I 

118TH CONGRESS 

2D SESSION H. R. 9315 

To direct the Secretary of the Treasury to submit a report on coordination 

in the public and private sectors in responding to ransomware attacks 

on financial institutions, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

AUGUST 6, 2024 

Mr. NUNN of Iowa (for himself and Mr. GOTTHEIMER) introduced the 

following bill; which was referred to the Committee on Financial Services 

A BILL 

To direct the Secretary of the Treasury to submit a report 

on coordination in the public and private sectors in responding to ransomware attacks on financial institutions, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Public and Private 

5 Sector Ransomware Response Coordination Act of 2024’’. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•HR 9315 IH

1 SEC. 2. REPORT ON COORDINATION IN THE PUBLIC AND 

2 PRIVATE SECTORS IN RESPONDING TO 

3 RANSOMWARE ATTACKS ON FINANCIAL IN4 STITUTIONS. 

5 (a) IN GENERAL.—Not later than one year after the 

6 date of the enactment of this section, the Secretary of the 

7 Treasury shall submit to the appropriate congressional 

8 committees a report that describes the following: 

9 (1) The current level of coordination and col10 laboration between the public and private sectors, in11 cluding entities in the public and private sectors that 

12 manage cybersecurity, in response to, and for the 

13 prevention of, a ransomware attack on a financial 

14 institution. 

15 (2) The coordination among relevant govern16 mental agencies in response to, and for the preven17 tion of, a ransomware attack on a financial institu18 tion. 

19 (3) Whether relevant governmental agencies 

20 have timely access to relevant information reported 

21 by a financial institution following a ransomware at22 tack on the financial institution. 

23 (4) The utility of such information to any rel24 evant governmental agency in the prevention or in25 vestigation of a ransomware attack on a financial inVerDate Sep 11 2014 03:34 Sep 07, 2024 Jkt 049200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H9315.IH H9315

kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•HR 9315 IH

1 stitution, or the prosecution of a person responsible 

2 for such attack. 

3 (5) An analysis of reporting requirements appli4 cable to a financial institution with respect to a 

5 ransomware attack in relation to the utility to any 

6 relevant governmental agency of the reported infor7 mation in the prevention or investigation of a 

8 ransomware attack on a financial institution, or the 

9 prosecution of a person responsible for such attack. 

10 (6) Whether further legislation is required to 

11 increase the utility and timely access of such infor12 mation to any relevant governmental agency fol13 lowing a ransomware attack on a financial institu14 tion. 

15 (7) Any recommended policy initiatives to bol16 ster public-private partnerships, increase incident re17 port sharing, and decrease incident response time. 

18 (8) The extent to which, and reasons that, fi19 nancial institutions withhold or delay reporting to 

20 relevant governmental agencies information about a 

21 ransomware attack. 

22 (9) Any feedback on the contents of the report 

23 received from cybersecurity and ransomware re24 sponse entities that provide services to financial in25 stitutions. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•HR 9315 IH

1 (b) FORM OF REPORT.—The report described in sub2 section (a) shall be submitted in unclassified form, but 

3 may include a classified annex. 

4 (c) BRIEFING.—Not later than 15 months after the 

5 date of the enactment of this section, the Secretary of the 

6 Treasury shall brief the appropriate congressional commit7 tees on the findings of the report described in subsection 

8 (a). 

9 (d) DEFINITIONS.—In this section: 

10 (1) APPROPRIATE CONGRESSIONAL COMMIT11 TEES.—The term ‘‘appropriate congressional com12 mittees’’ means— 

13 (A) the Committee on Financial Services 

14 of the House of Representatives; 

15 (B) the Permanent Select Committee on 

16 Intelligence of the House of Representatives; 

17 (C) the Committee on Banking, Housing, 

18 and Urban Affairs of the Senate; and 

19 (D) the Select Committee on Intelligence 

20 of the Senate. 

21 (2) CYBERSECURITY AND RANSOMWARE INCI22 DENT RESPONSE ENTITY.—The term ‘‘cybersecurity 

23 and ransomware incident response entity’’ means an 

24 entity that provides incident responses, managed 

25 services, or advisory services that— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•HR 9315 IH

1 (A) supports investigation and risk man2 agement related to ransomware attacks in the 

3 public and private sectors; 

4 (B) strengthens cybersecurity technology 

5 in the financial sector; and 

6 (C) reduces overall cyber risk in the finan7 cial sector by assessing the security posture of 

8 a financial institution, assisting a financial in9 stitution with regulatory compliance, and pro10 viding recommendations to a financial institu11 tion for recovery after a ransomware attack and 

12 prevention of any future attacks. 

13 (3) FINANCIAL INSTITUTION.—The term ‘‘fi14 nancial institution’’ has the meaning given that term 

15 under section 5312(a) of title 31, United States 

16 Code. 

Æ 


kjohnson on DSK7ZCZBW3PROD with $$_JOB