review &       
assessm5t2 reports  7#a7 ,initiation (  
review ,! ,bo>d may initiate a review & 
assessm5t describ$ 9 subsection         
7b77#b77;,b7 ^u a majority vote ( all   
memb]s ( ! ,bo>d1 ! results ( :i* %all  
be made publicly available4  7#b7       
,comm5cem5t ( review & assessm5t ,9     
addition to a meet+ ( ! ,bo>d conv5$ "u 
subsection 7d71 ! ,*air may1 at any "t1 
call a meet+ ( ! ,bo>d to initiate a    
review & assessm5t describ$ 9 subsection
 7b77#c77;,b74  7#c7 ,reports ,^u       
complet+ ea* review & assessm5t describ$
 9 subsection 7b77#c77;,b71 ! ,bo>d %all
 prep>e a report ) respect to ! ev5t t  
is ! subject ( ! review & assessm5t t-- 
7,a7 conta9s factual f9d+s & actionable 

recomm5dations = improv+ cyb]security   
practices1 sy/emic resili5ce1 incid5t   
response practices & policies1 &        
coord9ation across public & private     
entities2  7,b7 includes-- 7i7 a timel9e
 ( relevant ev5ts2  7ii7 an analysis (  
contribut+ te*nical1 organizational1 &  
sy/emic factors ) respect to !          
applicable ev5t2  7iii7 a section relat+
 to insights & lessons le>n$ t-- 7,i7   
id5tifies-- 7aa7 factors t enhanc$ or   
imp$$ ! review & assessm5t by ! ,bo>d2 &
  7bb7 any gaps 9 au?orities1 tools1 or 
int]ag5cy coord9ation2 &  7,,ii7 conta9s
 recomm5dations to improve ! future     
op]ations ( ! ,bo>d2  7iv7 app5dices t  
include-- 7,i7 te*nical indicators (    
compromise1 su* z data po9ts or         
artifacts t id5tify or describe ! me?ods
 us$ 9 an incid5t2 &  7,,ii7 detail$    
me?odological in=mation ) respect to !  
analytical processes1 tools1 & te*nical 
me?ods us$ to conduct ea* review &      
assessm5t describ$ 9 subsection         
7b77#c77;,b72 &  7v7 a pla9 language    

executive summ>y ( ! matt]s describ$ 9  
?is p>agraph1 :i* %all be accessible to 
a non-te*nical audi5ce2 &  7,c7 is in=m$
 by & compos$ ( only unclassifi$ or     
declassifi$ in=mation & in=mation       
appropriate = public consumption4  7#d7 
,updates ,! insights & lessons le>n$    
describ$ 9 p>agraph 7#c77;,b77iii7      
%all-- 7,a7 in=m updates to ,bo>d       
proc$ures1 tra9+1 & coord9ation         
protocols2 &  7,b7 be %>$ across !      
,f$]al cyb]security ecosy/em to improve 
int]ag5cy read9ess4  7#e7 ,public       
availability ,! ,bo>d %all-- 7,a7 submit
 to ! relevant congressional committees 
ea* report prep>$ "u p>agraph 7#c71     
consi/5t ) ! protections = docum5ts &   
te/imony volunt>ily provid$ to ! ,bo>d  
"u subsection 7i77#b72 &  7,b7 make ea* 
report prep>$ "u p>agraph 7#c7 publicly 
available1 consi/5t ) ! protections =   
docum5ts & te/imony volunt>ily provid$  
to ! ,bo>d "u subsection 7i77#b74  7#f7 
,responses ,n lat] ?an #ij days aft] !  
date on :i* ! ,bo>d issues a report     

prep>$ "u p>agraph 7#c7 t includes a    
recomm5dation apply+ to a ,f$]al        
civilian executive bran* ag5cy1 ea* su* 
,f$]al civilian executive bran* ag5cy   
%all respond 9 writ+ to t recomm5dation1
 ev5 :5 ! ,f$]al civilian executive     
bran* ag5cy does n foll[ ! recomm5d$    
c\rse ( action1 to all[ ! ,bo>d to track
 ! progress ( implem5tation across all (
 ! recomm5dations ( ! ,bo>d4  7f7       
,p]sonnel  7#a7 ,9 g5]al ,! ,bo>d %all  
be support$ by a p]man5t1 full-"t ,f$]al
 /aff1 :i* may include positions z--    
7,a7 lead inve/igators2  7,b7 malw>e    
analy/s2  7,c7 sy/em eng9e]s2  7,d7     
legal c\nsel2  7,e7 digital =5sic       
exp]ts2  7,f7 communications            
pr(essionals & te*nical writ]s2 &  7,g7 
o!r subject matt] exp]ts1 z det]m9$     
necess>y by ! ,*air4  7#b7 ,additional  
/aff ,9 addition to ! /aff describ$ 9   
p>agraph 7#a71 a memb] ( ! ,bo>d may    
nom9ate p]sonal support /aff to assi/ 9 
! "w ( ! ,bo>d1 subject to applicable   
backgr\nd *ecks1 security cle>ances1 &  

f9ancial disclosure requirem5ts4  7#c7  
,p]sonnel flexibility ,to increase !    
capabilities ( ! ,bo>d1 ! ,bo>d may--   
7,a7 ent] into agreem5ts ) f$]ally fund$
 rese>* & developm5t c5t]s2  7,b7 appo9t
 special ,gov]nm5t employees1 z def9$ 9 
section #bjb7;a7 ( title #ah1 ,unit$    
,/ates ,code2 &  7,c7 z necess>y1       
contract ) private sector or academic   
exp]ts to s]ve z inve/igators4  7g7     
,exemption f c]ta9 laws ,! ,bo>d %all n 
be subject to-- 7#a7 *apt] #aj ( title  
#e1 ,unit$ ,/ates ,code 7commonly kn[n z
 ! ,f$]al ,advisory ,committee ,act72 or
  7#b7 section #eeb;b ( title #e1 ,unit$
 ,/ates ,code 7commonly kn[n z !        
,gov]nm5t 9 ! ,sun%9e ,act74  7h7 ,bo>d 
managem5t  7#a7 ,9 g5]al ,to ensure t ! 
,bo>d fulfills ! purposes describ$ 9    
subsection 7b77#c71 ! ,*air %all take   
all necess>y actions to manage ! affairs
 ( ! ,bo>d & ! conduct ( ! reviews &    
assessm5ts describ$ 9 subsection        
7b77#c77;,b71 :i* %all include-- 7,a7   
develop+ & promulgat+1 ) ! approval ( ! 

,bo>d1 a *>t] & o!r bylaws & int]nal    
proc$ures conc]n+ ! "w ( ! ,bo>d1       
includ+ non-exhau/ive crit]ia = def9+ a 
significant cyb]security incid5t &      
select+ incid5ts = inve/igation1 all (  
:i* %all be made public2 &  7,b7 mak+   
contracts & ent]+ into agreem5ts )      
,f$]al dep>tm5ts & ,f$]al ag5cies z     
necess>y & appropriate to c>ry out !    
responsibilities ( ! ,bo>d1 includ+ by  
coord9at+ ) ! ,secret>y ( ,comm]ce1 !   
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology1 & ! ,assi/ant      
,secret>y ( ,comm]ce = ,communications &
 ,in=mation4  7#b7 ,p>ty sy/em  7,a7 ,9 
g5]al ,! ,*air may adopt a p>ty         
p>ticipation sy/em "u :i* an            
organization affect$ by a matt] t is    
subject to a review & assessm5t describ$
 9 subsection 7b77#c77;,b71 includ+ any 
entity op]at+ or provid+ digital        
communications1 te*nology products1 or  
critical infra/ructure s]vices implicat$
 9 t matt]1 may provide factual input = 
inve/igators ( ! ,bo>d4  7,b7 ,level (  

p>ticipation ,a p>ty t provides factual 
input "u subp>agraph 7,a7 may n         
p>ticipate 9 draft+ f9d+s or %ap+       
recomm5dations conta9$ 91 or review+1 a 
f9al report ( ! ,bo>d be=e publication (
 t report4  7#c7 ,conflicts ( int]e/ ,! 
,*air %all implem5t a sy/em to id5tify1 
mitigate1 & manage any conflicts (      
int]e/ t may arise z a result (         
p>ticipation by an individual 9 ! "w ( !
 ,bo>d "u ?is section4  7i7 ,reque/s =  
in=mation & adm9i/rative subpo5as  7#a7 
,purpose ,9 ord] to ensure t ! ,bo>d has
 suffici5t in=mation to conduct !       
reviews & assessm5ts requir$ "u         
subsection 7e7 & issue reports "u t     
subsection1 ! ,*air1 or an appropriate  
designee ( ! ,*air1 may reque/ & receive
 relevant docum5ts 7includ+ 9 electronic
 =m7 & te/imony f1 & issue subpo5as ad  
te/ific&um & subpo5as duces tecum to--  
7,a7 any entity or individual affect$ by
 ! incid5t or issue giv+ rise to a      
review & assessm5t "u subsection 7e72   
7,b7 any entity t1 or individual :o1    

respond$ to ! incid5t or issue describ$ 
9 subp>agraph 7,a72 or  7,c7 any o!r    
entity or individual t ! ,bo>d          
reasonably believes may h in=mation     
relevant to ! review & assessm5t c>ri$  
out1 or report issu$1 "u subsection 7e74
  7#b7 ,volunt>y provision ( in=mation  
7,a7 ,9 g5]al ,any entity or individual 
may volunt>ily provide ! ,bo>d )        
docum5ts1 includ+ 9 electronic =m1 &    
te/imony relevant to a review &         
assessm5t c>ri$ out1 or report issu$1 by
 ! ,bo>d "u subsection 7e71 ) or )\t a  
,bo>d reque/ = ^? docum5ts or t         
te/imony4  7,b7 ,bo>d reque/ = in=mation
 ,if ! ,*air has reason to believe t an 
entity or individual has in=mation      
relevant to an incid5t "u review by !   
,bo>d "u subsection 7e71 ! ,*air1 or an 
appropriate designee ( ! ,*air1 may     
reque/ t in=mation f ! entity or        
individual4  7,c7 ,treatm5t ( in=mation 
provid$ 9 response to a ,bo>d reque/    
,any docum5t1 includ+ 9 electronic =m1  
or te/imony provid$ to ! ,bo>d 9        

response to a reque/ "u subp>agraph 7,b7
 %all be-- 7i7 treat$ z volunt>ily      
provid$2 &  7ii7 subject to !           
protections set =? "u subsection 7j74   
7#c7 ,subpo5a au?ority  7,a7 ,9 g5]al   
,if ! ,*air1 or an appropriate designee 
( ! ,*air1 det]m9es t ! response1 or    
lack ( a response1 by an entity or an   
individual to a reque/ made "u p>agraph 
7#b77;,b7 is defici5t1 ! ,*air1 or an   
appropriate designee ( ! ,*air1 may1    
subject to approval "u subp>agraph      
7,b77i7 ( ?is p>agraph1 issue a subpo5a 
to compel ! disclosure ( docum5ts1      
includ+ 9 electronic =m1 & te/imony     
relevant to an incid5t "u ,bo>d review  
"u subsection 7e74  7,b7 ,proc$ures  7i7
 ,9 g5]al ,be=e ! issuance ( a subpo5a  
"u subp>agraph 7,a71 a simple majority (
 ! memb]s ( ! ,bo>d mu/ approve !       
issuance ( ! subpo5a4  7ii7             
,consid]ations ,9 evaluat+ :e!r to      
approve a subpo5a "u subp>agraph 7,a71 !
 memb]s ( ! ,bo>d %all consid] factors  
includ+-- 7,i7 :e!r ! ,bo>d is able to  

obta9 ! docum5ts1 includ+ 9 electronic  
=m1 or te/imony ?r\gh o!r non-compulsory
 means2  7,,ii7 :e!r fur!r communication
 ) ! entity or individual is likely to  
produce ! docum5ts1 includ+ 9 electronic
 =m1 or te/imony on a volunt>y basis2   
7,,iii7 :e!r1 bas$ on ! nature ( !      
reque/1 a reasonable am\nt ( "t has     
elaps$ to all[ ! entity or individual to
 volunt>ily provide ! docum5ts1 includ+ 
9 electronic =m1 or te/imony to ! ,bo>d2
  7,,iv7 ! importance ( ! reque/$       
docum5ts1 includ+ 9 electronic =m1 or   
te/imony to ! ability ( ! ,bo>d to      
complete a full & complete review &     
assessm5t or report "u subsection 7e72 &
  7,v7 :e!r1 aft] consultation )        
relevant ,f$]al ag5cies1 ! subpo5a w\ld 
affect a regulatory1 law en=cem5t1 =eign
 intellig5ce1 or diplomatic ef=t ( !    
,unit$ ,/ates4  7,c7 ,civil action  7i7 
,9 g5]al ,if an entity or individual    
fails to comply ) a subpo5a issu$ "u ?is
 p>agraph1 ! ,*air may ref] ! matt] to !
 ,attorney ,g5]al to br+ a civil action 

9 an appropriate di/rict c\rt ( ! ,unit$
 ,/ates to en=ce ! subpo5a4  7ii7 ,v5ue 
,an action "u ?is subp>agraph %all be   
br\ght 9 ! judicial di/rict 9 :i* !     
entity aga9/ :i*1 or ! individual aga9/ 
:om1 ! civil action is br\ght resides1  
is f\nd1 or does bus9ess1 or 9 !        
,di/rict ( ,columbia4  7iii7 ,contempt (
 c\rt ,a c\rt may puni% a failure to    
comply ) a subpo5a issu$ "u ?is p>agraph
 z contempt ( c\rt4  7,d7 ,exclusion =  
gov]nm5t entities ,?is p>agraph %all n  
apply to a ,/ate1 local1 ,tribal1       
t]ritorial1 or ,f$]al ,gov]nm5t entity1 
or to any employee ( t entity ) respect 
to matt]s relat$ to ! (ficial duties ( !
 employee4  7,e7 ,delegation ( subpo5a  
au?ority ,! au?ority ( ! ,*air to issue 
a subpo5a "u ?is p>agraph may only be   
delegat$ to ano!r ,bo>d memb]4  7,f7    
,au!ntication  7i7 ,9 g5]al ,any subpo5a
 issu$ electronically "u ?is p>agraph   
%all be au!nticat$ ) a cryptographic    
digital signature1 or o!r comp>able     
successor te*nology1 ( ! ,*air or       

designee ( ! ,*air1 t all[s ! ,*air or !
 designee ( ! ,*air to demon/rate t !   
subpo5a 0 issu$ by ! ,*air or ! designee
 ( ! ,*air & has n be5 alt]$ or modifi$ 
s9ce ! subpo5a 0 issu$4  7ii7 ,invalid  
if n au!nticat$ ,any subpo5a issu$      
electronically pursuant to ?is p>agraph 
t is n au!nticat$ 9 accordance ) clause 
7i7 %all n be consid]$ to be valid by ! 
recipi5t ( ! subpo5a or by any c\rt4    
7,g7 ,pres]vation ,= purposes ( section 
#bgjc7;f7 ( title #ah1 ,unit$ ,/ates    
,code1 ! ,bo>d %all be consid]$ to be a 
gov]nm5tal entity4  7,h7 ,protections = 
in=mation obta9$ by subpo5a ,any        
docum5t1 includ+ 9 electronic =m1 or    
te/imony obta9$ by a subpo5a "u ?is     
p>agraph-- 7i7 %all n be subject to     
subsection 7j72 &  7ii7 9 ! discretion (
 ! ,bo>d1 may be protect$ f public      
disclosure :]e o!rwise consi/5t )       
applicable law4  7#d7 ,/or$             
,communications ,act ,no?+ 9 ?is        
subsection may be con/ru$ to p]mit or   
require disclosure by a provid] ( a     

remote comput+ s]vice or a provid] ( an 
electronic communication s]vice to !    
public ( in=mation n o!rwise p]mitt$ or 
requir$ to be disclos$ "u *apt] #aba (  
title #ah1 ,unit$ ,/ates ,code 7commonly
 kn[n z ! ,/or$ ,communications ,act74  
7#e7 ,in=mation f ,f$]al ag5cies  7,a7  
,reque/s ,! ,*air1 or an appropriate    
designee ( ! ,*air1 may reque/ f any    
,f$]al ag5cy su* in=mation z necess>y to
 c>ry out ! duties ( ! ,bo>d4  7,b7     
,furni%+ in=mation ,^u reque/ ( ! ,*air1
 or ! appropriate designee ( ! ,*air1 "u
 subp>agraph 7,a71 ! head ( a ,f$]al    
ag5cy %all furni% ! applicable in=mation
 to ! ,bo>d4  7j7 ,protections =        
in=mation volunt>ily provid$ to ! ,bo>d 
7#a7 ,application ,! protections 9 ?is  
subsection %all apply to any docum5t1   
includ+ 9 electronic =m1 or te/imony    
volunt>ily provid$ to ! ,bo>d "u        
subsection 7i77#b74  7#b7 ,disclosure1  
ret5tion1 & use ,any docum5t1 includ+ 9 
electronic =m1 & te/imony volunt>ily    
provid$ to ! ,bo>d may be disclos$ to1  

reta9$ by1 & us$ by any ,f$]al ag5cy or 
dep>tm5t1 compon5t1 (fic]1 employee1 or 
ag5t ( ! ,f$]al ,gov]nm5t1 consi/5t )   
o!rwise applicable provisions ( ,f$]al  
law1 solely-- 7,a7 = a cyb]security     
purpose2  7,b7 to id5tify-- 7i7 a       
cyb]security ?reat1 includ+ ! s\rce ( ! 
cyb]security ?reat2 or  7ii7 a security 
vuln]ability2  7,c7 to respond to1 or   
o!rwise prev5t or mitigate1 a specific  
?reat ( dea?1 a specific ?reat ( s]i\s  
bodily h>m1 or a specific ?reat ( s]i\s 
economic h>m1 includ+ a t]rori/ act or  
use ( a weapon ( mass de/ruction2  7,d7 
to respond to1 inve/igate1 prosecute1 or
 o!rwise prev5t or mitigate1 a s]i\s    
?reat to a m9or1 includ+ sexual         
exploitation & ?reats to physical       
safety2 or  7,e7 to prev5t1 inve/igate1 
disrupt1 or prosecute an (f5se aris+ out
 ( an incid5t or issue assess$ by !     
,bo>d1 pursuant to subsection 7e71 or   
any ( ! (f5ses li/$ 9 section           
#aje7;d77#e77;,a77v7 ( ! ,cyb]security  
,act ( #bjae 7#f ,u4,s4,c4              

#aejd7;d77#e77;,a77v774  7#c7           
,protections = entities & in=mation ,any
 docum5t1 includ+ 9 electronic =m1 or   
te/imony volunt>ily provid$ to ! ,bo>d  
"u subsection 7i77#b7 %all-- 7,a7 be    
consid]$ ! comm]cial1 f9ancial1 &       
propriet>y in=mation ( ! provid+ entity 
or individual :5 s designat$ by t entity
 or individual2  7,b7 be exempt f       
disclosure "u-- 7i7 section #eeb7;b77#c7
 ( title #e1 ,unit$ ,/ates ,code        
7commonly kn[n z ! ,fre$om ( ,in=mation 
,act72 &  7ii7 any provision ( ,/ate1   
,tribal1 or local fre$om ( in=mation    
law1 op5 gov]nm5t law1 op5 meet+s law1  
op5 records law1 sun%9e law1 or simil>  
law requir+ disclosure ( in=mation or   
records2  7,c7 be consid]$ n to         
con/itute a waiv] ( any applicable      
privilege or protection provid$ by law1 
includ+ trade secret protection2 &  7,d7
 n be subject to a rule ( any ,f$]al    
ag5cy or any judicial doctr9e reg>d+ ex 
p>te communications ) a decision-mak+   
(ficial4  7#d7 ,liability protections   

7,a7 ,9 g5]al ,no cause ( action aris+ f
 ! volunt>y provision ( docum5ts to !   
,bo>d "u subsection 7i77#b7 %all lie or 
be ma9ta9$ 9 any c\rt by any p]son1 &   
any su* action %all be promptly         
dismiss$4  7,b7 ,re/rictions  7i7 ,9    
g5]al ,subject to clause 7ii71 no       
submission volunt>ily provid$ to ! ,bo>d
 "u subsection 7i77#b71 or any          
communication1 docum5t1 mat]ial1 or o!r 
record1 creat$ = ! sole purpose (       
prep>+1 draft+1 or submitt+ su*         
submission1 may be receiv$ 9 evid5ce1   
subject to discov]y1 or o!rwise us$ 9   
any trial1 he>+1 or o!r proce$+ 9 or    
be=e any c\rt1 regulatory body1 or o!r  
au?ority ( ! ,unit$ ,/ates1 a ,/ate1 or 
a political subdivision ( a ,/ate4  7ii7
 ,exception ,?is subp>agraph %all n     
prev5t ! use1 ret5tion1 or disclosure ( 
in=mation 9 ! docum5ts or te/imony      
describ$ 9 clause 7i7 to inve/igate or  
prosecute a p]son or entity suspect$ or 
alleg$ to h committ$1 conspir$ to       
commit1 or aid$ & abett$ ! commission (1

 an incid5t describ$ 9 ! docum5ts or    
te/imony1 provid$ t ! submission itself 
is n disclos$4  7,c7 ,rule ( con/ruction
 ,no?+ 9 ?is p>agraph may be con/ru$ to 
create a def5se to discov]y or o!rwise  
affect ! discov]y ( any communication1  
docum5t1 mat]ial1 or o!r record n creat$
 = ! sole purpose ( prep>+1 draft+1 or  
submitt+ su* submission1 except t ?is   
p>agraph %all n apply to in=mation      
develop$ f a s\rce indep5d5t ( a        
submission submitt$ "u subsection       
7i77#b74  7k7 ,additional privacy &     
digital security protections  7#a7      
,privacy & civil lib]ties ,any docum5t1 
includ+ 9 electronic =m1 or te/imony    
provid$ to or obta9$ by ! ,bo>d %all be 
reta9$1 us$1 & dissem9at$1 :]e          
p]missible & appropriate1 by ! ,f$]al   
,gov]nm5t 9 a mann] t protects p]sonal  
in=mation f unau?oriz$ use or unau?oriz$
 disclosure4  7#b7 ,digital security    
,any docum5t1 includ+ 9 electronic =m1  
or te/imony provid$ to or obta9$ by !   
,bo>d %all be collect$1 /or$1 &         

protect$1 at a m9imum1 9 accordance ) ! 
requirem5ts = mod]ate impact ,f$]al     
in=mation sy/ems1 z describ$ 9 ,f$]al   
,in=mation ,process+ ,/&>ds ,publication
 #aii ( ! ,national ,in/itute ( ,/&>ds &
 ,te*nology1 or any successor docum5t4