117TH CONGRESS 

2D SESSION S. 3600 

AN ACT 

To improve the cybersecurity of the Federal Government, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

†S 3600 ES

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Strengthening Amer3 ican Cybersecurity Act of 2022’’. 

4 SEC. 2. TABLE OF CONTENTS. 

5 The table of contents for this Act is as follows: 

Sec. 1. Short title. 

Sec. 2. Table of contents. 

TITLE I—FEDERAL INFORMATION SECURITY MODERNIZATION 

ACT OF 2022 

Sec. 101. Short title. 

Sec. 102. Definitions. 

Sec. 103. Title 44 amendments. 

Sec. 104. Amendments to subtitle III of title 40. 

Sec. 105. Actions to enhance Federal incident transparency. 

Sec. 106. Additional guidance to agencies on FISMA updates. 

Sec. 107. Agency requirements to notify private sector entities impacted by incidents. 

Sec. 108. Mobile security standards. 

Sec. 109. Data and logging retention for incident response. 

Sec. 110. CISA agency advisors. 

Sec. 111. Federal penetration testing policy. 

Sec. 112. Ongoing threat hunting program. 

Sec. 113. Codifying vulnerability disclosure programs. 

Sec. 114. Implementing zero trust architecture. 

Sec. 115. Automation reports. 

Sec. 116. Extension of Federal acquisition security council and software inventory. 

Sec. 117. Council of the Inspectors General on Integrity and Efficiency dashboard. 

Sec. 118. Quantitative cybersecurity metrics. 

Sec. 119. Establishment of risk-based budget model. 

Sec. 120. Active cyber defensive study. 

Sec. 121. Security operations center as a service pilot. 

Sec. 122. Extension of Chief Data Officer Council. 

Sec. 123. Federal Cybersecurity Requirements. 

TITLE II—CYBER INCIDENT REPORTING FOR CRITICAL 

INFRASTRUCTURE ACT OF 2022 

Sec. 201. Short title. 

Sec. 202. Definitions. 

Sec. 203. Cyber incident reporting. 

Sec. 204. Federal sharing of incident reports. 

Sec. 205. Ransomware vulnerability warning pilot program. 

Sec. 206. Ransomware threat mitigation activities. 

Sec. 207. Congressional reporting. 

TITLE III—FEDERAL SECURE CLOUD IMPROVEMENT AND JOBS 

ACT OF 2022 
3 

†S 3600 ES

Sec. 301. Short title. 

Sec. 302. Findings. 

Sec. 303. Title 44 amendments. 

1 TITLE I—FEDERAL INFORMA2 TION SECURITY MODERNIZA3 TION ACT OF 2022 

4 SEC. 101. SHORT TITLE. 

5 This title may be cited as the ‘‘Federal Information 

6 Security Modernization Act of 2022’’. 

7 SEC. 102. DEFINITIONS. 

8 In this title, unless otherwise specified: 

9 (1) ADDITIONAL CYBERSECURITY PROCE10 DURE.—The term ‘‘additional cybersecurity proce11 dure’’ has the meaning given the term in section 

12 3552(b) of title 44, United States Code, as amended 

13 by this title. 

14 (2) AGENCY.—The term ‘‘agency’’ has the 

15 meaning given the term in section 3502 of title 44, 

16 United States Code. 

17 (3) APPROPRIATE CONGRESSIONAL COMMIT18 TEES.—The term ‘‘appropriate congressional com19 mittees’’ means— 

20 (A) the Committee on Homeland Security 

21 and Governmental Affairs of the Senate; 

22 (B) the Committee on Oversight and Re23 form of the House of Representatives; and 
4 

†S 3600 ES

1 (C) the Committee on Homeland Security 

2 of the House of Representatives. 

3 (4) DIRECTOR.—The term ‘‘Director’’ means 

4 the Director of the Office of Management and Budg5 et. 

6 (5) INCIDENT.—The term ‘‘incident’’ has the 

7 meaning given the term in section 3552(b) of title 

8 44, United States Code. 

9 (6) NATIONAL SECURITY SYSTEM.—The term 

10 ‘‘national security system’’ has the meaning given 

11 the term in section 3552(b) of title 44, United 

12 States Code. 

13 (7) PENETRATION TEST.—The term ‘‘penetra14 tion test’’ has the meaning given the term in section 

15 3552(b) of title 44, United States Code, as amended 

16 by this title. 

17 (8) THREAT HUNTING.—The term ‘‘threat 

18 hunting’’ means proactively and iteratively searching 

19 systems for threats that evade detection by auto20 mated threat detection systems. 

21 SEC. 103. TITLE 44 AMENDMENTS. 

22 (a) SUBCHAPTER I AMENDMENTS.—Subchapter I of 

23 chapter 35 of title 44, United States Code, is amended— 

24 (1) in section 3504— 

25 (A) in subsection (a)(1)(B)— 
5 

†S 3600 ES

1 (i) by striking clause (v) and inserting 

2 the following: 

3 ‘‘(v) confidentiality, privacy, disclosure, 

4 and sharing of information;’’; 

5 (ii) by redesignating clause (vi) as 

6 clause (vii); and 

7 (iii) by inserting after clause (v) the 

8 following: 

9 ‘‘(vi) in consultation with the National 

10 Cyber Director, security of information; and’’; 

11 and 

12 (B) in subsection (g), by striking para13 graph (1) and inserting the following: 

14 ‘‘(1) develop and oversee the implementation of 

15 policies, principles, standards, and guidelines on pri16 vacy, confidentiality, disclosure, and sharing, and in 

17 consultation with the National Cyber Director, over18 see the implementation of policies, principles, stand19 ards, and guidelines on security, of information col20 lected or maintained by or for agencies; and’’; 

21 (2) in section 3505— 

22 (A) by striking the first subsection des23 ignated as subsection (c); 

24 (B) in paragraph (2) of the second sub25 section designated as subsection (c), by insert-
6 

†S 3600 ES

1 ing ‘‘an identification of internet accessible in2 formation systems and’’ after ‘‘an inventory 

3 under this subsection shall include’’; 

4 (C) in paragraph (3) of the second sub5 section designated as subsection (c)— 

6 (i) in subparagraph (B)— 

7 (I) by inserting ‘‘the Director of 

8 the Cybersecurity and Infrastructure 

9 Security Agency, the National Cyber 

10 Director, and’’ before ‘‘the Comp11 troller General’’; and 

12 (II) by striking ‘‘and’’ at the end; 

13 (ii) in subparagraph (C)(v), by strik14 ing the period at the end and inserting ‘‘; 

15 and’’; and 

16 (iii) by adding at the end the fol17 lowing: 

18 ‘‘(D) maintained on a continual basis through 

19 the use of automation, machine-readable data, and 

20 scanning, wherever practicable.’’; 

21 (3) in section 3506— 

22 (A) in subsection (a)(3), by inserting ‘‘In 

23 carrying out these duties, the Chief Information 

24 Officer shall coordinate, as appropriate, with 

25 the Chief Data Officer in accordance with the 
7 

†S 3600 ES

1 designated functions under section 3520(c).’’ 

2 after ‘‘reduction of information collection bur3 dens on the public.’’; 

4 (B) in subsection (b)(1)(C), by inserting ‘‘, 

5 availability’’ after ‘‘integrity’’; and 

6 (C) in subsection (h)(3), by inserting ‘‘se7 curity,’’ after ‘‘efficiency,’’; and 

8 (4) in section 3513— 

9 (A) by redesignating subsection (c) as sub10 section (d); and 

11 (B) by inserting after subsection (b) the 

12 following: 

13 ‘‘(c) Each agency providing a written plan under sub14 section (b) shall provide any portion of the written plan 

15 addressing information security to the Secretary of the 

16 Department of Homeland Security and the National Cyber 

17 Director.’’. 

18 (b) SUBCHAPTER II DEFINITIONS.— 

19 (1) IN GENERAL.—Section 3552(b) of title 44, 

20 United States Code, is amended— 

21 (A) by redesignating paragraphs (1), (2), 

22 (3), (4), (5), (6), and (7) as paragraphs (2), 

23 (4), (5), (6), (7), (9), and (11), respectively; 

24 (B) by inserting before paragraph (2), as 

25 so redesignated, the following: 
8 

†S 3600 ES

1 ‘‘(1) The term ‘additional cybersecurity proce2 dure’ means a process, procedure, or other activity 

3 that is established in excess of the information secu4 rity standards promulgated under section 11331(b) 

5 of title 40 to increase the security and reduce the cy6 bersecurity risk of agency systems.’’; 

7 (C) by inserting after paragraph (2), as so 

8 redesignated, the following: 

9 ‘‘(3) The term ‘high value asset’ means infor10 mation or an information system that the head of an 

11 agency, using policies, principles, standards, or 

12 guidelines issued by the Director under section 

13 3553(a), determines to be so critical to the agency 

14 that the loss or corruption of the information or the 

15 loss of access to the information system would have 

16 a serious impact on the ability of the agency to per17 form the mission of the agency or conduct busi18 ness.’’; 

19 (D) by inserting after paragraph (7), as so 

20 redesignated, the following: 

21 ‘‘(8) The term ‘major incident’ has the meaning 

22 given the term in guidance issued by the Director 

23 under section 3598(a).’’; 

24 (E) by inserting after paragraph (9), as so 

25 redesignated, the following: 
9 

†S 3600 ES

1 ‘‘(10) The term ‘penetration test’— 

2 ‘‘(A) means an authorized assessment that 

3 emulates attempts to gain unauthorized access 

4 to, or disrupt the operations of, an information 

5 system or component of an information system; 

6 and 

7 ‘‘(B) includes any additional meaning 

8 given the term in policies, principles, standards, 

9 or guidelines issued by the Director under sec10 tion 3553(a).’’; and 

11 (F) by inserting after paragraph (11), as 

12 so redesignated, the following: 

13 ‘‘(12) The term ‘shared service’ means a cen14 tralized business or mission capability that is pro15 vided to multiple organizations within an agency or 

16 to multiple agencies.’’. 

17 (2) CONFORMING AMENDMENTS.— 

18 (A) HOMELAND SECURITY ACT OF 2002.— 

19 Section 1001(c)(1)(A) of the Homeland Secu20 rity Act of 2002 (6 U.S.C. 511(1)(A)) is 

21 amended by striking ‘‘section 3552(b)(5)’’ and 

22 inserting ‘‘section 3552(b)’’. 

23 (B) TITLE 10.— 

24 (i) SECTION 2222.—Section 2222(i)(8) 

25 of title 10, United States Code, is amended 
10 

†S 3600 ES

1 by striking ‘‘section 3552(b)(6)(A)’’ and 

2 inserting ‘‘section 3552(b)(9)(A)’’. 

3 (ii) SECTION 2223.—Section 

4 2223(c)(3) of title 10, United States Code, 

5 is amended by striking ‘‘section 

6 3552(b)(6)’’ and inserting ‘‘section 

7 3552(b)’’. 

8 (iii) SECTION 2315.—Section 2315 of 

9 title 10, United States Code, is amended 

10 by striking ‘‘section 3552(b)(6)’’ and in11 serting ‘‘section 3552(b)’’. 

12 (iv) SECTION 2339A.—Section 

13 2339a(e)(5) of title 10, United States 

14 Code, is amended by striking ‘‘section 

15 3552(b)(6)’’ and inserting ‘‘section 

16 3552(b)’’. 

17 (C) HIGH-PERFORMANCE COMPUTING ACT

18 OF 1991.—Section 207(a) of the High-Perform19 ance Computing Act of 1991 (15 U.S.C. 

20 5527(a)) is amended by striking ‘‘section 

21 3552(b)(6)(A)(i)’’ and inserting ‘‘section 

22 3552(b)(9)(A)(i)’’. 

23 (D) INTERNET OF THINGS CYBERSECU24 RITY IMPROVEMENT ACT OF 2020.—Section 3(5) 

25 of the Internet of Things Cybersecurity Im-
11 

†S 3600 ES

1 provement Act of 2020 (15 U.S.C. 278g–3a) is 

2 amended by striking ‘‘section 3552(b)(6)’’ and 

3 inserting ‘‘section 3552(b)’’. 

4 (E) NATIONAL DEFENSE AUTHORIZATION

5 ACT FOR FISCAL YEAR 2013.—Section 

6 933(e)(1)(B) of the National Defense Author7 ization Act for Fiscal Year 2013 (10 U.S.C. 

8 2224 note) is amended by striking ‘‘section 

9 3542(b)(2)’’ and inserting ‘‘section 3552(b)’’. 

10 (F) IKE SKELTON NATIONAL DEFENSE AU11 THORIZATION ACT FOR FISCAL YEAR 2011.—The 

12 Ike Skelton National Defense Authorization Act 

13 for Fiscal Year 2011 (Public Law 111–383) is 

14 amended— 

15 (i) in section 806(e)(5) (10 U.S.C. 

16 2304 note), by striking ‘‘section 3542(b)’’ 

17 and inserting ‘‘section 3552(b)’’; 

18 (ii) in section 931(b)(3) (10 U.S.C. 

19 2223 note), by striking ‘‘section 

20 3542(b)(2)’’ and inserting ‘‘section 

21 3552(b)’’; and 

22 (iii) in section 932(b)(2) (10 U.S.C. 

23 2224 note), by striking ‘‘section 

24 3542(b)(2)’’ and inserting ‘‘section 

25 3552(b)’’. 
12 

†S 3600 ES

1 (G) E-GOVERNMENT ACT OF 2002.—Sec2 tion 301(c)(1)(A) of the E-Government Act of 

3 2002 (44 U.S.C. 3501 note) is amended by 

4 striking ‘‘section 3542(b)(2)’’ and inserting 

5 ‘‘section 3552(b)’’. 

6 (H) NATIONAL INSTITUTE OF STANDARDS

7 AND TECHNOLOGY ACT.—Section 20 of the Na8 tional Institute of Standards and Technology 

9 Act (15 U.S.C. 278g–3) is amended— 

10 (i) in subsection (a)(2), by striking 

11 ‘‘section 3552(b)(5)’’ and inserting ‘‘sec12 tion 3552(b)’’; and 

13 (ii) in subsection (f)— 

14 (I) in paragraph (3), by striking 

15 ‘‘section 3532(1)’’ and inserting ‘‘sec16 tion 3552(b)’’; and 

17 (II) in paragraph (5), by striking 

18 ‘‘section 3532(b)(2)’’ and inserting 

19 ‘‘section 3552(b)’’. 

20 (c) SUBCHAPTER II AMENDMENTS.—Subchapter II 

21 of chapter 35 of title 44, United States Code, is amend22 ed— 

23 (1) in section 3551— 
13 

†S 3600 ES

1 (A) in paragraph (4), by striking ‘‘diag2 nose and improve’’ and inserting ‘‘integrate, de3 liver, diagnose, and improve’’; 

4 (B) in paragraph (5), by striking ‘‘and’’ at 

5 the end; 

6 (C) in paragraph (6), by striking the pe7 riod at the end and inserting a semi colon; and 

8 (D) by adding at the end the following: 

9 ‘‘(7) recognize that each agency has specific 

10 mission requirements and, at times, unique cyberse11 curity requirements to meet the mission of the agen12 cy; 

13 ‘‘(8) recognize that each agency does not have 

14 the same resources to secure agency systems, and an 

15 agency should not be expected to have the capability 

16 to secure the systems of the agency from advanced 

17 adversaries alone; and 

18 ‘‘(9) recognize that a holistic Federal cybersecu19 rity model is necessary to account for differences be20 tween the missions and capabilities of agencies.’’; 

21 (2) in section 3553— 

22 (A) in subsection (a)— 

23 (i) in paragraph (1), by inserting ‘‘, in 

24 consultation with the Secretary and the 
14 

†S 3600 ES

1 National Cyber Director,’’ before ‘‘over2 seeing’’; 

3 (ii) in paragraph (5), by striking 

4 ‘‘and’’ at the end; and 

5 (iii) by adding at the end the fol6 lowing: 

7 ‘‘(8) promoting, in consultation with the Direc8 tor of the Cybersecurity and Infrastructure Security 

9 Agency, the National Cyber Director, and the Direc10 tor of the National Institute of Standards and Tech11 nology— 

12 ‘‘(A) the use of automation to improve 

13 Federal cybersecurity and visibility with respect 

14 to the implementation of Federal cybersecurity; 

15 and 

16 ‘‘(B) the use of presumption of com17 promise and least privilege principles to improve 

18 resiliency and timely response actions to inci19 dents on Federal systems.’’; 

20 (B) in subsection (b)— 

21 (i) in the matter preceding paragraph 

22 (1), by inserting ‘‘and the National Cyber 

23 Director’’ after ‘‘Director’’; and 

24 (ii) in paragraph (2)(A), by inserting 

25 ‘‘and reporting requirements under sub-
15 

†S 3600 ES

1 chapter IV of this chapter’’ after ‘‘section 

2 3556’’; and 

3 (C) in subsection (c)— 

4 (i) in the matter preceding paragraph 

5 (1)— 

6 (I) by striking ‘‘each year’’ and 

7 inserting ‘‘each year during which 

8 agencies are required to submit re9 ports under section 3554(c)’’; and 

10 (II) by striking ‘‘preceding year’’ 

11 and inserting ‘‘preceding 2 years’’; 

12 (ii) by striking paragraph (1); 

13 (iii) by redesignating paragraphs (2), 

14 (3), and (4) as paragraphs (1), (2), and 

15 (3), respectively; 

16 (iv) in paragraph (3), as so redesig17 nated, by striking ‘‘and’’ at the end; 

18 (v) by inserting after paragraph (3), 

19 as so redesignated the following: 

20 ‘‘(4) a summary of each assessment of Federal 

21 risk posture performed under subsection (i);’’; and 

22 (vi) in paragraph (5), by striking the 

23 period at the end and inserting ‘‘; and’’; 
16 

†S 3600 ES

1 (D) by redesignating subsections (i), (j), 

2 (k), and (l) as subsections (j), (k), (l), and (m) 

3 respectively; 

4 (E) by inserting after subsection (h) the 

5 following: 

6 ‘‘(i) FEDERAL RISK ASSESSMENTS.—On an ongoing 

7 and continuous basis, the Director of the Cybersecurity 

8 and Infrastructure Security Agency shall perform assess9 ments of Federal risk posture using any available informa10 tion on the cybersecurity posture of agencies, and brief 

11 the Director and National Cyber Director on the findings 

12 of those assessments including— 

13 ‘‘(1) the status of agency cybersecurity remedial 

14 actions described in section 3554(b)(7); 

15 ‘‘(2) any vulnerability information relating to 

16 the systems of an agency that is known by the agen17 cy; 

18 ‘‘(3) analysis of incident information under sec19 tion 3597; 

20 ‘‘(4) evaluation of penetration testing per21 formed under section 3559A; 

22 ‘‘(5) evaluation of vulnerability disclosure pro23 gram information under section 3559B; 

24 ‘‘(6) evaluation of agency threat hunting re25 sults; 
17 

†S 3600 ES

1 ‘‘(7) evaluation of Federal and non-Federal 

2 cyber threat intelligence; 

3 ‘‘(8) data on agency compliance with standards 

4 issued under section 11331 of title 40; 

5 ‘‘(9) agency system risk assessments performed 

6 under section 3554(a)(1)(A); and 

7 ‘‘(10) any other information the Director of the 

8 Cybersecurity and Infrastructure Security Agency 

9 determines relevant.’’; 

10 (F) in subsection (j), as so redesignated— 

11 (i) by striking ‘‘regarding the spe12 cific’’ and inserting ‘‘that includes a sum13 mary of— 

14 ‘‘(1) the specific’’; 

15 (ii) in paragraph (1), as so des16 ignated, by striking the period at the end 

17 and inserting ‘‘; and’’ and 

18 (iii) by adding at the end the fol19 lowing: 

20 ‘‘(2) the trends identified in the Federal risk 

21 assessment performed under subsection (i).’’; and 

22 (G) by adding at the end the following: 

23 ‘‘(n) BINDING OPERATIONAL DIRECTIVES.—If the 

24 Director of the Cybersecurity and Infrastructure Security 

25 Agency issues a binding operational directive or an emer-
18 

†S 3600 ES

1 gency directive under this section, not later than 4 days 

2 after the date on which the binding operational directive 

3 requires an agency to take an action, the Director of the 

4 Cybersecurity and Infrastructure Security Agency shall 

5 provide to the Director, National Cyber Director, the 

6 Committee on Homeland Security and Governmental Af7 fairs of the Senate and the Committee on Oversight and 

8 Reform of the House of Representatives the status of the 

9 implementation of the binding operational directive at the 

10 agency. 

11 ‘‘(o) REVIEW OF OFFICE OF MANAGEMENT AND

12 BUDGET GUIDANCE AND POLICY.— 

13 ‘‘(1) REVIEW.— 

14 ‘‘(A) IN GENERAL.—Not less frequently 

15 than once every 3 years, the Director, in con16 sultation with the Chief Information Officers 

17 Council, the Director of the Cybersecurity and 

18 Infrastructure Security Agency, the National 

19 Cyber Director, the Comptroller General of the 

20 United States, and the Council of the Inspec21 tors General on Integrity and Efficiency, 

22 shall— 

23 ‘‘(i) review the efficacy of the guid24 ance and policy developed by the Director 

25 under subsection (a)(1) in reducing cyber-
19 

†S 3600 ES

1 security risks, including an assessment of 

2 the requirements for agencies to report in3 formation to the Director; and 

4 ‘‘(ii) determine whether any changes 

5 to the guidance or policy developed under 

6 subsection (a)(1) is appropriate. 

7 ‘‘(B) CONSIDERATIONS.—In conducting 

8 the review required under subparagraph (A), 

9 the Director shall consider— 

10 ‘‘(i) the Federal risk assessments per11 formed under subsection (i); 

12 ‘‘(ii) the cumulative reporting and 

13 compliance burden to agencies; and 

14 ‘‘(iii) the clarity of the requirements 

15 and deadlines contained in guidance and 

16 policy documents. 

17 ‘‘(2) UPDATED GUIDANCE.—Not later than 90 

18 days after the date on which a review is completed 

19 under paragraph (1), the Director shall issue up20 dated guidance or policy to agencies determined ap21 propriate by the Director, based on the results of the 

22 review. 

23 ‘‘(3) PUBLIC REPORT.—Not later than 30 days 

24 after the date on which the Director completes a re-
20 

†S 3600 ES

1 view under paragraph (1), the Director shall make 

2 publicly available a report that includes— 

3 ‘‘(A) an overview of the guidance and pol4 icy developed under subsection (a)(1) that is in 

5 effect; 

6 ‘‘(B) the cybersecurity risk mitigation, or 

7 other cybersecurity benefit, offered by each 

8 guidance or policy described in subparagraph 

9 (A); 

10 ‘‘(C) a summary of the guidance or policy 

11 developed under subsection (a)(1) to which 

12 changes were determined appropriate during 

13 the review; and 

14 ‘‘(D) the changes that are anticipated to 

15 be included in the updated guidance or policy 

16 issued under paragraph (2). 

17 ‘‘(4) CONGRESSIONAL BRIEFING.—Not later 

18 than 60 days after the date on which a review is 

19 completed under paragraph (1), the Director shall 

20 provide to the Committee on Homeland Security and 

21 Governmental Affairs of the Senate and the Com22 mittee on Oversight and Reform of the House of 

23 Representatives a briefing on the review. 

24 ‘‘(p) AUTOMATED STANDARD IMPLEMENTATION

25 VERIFICATION.—When the Director of the National Insti-
21 

†S 3600 ES

1 tute of Standards and Technology issues a proposed 

2 standard pursuant to paragraphs (2) or (3) of section 

3 20(a) of the National Institute of Standards and Tech4 nology Act (15 U.S.C. 278g–3(a)), the Director of the Na5 tional Institute of Standards and Technology shall con6 sider developing and, if appropriate and practical, develop, 

7 in consultation with the Director of the Cybersecurity and 

8 Infrastructure Security Agency, specifications to enable 

9 the automated verification of the implementation of the 

10 controls within the standard.’’; 

11 (3) in section 3554— 

12 (A) in subsection (a)— 

13 (i) in paragraph (1)— 

14 (I) by redesignating subpara15 graphs (A), (B), and (C) as subpara16 graphs (B), (C), and (D), respectively; 

17 (II) by inserting before subpara18 graph (B), as so redesignated, the fol19 lowing: 

20 ‘‘(A) on an ongoing and continuous basis, 

21 performing agency system risk assessments 

22 that— 

23 ‘‘(i) identify and document the high 

24 value assets of the agency using guidance 

25 from the Director; 
22 

†S 3600 ES

1 ‘‘(ii) evaluate the data assets inven2 toried under section 3511 for sensitivity to 

3 compromises in confidentiality, integrity, 

4 and availability; 

5 ‘‘(iii) identify agency systems that 

6 have access to or hold the data assets 

7 inventoried under section 3511; 

8 ‘‘(iv) evaluate the threats facing agen9 cy systems and data, including high value 

10 assets, based on Federal and non-Federal 

11 cyber threat intelligence products, where 

12 available; 

13 ‘‘(v) evaluate the vulnerability of 

14 agency systems and data, including high 

15 value assets, including by analyzing— 

16 ‘‘(I) the results of penetration 

17 testing performed by the Department 

18 of Homeland Security under section 

19 3553(b)(9); 

20 ‘‘(II) the results of penetration 

21 testing performed under section 

22 3559A; 

23 ‘‘(III) information provided to 

24 the agency through the vulnerability 
23 

†S 3600 ES

1 disclosure program of the agency 

2 under section 3559B; 

3 ‘‘(IV) incidents; and 

4 ‘‘(V) any other vulnerability in5 formation relating to agency systems 

6 that is known to the agency; 

7 ‘‘(vi) assess the impacts of potential 

8 agency incidents to agency systems, data, 

9 and operations based on the evaluations 

10 described in clauses (ii) and (iv) and the 

11 agency systems identified under clause 

12 (iii); and 

13 ‘‘(vii) assess the consequences of po14 tential incidents occurring on agency sys15 tems that would impact systems at other 

16 agencies, including due to interconnectivity 

17 between different agency systems or oper18 ational reliance on the operations of the 

19 system or data in the system;’’; 

20 (III) in subparagraph (B), as so 

21 redesignated, in the matter preceding 

22 clause (i), by striking ‘‘providing in23 formation’’ and inserting ‘‘using infor24 mation from the assessment con-
24 

†S 3600 ES

1 ducted under subparagraph (A), pro2 viding information’’; 

3 (IV) in subparagraph (C), as so 

4 redesignated— 

5 (aa) in clause (ii) by insert6 ing ‘‘binding’’ before ‘‘oper7 ational’’; and 

8 (bb) in clause (vi), by strik9 ing ‘‘and’’ at the end; and 

10 (V) by adding at the end the fol11 lowing: 

12 ‘‘(E) providing an update on the ongoing 

13 and continuous assessment performed under 

14 subparagraph (A)— 

15 ‘‘(i) upon request, to the inspector 

16 general of the agency or the Comptroller 

17 General of the United States; and 

18 ‘‘(ii) on a periodic basis, as deter19 mined by guidance issued by the Director 

20 but not less frequently than annually, to— 

21 ‘‘(I) the Director; 

22 ‘‘(II) the Director of the Cyberse23 curity and Infrastructure Security 

24 Agency; and 
25 

†S 3600 ES

1 ‘‘(III) the National Cyber Direc2 tor; 

3 ‘‘(F) in consultation with the Director of 

4 the Cybersecurity and Infrastructure Security 

5 Agency and not less frequently than once every 

6 3 years, performing an evaluation of whether 

7 additional cybersecurity procedures are appro8 priate for securing a system of, or under the 

9 supervision of, the agency, which shall— 

10 ‘‘(i) be completed considering the 

11 agency system risk assessment performed 

12 under subparagraph (A); and 

13 ‘‘(ii) include a specific evaluation for 

14 high value assets; 

15 ‘‘(G) not later than 30 days after com16 pleting the evaluation performed under sub17 paragraph (F), providing the evaluation and an 

18 implementation plan, if applicable, for using ad19 ditional cybersecurity procedures determined to 

20 be appropriate to— 

21 ‘‘(i) the Director of the Cybersecurity 

22 and Infrastructure Security Agency; 

23 ‘‘(ii) the Director; and 

24 ‘‘(iii) the National Cyber Director; 

25 and 
26 

†S 3600 ES

1 ‘‘(H) if the head of the agency determines 

2 there is need for additional cybersecurity proce3 dures, ensuring that those additional cybersecu4 rity procedures are reflected in the budget re5 quest of the agency;’’; 

6 (ii) in paragraph (2)— 

7 (I) in subparagraph (A), by in8 serting ‘‘in accordance with the agen9 cy system risk assessment performed 

10 under paragraph (1)(A)’’ after ‘‘infor11 mation systems’’; 

12 (II) in subparagraph (B)— 

13 (aa) by striking ‘‘in accord14 ance with standards’’ and insert15 ing ‘‘in accordance with— 

16 ‘‘(i) standards’’; and 

17 (bb) by adding at the end 

18 the following: 

19 ‘‘(ii) the evaluation performed under 

20 paragraph (1)(F); and 

21 ‘‘(iii) the implementation plan de22 scribed in paragraph (1)(G);’’; and 

23 (III) in subparagraph (D), by in24 serting ‘‘, through the use of penetra25 tion testing, the vulnerability disclo-
27 

†S 3600 ES

1 sure program established under sec2 tion 3559B, and other means,’’ after 

3 ‘‘periodically’’; 

4 (iii) in paragraph (3)— 

5 (I) in subparagraph (A)— 

6 (aa) in clause (iii), by strik7 ing ‘‘and’’ at the end; 

8 (bb) in clause (iv), by add9 ing ‘‘and’’ at the end; and 

10 (cc) by adding at the end 

11 the following: 

12 ‘‘(v) ensure that— 

13 ‘‘(I) senior agency information 

14 security officers of component agen15 cies carry out responsibilities under 

16 this subchapter, as directed by the 

17 senior agency information security of18 ficer of the agency or an equivalent 

19 official; and 

20 ‘‘(II) senior agency information 

21 security officers of component agen22 cies report to— 

23 ‘‘(aa) the senior information 

24 security officer of the agency or 

25 an equivalent official; and 
28 

†S 3600 ES

1 ‘‘(bb) the Chief Information 

2 Officer of the component agency 

3 or an equivalent official;’’; and 

4 (iv) in paragraph (5), by inserting 

5 ‘‘and the Director of the Cybersecurity and 

6 Infrastructure Security Agency’’ before 

7 ‘‘on the effectiveness’’; 

8 (B) in subsection (b)— 

9 (i) by striking paragraph (1) and in10 serting the following: 

11 ‘‘(1) pursuant to subsection (a)(1)(A), per12 forming ongoing and continuous agency system risk 

13 assessments, which may include using guidelines and 

14 automated tools consistent with standards and 

15 guidelines promulgated under section 11331 of title 

16 40, as applicable;’’; 

17 (ii) in paragraph (2)— 

18 (I) by striking subparagraph (B) 

19 and inserting the following: 

20 ‘‘(B) comply with the risk-based cyber 

21 budget model developed pursuant to section 

22 3553(a)(7);’’; and 

23 (II) in subparagraph (D)— 
29 

†S 3600 ES

1 (aa) by redesignating 

2 clauses (iii) and (iv) as clauses 

3 (iv) and (v), respectively; 

4 (bb) by inserting after 

5 clause (ii) the following: 

6 ‘‘(iii) binding operational directives 

7 and emergency directives promulgated by 

8 the Director of the Cybersecurity and In9 frastructure Security Agency under section 

10 3553;’’; and 

11 (cc) in clause (iv), as so re12 designated, by striking ‘‘as deter13 mined by the agency; and’’ and 

14 inserting ‘‘as determined by the 

15 agency, considering the agency 

16 risk assessment performed under 

17 subsection (a)(1)(A); and 

18 (iii) in paragraph (5)(A), by inserting 

19 ‘‘, including penetration testing, as appro20 priate,’’ after ‘‘shall include testing’’; 

21 (iv) in paragraph (6), by striking 

22 ‘‘planning, implementing, evaluating, and 

23 documenting’’ and inserting ‘‘planning and 

24 implementing and, in consultation with the 

25 Director of the Cybersecurity and Infra-
30 

†S 3600 ES

1 structure Security Agency, evaluating and 

2 documenting’’; 

3 (v) by redesignating paragraphs (7) 

4 and (8) as paragraphs (8) and (9), respec5 tively; 

6 (vi) by inserting after paragraph (6) 

7 the following: 

8 ‘‘(7) a process for providing the status of every 

9 remedial action and unremediated identified system 

10 vulnerability to the Director and the Director of the 

11 Cybersecurity and Infrastructure Security Agency, 

12 using automation and machine-readable data to the 

13 greatest extent practicable;’’; and 

14 (vii) in paragraph (8)(C), as so redes15 ignated— 

16 (I) by striking clause (ii) and in17 serting the following: 

18 ‘‘(ii) notifying and consulting with the 

19 Federal information security incident cen20 ter established under section 3556 pursu21 ant to the requirements of section 3594;’’; 

22 (II) by redesignating clause (iii) 

23 as clause (iv); 

24 (III) by inserting after clause (ii) 

25 the following: 
31 

†S 3600 ES

1 ‘‘(iii) performing the notifications and 

2 other activities required under subchapter 

3 IV of this chapter; and’’; and 

4 (IV) in clause (iv), as so redesig5 nated— 

6 (aa) in subclause (I), by 

7 striking ‘‘and relevant offices of 

8 inspectors general’’; 

9 (bb) in subclause (II), by 

10 adding ‘‘and’’ at the end; 

11 (cc) by striking subclause 

12 (III); and 

13 (dd) by redesignating sub14 clause (IV) as subclause (III); 

15 (C) in subsection (c)— 

16 (i) by redesignating paragraph (2) as 

17 paragraph (5); 

18 (ii) by striking paragraph (1) and in19 serting the following: 

20 ‘‘(1) BIANNUAL REPORT.—Not later than 2 

21 years after the date of enactment of the Federal In22 formation Security Modernization Act of 2022 and 

23 not less frequently than once every 2 years there24 after, using the continuous and ongoing agency sys25 tem risk assessment under subsection (a)(1)(A), the 
32 

†S 3600 ES

1 head of each agency shall submit to the Director, 

2 the Director of the Cybersecurity and Infrastructure 

3 Security Agency, the majority and minority leaders 

4 of the Senate, the Speaker and minority leader of 

5 the House of Representatives, the Committee on 

6 Homeland Security and Governmental Affairs of the 

7 Senate, the Committee on Oversight and Reform of 

8 the House of Representatives, the Committee on 

9 Homeland Security of the House of Representatives, 

10 the Committee on Commerce, Science, and Trans11 portation of the Senate, the Committee on Science, 

12 Space, and Technology of the House of Representa13 tives, the appropriate authorization and appropria14 tions committees of Congress, the National Cyber 

15 Director, and the Comptroller General of the United 

16 States a report that— 

17 ‘‘(A) summarizes the agency system risk 

18 assessment performed under subsection 

19 (a)(1)(A); 

20 ‘‘(B) evaluates the adequacy and effective21 ness of information security policies, proce22 dures, and practices of the agency to address 

23 the risks identified in the agency system risk 

24 assessment performed under subsection 

25 (a)(1)(A), including an analysis of the agency’s 
33 

†S 3600 ES

1 cybersecurity and incident response capabilities 

2 using the metrics established under section 

3 224(c) of the Cybersecurity Act of 2015 (6 

4 U.S.C. 1522(c)); 

5 ‘‘(C) summarizes the evaluation and imple6 mentation plans described in subparagraphs (F) 

7 and (G) of subsection (a)(1) and whether those 

8 evaluation and implementation plans call for 

9 the use of additional cybersecurity procedures 

10 determined to be appropriate by the agency; 

11 and 

12 ‘‘(D) summarizes the status of remedial 

13 actions identified by inspector general of the 

14 agency, the Comptroller General of the United 

15 States, and any other source determined appro16 priate by the head of the agency. 

17 ‘‘(2) UNCLASSIFIED REPORTS.—Each report 

18 submitted under paragraph (1)— 

19 ‘‘(A) shall be, to the greatest extent prac20 ticable, in an unclassified and otherwise uncon21 trolled form; and 

22 ‘‘(B) may include a classified annex. 

23 ‘‘(3) ACCESS TO INFORMATION.—The head of 

24 an agency shall ensure that, to the greatest extent 

25 practicable, information is included in the unclassi-
34 

†S 3600 ES

1 fied form of the report submitted by the agency 

2 under paragraph (2)(A). 

3 ‘‘(4) BRIEFINGS.—During each year during 

4 which a report is not required to be submitted under 

5 paragraph (1), the Director shall provide to the con6 gressional committees described in paragraph (1) a 

7 briefing summarizing current agency and Federal 

8 risk postures.’’; and 

9 (iii) in paragraph (5), as so redesig10 nated, by striking the period at the end 

11 and inserting ‘‘, including the reporting 

12 procedures established under section 

13 11315(d) of title 40 and subsection 

14 (a)(3)(A)(v) of this section’’; and 

15 (D) in subsection (d)(1), in the matter pre16 ceding subparagraph (A), by inserting ‘‘and the 

17 National Cyber Director’’ after ‘‘the Director’’; 

18 and 

19 (E) by adding at the end the following: 

20 ‘‘(f) REPORTING STRUCTURE EXEMPTION.— 

21 ‘‘(1) IN GENERAL.—On an annual basis, the 

22 Director may exempt an agency from the reporting 

23 structure requirement under subsection 

24 (a)(3)(A)(v)(II). 
35 

†S 3600 ES

1 ‘‘(2) REPORT.—On an annual basis, the Direc2 tor shall submit a report to the Committee on 

3 Homeland Security and Governmental Affairs of the 

4 Senate and the Committee on Oversight and Reform 

5 of the House of Representatives that includes a list 

6 of each exemption granted under paragraph (1) and 

7 the associated rationale for each exemption. 

8 ‘‘(3) COMPONENT OF OTHER REPORT.—The re9 port required under paragraph (2) may be incor10 porated into any other annual report required under 

11 this chapter.’’; 

12 (4) in section 3555— 

13 (A) in the section heading, by striking 

14 ‘‘ANNUAL INDEPENDENT’’ and inserting 

15 ‘‘INDEPENDENT’’; 

16 (B) in subsection (a)— 

17 (i) in paragraph (1), by inserting 

18 ‘‘during which a report is required to be 

19 submitted under section 3553(c),’’ after 

20 ‘‘Each year’’; 

21 (ii) in paragraph (2)(A), by inserting 

22 ‘‘, including by penetration testing and 

23 analyzing the vulnerability disclosure pro24 gram of the agency’’ after ‘‘information 

25 systems’’; and 
36 

†S 3600 ES

1 (iii) by adding at the end the fol2 lowing: 

3 ‘‘(3) An evaluation under this section may include 

4 recommendations for improving the cybersecurity posture 

5 of the agency.’’; 

6 (C) in subsection (b)(1), by striking ‘‘an7 nual’’; 

8 (D) in subsection (e)(1), by inserting ‘‘dur9 ing which a report is required to be submitted 

10 under section 3553(c)’’ after ‘‘Each year’’; 

11 (E) by striking subsection (f) and inserting 

12 the following: 

13 ‘‘(f) PROTECTION OF INFORMATION.—(1) Agencies, 

14 evaluators, and other recipients of information that, if dis15 closed, may cause grave harm to the efforts of Federal 

16 information security officers, shall take appropriate steps 

17 to ensure the protection of that information, including 

18 safeguarding the information from public disclosure. 

19 ‘‘(2) The protections required under paragraph (1) 

20 shall be commensurate with the risk and comply with all 

21 applicable laws and regulations. 

22 ‘‘(3) With respect to information that is not related 

23 to national security systems, agencies and evaluators shall 

24 make a summary of the information unclassified and pub-
37 

†S 3600 ES

1 licly available, including information that does not iden2 tify— 

3 ‘‘(A) specific information system incidents; or 

4 ‘‘(B) specific information system 

5 vulnerabilities.’’; 

6 (F) in subsection (g)(2)— 

7 (i) by striking ‘‘this subsection shall’’ 

8 and inserting ‘‘this subsection— 

9 ‘‘(A) shall’’; 

10 (ii) in subparagraph (A), as so des11 ignated, by striking the period at the end 

12 and inserting ‘‘; and’’; and 

13 (iii) by adding at the end the fol14 lowing: 

15 ‘‘(B) identify any entity that performs an inde16 pendent evaluation under subsection (b).’’; and 

17 (G) by striking subsection (j) and inserting 

18 the following: 

19 ‘‘(j) GUIDANCE.— 

20 ‘‘(1) IN GENERAL.—The Director, in consulta21 tion with the Director of the Cybersecurity and In22 frastructure Security Agency, the Chief Information 

23 Officers Council, the Council of the Inspectors Gen24 eral on Integrity and Efficiency, and other interested 

25 parties as appropriate, shall ensure the development 
38 

†S 3600 ES

1 of risk-based guidance for evaluating the effective2 ness of an information security program and prac3 tices 

4 ‘‘(2) PRIORITIES.—The risk-based guidance de5 veloped under paragraph (1) shall include— 

6 ‘‘(A) the identification of the most common 

7 successful threat patterns experienced by each 

8 agency; 

9 ‘‘(B) the identification of security controls 

10 that address the threat patterns described in 

11 subparagraph (A); 

12 ‘‘(C) any other security risks unique to the 

13 networks of each agency; and 

14 ‘‘(D) any other element the Director, in 

15 consultation with the Director of the Cybersecu16 rity and Infrastructure Security Agency and the 

17 Council of the Inspectors General on Integrity 

18 and Efficiency, determines appropriate.’’; and 

19 (5) in section 3556(a)— 

20 (A) in the matter preceding paragraph (1), 

21 by inserting ‘‘within the Cybersecurity and In22 frastructure Security Agency’’ after ‘‘incident 

23 center’’; and 

24 (B) in paragraph (4), by striking 

25 ‘‘3554(b)’’ and inserting ‘‘3554(a)(1)(A)’’. 
39 

†S 3600 ES

1 (d) CONFORMING AMENDMENTS.— 

2 (1) TABLE OF SECTIONS.—The table of sections 

3 for chapter 35 of title 44, United States Code, is 

4 amended by striking the item relating to section 

5 3555 and inserting the following: 

‘‘3555. Independent evaluation’’. 

6 (2) OMB REPORTS.—Section 226(c) of the Cy7 bersecurity Act of 2015 (6 U.S.C. 1524(c)) is 

8 amended— 

9 (A) in paragraph (1)(B), in the matter 

10 preceding clause (i), by striking ‘‘annually 

11 thereafter’’ and inserting ‘‘thereafter during the 

12 years during which a report is required to be 

13 submitted under section 3553(c) of title 44, 

14 United States Code’’; and 

15 (B) in paragraph (2)(B), in the matter 

16 preceding clause (i)— 

17 (i) by striking ‘‘annually thereafter’’ 

18 and inserting ‘‘thereafter during the years 

19 during which a report is required to be 

20 submitted under section 3553(c) of title 

21 44, United States Code’’; and 

22 (ii) by striking ‘‘the report required 

23 under section 3553(c) of title 44, United 

24 States Code’’ and inserting ‘‘that report’’. 
40 

†S 3600 ES

1 (3) NIST RESPONSIBILITIES.—Section 

2 20(d)(3)(B) of the National Institute of Standards 

3 and Technology Act (15 U.S.C. 278g–3(d)(3)(B)) is 

4 amended by striking ‘‘annual’’. 

5 (e) FEDERAL SYSTEM INCIDENT RESPONSE.— 

6 (1) IN GENERAL.—Chapter 35 of title 44, 

7 United States Code, is amended by adding at the 

8 end the following: 

9 ‘‘SUBCHAPTER IV—FEDERAL SYSTEM 

10 INCIDENT RESPONSE 

11 ‘‘§ 3591. Definitions 

12 ‘‘(a) IN GENERAL.—Except as provided in subsection 

13 (b), the definitions under sections 3502 and 3552 shall 

14 apply to this subchapter. 

15 ‘‘(b) ADDITIONAL DEFINITIONS.—As used in this 

16 subchapter: 

17 ‘‘(1) APPROPRIATE REPORTING ENTITIES.—The 

18 term ‘appropriate reporting entities’ means— 

19 ‘‘(A) the majority and minority leaders of 

20 the Senate; 

21 ‘‘(B) the Speaker and minority leader of 

22 the House of Representatives; 

23 ‘‘(C) the Committee on Homeland Security 

24 and Governmental Affairs of the Senate; 
41 

†S 3600 ES

1 ‘‘(D) the Committee on Oversight and Re2 form of the House of Representatives; 

3 ‘‘(E) the Committee on Homeland Security 

4 of the House of Representatives; 

5 ‘‘(F) the appropriate authorization and ap6 propriations committees of Congress; 

7 ‘‘(G) the Director; 

8 ‘‘(H) the Director of the Cybersecurity and 

9 Infrastructure Security Agency; 

10 ‘‘(I) the National Cyber Director; 

11 ‘‘(J) the Comptroller General of the United 

12 States; and 

13 ‘‘(K) the inspector general of any impacted 

14 agency. 

15 ‘‘(2) AWARDEE.—The term ‘awardee’— 

16 ‘‘(A) means a person, business, or other 

17 entity that receives a grant from, or is a party 

18 to a cooperative agreement or an other trans19 action agreement with, an agency; and 

20 ‘‘(B) includes any subgrantee of a person, 

21 business, or other entity described in subpara22 graph (A). 

23 ‘‘(3) BREACH.—The term ‘breach’— 

24 ‘‘(A) means the loss, control, compromise, 

25 unauthorized disclosure, or unauthorized acqui-
42 

†S 3600 ES

1 sition of personally identifiable information or 

2 any similar occurrence; and 

3 ‘‘(B) includes any additional meaning 

4 given the term in policies, principles, standards, 

5 or guidelines issued by the Director under sec6 tion 3553(a). 

7 ‘‘(4) CONTRACTOR.—The term ‘contractor’ 

8 means a prime contractor of an agency or a subcon9 tractor of a prime contractor of an agency. 

10 ‘‘(5) FEDERAL INFORMATION.—The term ‘Fed11 eral information’ means information created, col12 lected, processed, maintained, disseminated, dis13 closed, or disposed of by or for the Federal Govern14 ment in any medium or form. 

15 ‘‘(6) FEDERAL INFORMATION SYSTEM.—The 

16 term ‘Federal information system’ means an infor17 mation system used or operated by an agency, a con18 tractor, an awardee, or another organization on be19 half of an agency. 

20 ‘‘(7) INTELLIGENCE COMMUNITY.—The term 

21 ‘intelligence community’ has the meaning given the 

22 term in section 3 of the National Security Act of 

23 1947 (50 U.S.C. 3003). 

24 ‘‘(8) NATIONWIDE CONSUMER REPORTING

25 AGENCY.—The term ‘nationwide consumer reporting 
43 

†S 3600 ES

1 agency’ means a consumer reporting agency de2 scribed in section 603(p) of the Fair Credit Report3 ing Act (15 U.S.C. 1681a(p)). 

4 ‘‘(9) VULNERABILITY DISCLOSURE.—The term 

5 ‘vulnerability disclosure’ means a vulnerability iden6 tified under section 3559B. 

7 ‘‘§ 3592. Notification of breach 

8 ‘‘(a) NOTIFICATION.—As expeditiously as practicable 

9 and without unreasonable delay, and in any case not later 

10 than 45 days after an agency has a reasonable basis to 

11 conclude that a breach has occurred, the head of the agen12 cy, in consultation with a senior privacy officer of the 

13 agency, shall— 

14 ‘‘(1) determine whether notice to any individual 

15 potentially affected by the breach is appropriate 

16 based on an assessment of the risk of harm to the 

17 individual that considers— 

18 ‘‘(A) the nature and sensitivity of the per19 sonally identifiable information affected by the 

20 breach; 

21 ‘‘(B) the likelihood of access to and use of 

22 the personally identifiable information affected 

23 by the breach; 

24 ‘‘(C) the type of breach; and 
44 

†S 3600 ES

1 ‘‘(D) any other factors determined by the 

2 Director; and 

3 ‘‘(2) as appropriate, provide written notice in 

4 accordance with subsection (b) to each individual po5 tentially affected by the breach— 

6 ‘‘(A) to the last known mailing address of 

7 the individual; or 

8 ‘‘(B) through an appropriate alternative 

9 method of notification that the head of the 

10 agency or a designated senior-level individual of 

11 the agency selects based on factors determined 

12 by the Director. 

13 ‘‘(b) CONTENTS OF NOTICE.—Each notice of a 

14 breach provided to an individual under subsection (a)(2) 

15 shall include— 

16 ‘‘(1) a brief description of the breach; 

17 ‘‘(2) if possible, a description of the types of 

18 personally identifiable information affected by the 

19 breach; 

20 ‘‘(3) contact information of the agency that 

21 may be used to ask questions of the agency, which— 

22 ‘‘(A) shall include an e-mail address or an23 other digital contact mechanism; and 

24 ‘‘(B) may include a telephone number, 

25 mailing address, or a website; 
45 

†S 3600 ES

1 ‘‘(4) information on any remedy being offered 

2 by the agency; 

3 ‘‘(5) any applicable educational materials relat4 ing to what individuals can do in response to a 

5 breach that potentially affects their personally iden6 tifiable information, including relevant contact infor7 mation for Federal law enforcement agencies and 

8 each nationwide consumer reporting agency; and 

9 ‘‘(6) any other appropriate information, as de10 termined by the head of the agency or established in 

11 guidance by the Director. 

12 ‘‘(c) DELAY OF NOTIFICATION.— 

13 ‘‘(1) IN GENERAL.—The Attorney General, the 

14 Director of National Intelligence, or the Secretary of 

15 Homeland Security may delay a notification required 

16 under subsection (a) or (d) if the notification 

17 would— 

18 ‘‘(A) impede a criminal investigation or a 

19 national security activity; 

20 ‘‘(B) reveal sensitive sources and methods; 

21 ‘‘(C) cause damage to national security; or 

22 ‘‘(D) hamper security remediation actions. 

23 ‘‘(2) DOCUMENTATION.— 

24 ‘‘(A) IN GENERAL.—Any delay under para25 graph (1) shall be reported in writing to the Di-
46 

†S 3600 ES

1 rector, the Attorney General, the Director of 

2 National Intelligence, the Secretary of Home3 land Security, the National Cyber Director, the 

4 Director of the Cybersecurity and Infrastruc5 ture Security Agency, and the head of the agen6 cy and the inspector general of the agency that 

7 experienced the breach. 

8 ‘‘(B) CONTENTS.—A report required under 

9 subparagraph (A) shall include a written state10 ment from the entity that delayed the notifica11 tion explaining the need for the delay. 

12 ‘‘(C) FORM.—The report required under 

13 subparagraph (A) shall be unclassified but may 

14 include a classified annex. 

15 ‘‘(3) RENEWAL.—A delay under paragraph (1) 

16 shall be for a period of 60 days and may be renewed. 

17 ‘‘(d) UPDATE NOTIFICATION.—If an agency deter18 mines there is a significant change in the reasonable basis 

19 to conclude that a breach occurred, a significant change 

20 to the determination made under subsection (a)(1), or that 

21 it is necessary to update the details of the information pro22 vided to potentially affected individuals as described in 

23 subsection (b), the agency shall as expeditiously as prac24 ticable and without unreasonable delay, and in any case 

25 not later than 30 days after such a determination, notify 
47 

†S 3600 ES

1 each individual who received a notification pursuant to 

2 subsection (a) of those changes. 

3 ‘‘(e) RULE OF CONSTRUCTION.—Nothing in this sec4 tion shall be construed to limit— 

5 ‘‘(1) the Director from issuing guidance relat6 ing to notifications or the head of an agency from 

7 notifying individuals potentially affected by breaches 

8 that are not determined to be major incidents; or 

9 ‘‘(2) the Director from issuing guidance relat10 ing to notifications of major incidents or the head of 

11 an agency from providing more information than de12 scribed in subsection (b) when notifying individuals 

13 potentially affected by breaches. 

14 ‘‘§ 3593. Congressional and Executive Branch reports 

15 ‘‘(a) INITIAL REPORT.— 

16 ‘‘(1) IN GENERAL.—Not later than 72 hours 

17 after an agency has a reasonable basis to conclude 

18 that a major incident occurred, the head of the 

19 agency impacted by the major incident shall submit 

20 to the appropriate reporting entities a written report 

21 and, to the extent practicable, provide a briefing to 

22 the Committee on Homeland Security and Govern23 mental Affairs of the Senate, the Committee on 

24 Oversight and Reform of the House of Representa25 tives, the Committee on Homeland Security of the 
48 

†S 3600 ES

1 House of Representatives, and the appropriate au2 thorization and appropriations committees of Con3 gress, taking into account— 

4 ‘‘(A) the information known at the time of 

5 the report; 

6 ‘‘(B) the sensitivity of the details associ7 ated with the major incident; and 

8 ‘‘(C) the classification level of the informa9 tion contained in the report. 

10 ‘‘(2) CONTENTS.—A report required under 

11 paragraph (1) shall include, in a manner that ex12 cludes or otherwise reasonably protects personally 

13 identifiable information and to the extent permitted 

14 by applicable law, including privacy and statistical 

15 laws— 

16 ‘‘(A) a summary of the information avail17 able about the major incident, including how 

18 the major incident occurred, information indi19 cating that the major incident may be a breach, 

20 and information relating to the major incident 

21 as a breach, based on information available to 

22 agency officials as of the date on which the 

23 agency submits the report; 

24 ‘‘(B) if applicable, a description and any 

25 associated documentation of any circumstances 
49 

†S 3600 ES

1 necessitating a delay in a notification to individ2 uals potentially affected by the major incident 

3 under section 3592(c); 

4 ‘‘(C) if applicable, an assessment of the 

5 impacts to the agency, the Federal Government, 

6 or the security of the United States, based on 

7 information available to agency officials on the 

8 date on which the agency submits the report; 

9 and 

10 ‘‘(D) if applicable, whether any ransom has 

11 been demanded or paid, or plans to be paid, by 

12 any entity operating a Federal information sys13 tem or with access to a Federal information 

14 system, unless disclosure of such information 

15 may disrupt an active Federal law enforcement 

16 or national security operation. 

17 ‘‘(b) SUPPLEMENTAL REPORT.—Within a reasonable 

18 amount of time, but not later than 30 days after the date 

19 on which an agency submits a written report under sub20 section (a), the head of the agency shall provide to the 

21 appropriate reporting entities written updates, which may 

22 include classified annexes, on the major incident and, to 

23 the extent practicable, provide a briefing, which may in24 clude a classified component, to the congressional commit-
50 

†S 3600 ES

1 tees described in subsection (a)(1), including summaries 

2 of— 

3 ‘‘(1) vulnerabilities, means by which the major 

4 incident occurred, and impacts to the agency relat5 ing to the major incident; 

6 ‘‘(2) any risk assessment and subsequent risk7 based security implementation of the affected infor8 mation system before the date on which the major 

9 incident occurred; 

10 ‘‘(3) the status of compliance of the affected in11 formation system with applicable security require12 ments that are directly related to the cause of the 

13 incident, at the time of the major incident; 

14 ‘‘(4) an estimate of the number of individuals 

15 potentially affected by the major incident based on 

16 information available to agency officials as of the 

17 date on which the agency provides the update; 

18 ‘‘(5) an assessment of the risk of harm to indi19 viduals potentially affected by the major incident 

20 based on information available to agency officials as 

21 of the date on which the agency provides the update; 

22 ‘‘(6) an update to the assessment of the risk to 

23 agency operations, or to impacts on other agency or 

24 non-Federal entity operations, affected by the major 

25 incident based on information available to agency of-
51 

†S 3600 ES

1 ficials as of the date on which the agency provides 

2 the update; 

3 ‘‘(7) the detection, response, and remediation 

4 actions of the agency, including any support pro5 vided by the Cybersecurity and Infrastructure Secu6 rity Agency under section 3594(d) and status up7 dates on the notification process described in section 

8 3592(a), including any delay described in section 

9 3592(c), if applicable; and 

10 ‘‘(8) if applicable, a description of any cir11 cumstances or data leading the head of the agency 

12 to determine, pursuant to section 3592(a)(1), not to 

13 notify individuals potentially impacted by a breach. 

14 ‘‘(c) UPDATE REPORT.—If the agency determines 

15 that there is any significant change in the understanding 

16 of the agency of the scope, scale, or consequence of a 

17 major incident for which an agency submitted a written 

18 report under subsection (a), the agency shall provide an 

19 updated report to the appropriate reporting entities that 

20 includes information relating to the change in under21 standing. 

22 ‘‘(d) BIANNUAL REPORT.—Each agency shall submit 

23 as part of the biannual report required under section 

24 3554(c)(1) of this title a description of each major inci-
52 

†S 3600 ES

1 dent that occurred during the 2-year period preceding the 

2 date on which the biannual report is submitted. 

3 ‘‘(e) DELAY AND LACK OF NOTIFICATION REPORT.— 

4 ‘‘(1) IN GENERAL.—The Director shall submit 

5 to the appropriate reporting entities an annual re6 port on all notification delays granted pursuant to 

7 section 3592(c). 

8 ‘‘(2) LACK OF BREACH NOTIFICATION.—The 

9 Director shall submit to the appropriate reporting 

10 entities an annual report on each breach with re11 spect to which the head of an agency determined, 

12 pursuant to section 3592(a)(1), not to notify individ13 uals potentially impacted by the breach. 

14 ‘‘(3) COMPONENT OF OTHER REPORT.—The Di15 rector may submit the report required under para16 graph (1) as a component of the annual report sub17 mitted under section 3597(b). 

18 ‘‘(f) REPORT DELIVERY.—Any written report re19 quired to be submitted under this section may be sub20 mitted in a paper or electronic format. 

21 ‘‘(g) THREAT BRIEFING.— 

22 ‘‘(1) IN GENERAL.—Not later than 7 days after 

23 the date on which an agency has a reasonable basis 

24 to conclude that a major incident occurred, the head 

25 of the agency, jointly with the Director, the National 
53 

†S 3600 ES

1 Cyber Director and any other Federal entity deter2 mined appropriate by the National Cyber Director, 

3 shall provide a briefing to the congressional commit4 tees described in subsection (a)(1) on the threat 

5 causing the major incident. 

6 ‘‘(2) COMPONENTS.—The briefing required 

7 under paragraph (1)— 

8 ‘‘(A) shall, to the greatest extent prac9 ticable, include an unclassified component; and 

10 ‘‘(B) may include a classified component. 

11 ‘‘(h) RULE OF CONSTRUCTION.—Nothing in this sec12 tion shall be construed to limit— 

13 ‘‘(1) the ability of an agency to provide addi14 tional reports or briefings to Congress; or 

15 ‘‘(2) Congress from requesting additional infor16 mation from agencies through reports, briefings, or 

17 other means. 

18 ‘‘§ 3594. Government information sharing and inci19 dent response 

20 ‘‘(a) IN GENERAL.— 

21 ‘‘(1) INCIDENT REPORTING.—Subject to the 

22 limitations described in subsection (b), the head of 

23 each agency shall provide any information relating 

24 to any incident affecting the agency, whether the in25 formation is obtained by the Federal Government di-
54 

†S 3600 ES

1 rectly or indirectly, to the Cybersecurity and Infra2 structure Security Agency. 

3 ‘‘(2) CONTENTS.—A provision of information 

4 relating to an incident made by the head of an agen5 cy under paragraph (1) shall— 

6 ‘‘(A) include detailed information about 

7 the safeguards that were in place when the inci8 dent occurred; 

9 ‘‘(B) whether the agency implemented the 

10 safeguards described in subparagraph (A) cor11 rectly; 

12 ‘‘(C) in order to protect against a similar 

13 incident, identify— 

14 ‘‘(i) how the safeguards described in 

15 subparagraph (A) should be implemented 

16 differently; and 

17 ‘‘(ii) additional necessary safeguards; 

18 and 

19 ‘‘(D) include information to aid in incident 

20 response, such as— 

21 ‘‘(i) a description of the affected sys22 tems or networks; 

23 ‘‘(ii) the estimated dates of when the 

24 incident occurred; and 
55 

†S 3600 ES

1 ‘‘(iii) information that could reason2 ably help identify the party that conducted 

3 the incident or the cause of the incident, 

4 subject to appropriate privacy protections. 

5 ‘‘(3) INFORMATION SHARING.—The Director of 

6 the Cybersecurity and Infrastructure Security Agen7 cy shall— 

8 ‘‘(A) make incident information provided 

9 under paragraph (1) available to the Director 

10 and the National Cyber Director; 

11 ‘‘(B) to the greatest extent practicable, 

12 share information relating to an incident with 

13 the head of any agency that may be— 

14 ‘‘(i) impacted by the incident; 

15 ‘‘(ii) similarly susceptible to the inci16 dent; or 

17 ‘‘(iii) similarly targeted by the inci18 dent; and 

19 ‘‘(C) coordinate any necessary information 

20 sharing efforts relating to a major incident with 

21 the private sector. 

22 ‘‘(4) NATIONAL SECURITY SYSTEMS.—Each 

23 agency operating or exercising control of a national 

24 security system shall share information about inci25 dents that occur on national security systems with 
56 

†S 3600 ES

1 the Director of the Cybersecurity and Infrastructure 

2 Security Agency to the extent consistent with stand3 ards and guidelines for national security systems 

4 issued in accordance with law and as directed by the 

5 President. 

6 ‘‘(b) COMPLIANCE.—In providing information and se7 lecting a method to provide information under subsection 

8 (a), the head of each agency shall take into account the 

9 level of classification of the information and any informa10 tion sharing limitations and protections, such as limita11 tions and protections relating to law enforcement, national 

12 security, privacy, statistical confidentiality, or other fac13 tors determined by the Director in order to implement 

14 subsection (a)(1) in a manner that enables automated and 

15 consistent reporting to the greatest extent practicable. 

16 ‘‘(c) INCIDENT RESPONSE.—Each agency that has a 

17 reasonable basis to conclude that a major incident oc18 curred involving Federal information in electronic medium 

19 or form that does not exclusively involve a national secu20 rity system, regardless of delays from notification granted 

21 for a major incident that is also a breach, shall coordinate 

22 with the Cybersecurity and Infrastructure Security Agen23 cy to facilitate asset response activities and provide rec24 ommendations for mitigating future incidents. 
57 

†S 3600 ES

1 ‘‘§ 3595. Responsibilities of contractors and awardees 

2 ‘‘(a) REPORTING.— 

3 ‘‘(1) IN GENERAL.—Unless otherwise specified 

4 in a contract, grant, cooperative agreement, or an 

5 other transaction agreement, any contractor or 

6 awardee of an agency shall report to the agency 

7 within the same amount of time such agency is re8 quired to report an incident to the Cybersecurity 

9 and Infrastructure Security Agency, if the con10 tractor or awardee has a reasonable basis to suspect 

11 or conclude that— 

12 ‘‘(A) an incident or breach has occurred 

13 with respect to Federal information collected, 

14 used, or maintained by the contractor or award15 ee in connection with the contract, grant, coop16 erative agreement, or other transaction agree17 ment of the contractor or awardee; 

18 ‘‘(B) an incident or breach has occurred 

19 with respect to a Federal information system 

20 used or operated by the contractor or awardee 

21 in connection with the contract, grant, coopera22 tive agreement, or other transaction agreement 

23 of the contractor or awardee; or 

24 ‘‘(C) the contractor or awardee has re25 ceived information from the agency that the 

26 contractor or awardee is not authorized to re-
58 

†S 3600 ES

1 ceive in connection with the contract, grant, co2 operative agreement, or other transaction agree3 ment of the contractor or awardee. 

4 ‘‘(2) PROCEDURES.— 

5 ‘‘(A) MAJOR INCIDENT.—Following a re6 port of a breach or major incident by a con7 tractor or awardee under paragraph (1), the 

8 agency, in consultation with the contractor or 

9 awardee, shall carry out the requirements under 

10 sections 3592, 3593, and 3594 with respect to 

11 the major incident. 

12 ‘‘(B) INCIDENT.—Following a report of an 

13 incident by a contractor or awardee under para14 graph (1), an agency, in consultation with the 

15 contractor or awardee, shall carry out the re16 quirements under section 3594 with respect to 

17 the incident. 

18 ‘‘(b) EFFECTIVE DATE.—This section shall apply— 

19 ‘‘(1) on and after the date that is 1 year after 

20 the date of enactment of the Federal Information 

21 Security Modernization Act of 2022; and 

22 ‘‘(2) with respect to any contract entered into 

23 on or after the date described in paragraph (1). 
59 

†S 3600 ES

1 ‘‘§ 3596. Training 

2 ‘‘(a) COVERED INDIVIDUAL DEFINED.—In this sec3 tion, the term ‘covered individual’ means an individual 

4 who obtains access to Federal information or Federal in5 formation systems because of the status of the individual 

6 as an employee, contractor, awardee, volunteer, or intern 

7 of an agency. 

8 ‘‘(b) REQUIREMENT.—The head of each agency shall 

9 develop training for covered individuals on how to identify 

10 and respond to an incident, including— 

11 ‘‘(1) the internal process of the agency for re12 porting an incident; and 

13 ‘‘(2) the obligation of a covered individual to re14 port to the agency a confirmed major incident and 

15 any suspected incident involving information in any 

16 medium or form, including paper, oral, and elec17 tronic. 

18 ‘‘(c) INCLUSION IN ANNUAL TRAINING.—The train19 ing developed under subsection (b) may be included as 

20 part of an annual privacy or security awareness training 

21 of an agency. 

22 ‘‘§ 3597. Analysis and report on Federal incidents 

23 ‘‘(a) ANALYSIS OF FEDERAL INCIDENTS.— 

24 ‘‘(1) QUANTITATIVE AND QUALITATIVE ANAL25 YSES.—The Director of the Cybersecurity and Infra26 structure Security Agency shall develop, in consulta-
60 

†S 3600 ES

1 tion with the Director and the National Cyber Direc2 tor, and perform continuous monitoring and quan3 titative and qualitative analyses of incidents at agen4 cies, including major incidents, including— 

5 ‘‘(A) the causes of incidents, including— 

6 ‘‘(i) attacker tactics, techniques, and 

7 procedures; and 

8 ‘‘(ii) system vulnerabilities, including 

9 zero days, unpatched systems, and infor10 mation system misconfigurations; 

11 ‘‘(B) the scope and scale of incidents at 

12 agencies; 

13 ‘‘(C) common root causes of incidents 

14 across multiple Federal agencies; 

15 ‘‘(D) agency incident response, recovery, 

16 and remediation actions and the effectiveness of 

17 those actions, as applicable; 

18 ‘‘(E) lessons learned and recommendations 

19 in responding to, recovering from, remediating, 

20 and mitigating future incidents; and 

21 ‘‘(F) trends across multiple Federal agen22 cies to address intrusion detection and incident 

23 response capabilities using the metrics estab24 lished under section 224(c) of the Cybersecurity 

25 Act of 2015 (6 U.S.C. 1522(c)). 
61 

†S 3600 ES

1 ‘‘(2) AUTOMATED ANALYSIS.—The analyses de2 veloped under paragraph (1) shall, to the greatest 

3 extent practicable, use machine readable data, auto4 mation, and machine learning processes. 

5 ‘‘(3) SHARING OF DATA AND ANALYSIS.— 

6 ‘‘(A) IN GENERAL.—The Director shall 

7 share on an ongoing basis the analyses required 

8 under this subsection with agencies and the Na9 tional Cyber Director to— 

10 ‘‘(i) improve the understanding of cy11 bersecurity risk of agencies; and 

12 ‘‘(ii) support the cybersecurity im13 provement efforts of agencies. 

14 ‘‘(B) FORMAT.—In carrying out subpara15 graph (A), the Director shall share the anal16 yses— 

17 ‘‘(i) in human-readable written prod18 ucts; and 

19 ‘‘(ii) to the greatest extent practicable, 

20 in machine-readable formats in order to 

21 enable automated intake and use by agen22 cies. 

23 ‘‘(b) ANNUAL REPORT ON FEDERAL INCIDENTS.— 

24 Not later than 2 years after the date of enactment of this 

25 section, and not less frequently than annually thereafter, 
62 

†S 3600 ES

1 the Director of the Cybersecurity and Infrastructure Secu2 rity Agency, in consultation with the Director, the Na3 tional Cyber Director and the heads of other Federal agen4 cies, as appropriate, shall submit to the appropriate re5 porting entities a report that includes— 

6 ‘‘(1) a summary of causes of incidents from 

7 across the Federal Government that categorizes 

8 those incidents as incidents or major incidents; 

9 ‘‘(2) the quantitative and qualitative analyses of 

10 incidents developed under subsection (a)(1) on an 

11 agency-by-agency basis and comprehensively across 

12 the Federal Government, including— 

13 ‘‘(A) a specific analysis of breaches; and 

14 ‘‘(B) an analysis of the Federal Govern15 ment’s performance against the metrics estab16 lished under section 224(c) of the Cybersecurity 

17 Act of 2015 (6 U.S.C. 1522(c)); and 

18 ‘‘(3) an annex for each agency that includes— 

19 ‘‘(A) a description of each major incident; 

20 ‘‘(B) the total number of incidents of the 

21 agency; and 

22 ‘‘(C) an analysis of the agency’s perform23 ance against the metrics established under sec24 tion 224(c) of the Cybersecurity Act of 2015 (6 

25 U.S.C. 1522(c)). 
63 

†S 3600 ES

1 ‘‘(c) PUBLICATION.— 

2 ‘‘(1) IN GENERAL.—A version of each report 

3 submitted under subsection (b) shall be made pub4 licly available on the website of the Cybersecurity 

5 and Infrastructure Security Agency during the year 

6 in which the report is submitted. 

7 ‘‘(2) EXEMPTION.—The Director of the Cyber8 security and Infrastructure Security Agency may ex9 empt all or a portion of a report described in para10 graph (1) from public publication if the Director of 

11 the Cybersecurity and Infrastructure Security Agen12 cy determines the exemption is in the interest of na13 tional security. 

14 ‘‘(3) LIMITATION ON EXEMPTION.—An exemp15 tion granted under paragraph (2) shall not apply to 

16 any version of a report submitted to the appropriate 

17 reporting entities under subsection (b). 

18 ‘‘(d) INFORMATION PROVIDED BY AGENCIES.— 

19 ‘‘(1) IN GENERAL.—The analysis required 

20 under subsection (a) and each report submitted 

21 under subsection (b) shall use information provided 

22 by agencies under section 3594(a). 

23 ‘‘(2) NONCOMPLIANCE REPORTS.— 

24 ‘‘(A) IN GENERAL.—Subject to subpara25 graph (B), during any year during which the 
64 

†S 3600 ES

1 head of an agency does not provide data for an 

2 incident to the Cybersecurity and Infrastructure 

3 Security Agency in accordance with section 

4 3594(a), the head of the agency, in coordina5 tion with the Director of the Cybersecurity and 

6 Infrastructure Security Agency and the Direc7 tor, shall submit to the appropriate reporting 

8 entities a report that includes the information 

9 described in subsection (b) with respect to the 

10 agency. 

11 ‘‘(B) EXCEPTION FOR NATIONAL SECURITY

12 SYSTEMS.—The head of an agency that owns or 

13 exercises control of a national security system 

14 shall not include data for an incident that oc15 curs on a national security system in any report 

16 submitted under subparagraph (A). 

17 ‘‘(3) NATIONAL SECURITY SYSTEM REPORTS.— 

18 ‘‘(A) IN GENERAL.—Annually, the head of 

19 an agency that operates or exercises control of 

20 a national security system shall submit a report 

21 that includes the information described in sub22 section (b) with respect to the national security 

23 system to the extent that the submission is con24 sistent with standards and guidelines for na-
65 

†S 3600 ES

1 tional security systems issued in accordance 

2 with law and as directed by the President to— 

3 ‘‘(i) the majority and minority leaders 

4 of the Senate, 

5 ‘‘(ii) the Speaker and minority leader 

6 of the House of Representatives; 

7 ‘‘(iii) the Committee on Homeland Se8 curity and Governmental Affairs of the 

9 Senate; 

10 ‘‘(iv) the Select Committee on Intel11 ligence of the Senate; 

12 ‘‘(v) the Committee on Armed Serv13 ices of the Senate; 

14 ‘‘(vi) the Committee on Appropria15 tions of the Senate; 

16 ‘‘(vii) the Committee on Oversight and 

17 Reform of the House of Representatives; 

18 ‘‘(viii) the Committee on Homeland 

19 Security of the House of Representatives; 

20 ‘‘(ix) the Permanent Select Committee 

21 on Intelligence of the House of Represent22 atives; 

23 ‘‘(x) the Committee on Armed Serv24 ices of the House of Representatives; and 
66 

†S 3600 ES

1 ‘‘(xi) the Committee on Appropria2 tions of the House of Representatives. 

3 ‘‘(B) CLASSIFIED FORM.—A report re4 quired under subparagraph (A) may be sub5 mitted in a classified form. 

6 ‘‘(e) REQUIREMENT FOR COMPILING INFORMA7 TION.—In publishing the public report required under 

8 subsection (c), the Director of the Cybersecurity and In9 frastructure Security Agency shall sufficiently compile in10 formation such that no specific incident of an agency can 

11 be identified, except with the concurrence of the Director 

12 of the Office of Management and Budget and in consulta13 tion with the impacted agency. 

14 ‘‘§ 3598. Major incident definition 

15 ‘‘(a) IN GENERAL.—Not later than 180 days after 

16 the date of enactment of the Federal Information Security 

17 Modernization Act of 2022, the Director, in coordination 

18 with the Director of the Cybersecurity and Infrastructure 

19 Security Agency and the National Cyber Director, shall 

20 develop and promulgate guidance on the definition of the 

21 term ‘major incident’ for the purposes of subchapter II 

22 and this subchapter. 

23 ‘‘(b) REQUIREMENTS.—With respect to the guidance 

24 issued under subsection (a), the definition of the term 

25 ‘major incident’ shall— 
67 

†S 3600 ES

1 ‘‘(1) include, with respect to any information 

2 collected or maintained by or on behalf of an agency 

3 or an information system used or operated by an 

4 agency or by a contractor of an agency or another 

5 organization on behalf of an agency— 

6 ‘‘(A) any incident the head of the agency 

7 determines is likely to have an impact on— 

8 ‘‘(i) the national security, homeland 

9 security, or economic security of the 

10 United States; or 

11 ‘‘(ii) the civil liberties or public health 

12 and safety of the people of the United 

13 States; 

14 ‘‘(B) any incident the head of the agency 

15 determines likely to result in an inability for the 

16 agency, a component of the agency, or the Fed17 eral Government, to provide 1 or more critical 

18 services; 

19 ‘‘(C) any incident that the head of an 

20 agency, in consultation with a senior privacy of21 ficer of the agency, determines is likely to have 

22 a significant privacy impact on 1 or more indi23 vidual; 

24 ‘‘(D) any incident that the head of the 

25 agency, in consultation with a senior privacy of-
68 

†S 3600 ES

1 ficial of the agency, determines is likely to have 

2 a substantial privacy impact on a significant 

3 number of individuals; 

4 ‘‘(E) any incident the head of the agency 

5 determines substantially disrupts the operations 

6 of a high value asset owned or operated by the 

7 agency; 

8 ‘‘(F) any incident involving the exposure of 

9 sensitive agency information to a foreign entity, 

10 such as the communications of the head of the 

11 agency, the head of a component of the agency, 

12 or the direct reports of the head of the agency 

13 or the head of a component of the agency; and 

14 ‘‘(G) any other type of incident determined 

15 appropriate by the Director; 

16 ‘‘(2) stipulate that the National Cyber Director, 

17 in consultation with the Director, shall declare a 

18 major incident at each agency impacted by an inci19 dent if it is determined that an incident— 

20 ‘‘(A) occurs at not less than 2 agencies; 

21 and 

22 ‘‘(B) is enabled by— 

23 ‘‘(i) a common technical root cause, 

24 such as a supply chain compromise, a com25 mon software or hardware vulnerability; or 
69 

†S 3600 ES

1 ‘‘(ii) the related activities of a com2 mon threat actor; and 

3 ‘‘(3) stipulate that, in determining whether an 

4 incident constitutes a major incident because that 

5 incident is any incident described in paragraph (1), 

6 the head of the agency shall consult with the Na7 tional Cyber Director and may consult with the Di8 rector of the Cybersecurity and Infrastructure Secu9 rity Agency. 

10 ‘‘(c) SIGNIFICANT NUMBER OF INDIVIDUALS.—In de11 termining what constitutes a significant number of indi12 viduals under subsection (b)(1)(D), the Director— 

13 ‘‘(1) may determine a threshold for a minimum 

14 number of individuals that constitutes a significant 

15 amount; and 

16 ‘‘(2) may not determine a threshold described 

17 in paragraph (1) that exceeds 5,000 individuals. 

18 ‘‘(d) EVALUATION AND UPDATES.—Not later than 2 

19 years after the date of enactment of the Federal Informa20 tion Security Modernization Act of 2022, and not less fre21 quently than every 2 years thereafter, the Director shall 

22 provide a briefing to the Committee on Homeland Security 

23 and Governmental Affairs of the Senate and the Com24 mittee on Oversight and Reform of the House of Rep25 resentatives, which shall include— 
70 

†S 3600 ES

1 ‘‘(1) an evaluation of any necessary updates to 

2 the guidance issued under subsection (a); 

3 ‘‘(2) an evaluation of any necessary updates to 

4 the definition of the term ‘major incident’ included 

5 in the guidance issued under subsection (a); and 

6 ‘‘(3) an explanation of, and the analysis that 

7 led to, the definition described in paragraph (2).’’. 

8 (2) CLERICAL AMENDMENT.—The table of sec9 tions for chapter 35 of title 44, United States Code, 

10 is amended by adding at the end the following: 

‘‘SUBCHAPTER IV—FEDERAL SYSTEM INCIDENT RESPONSE

‘‘3591. Definitions 

‘‘3592. Notification of breach 

‘‘3593. Congressional and Executive Branch reports 

‘‘3594. Government information sharing and incident response 

‘‘3595. Responsibilities of contractors and awardees 

‘‘3596. Training 

‘‘3597. Analysis and report on Federal incidents 

‘‘3598. Major incident definition’’. 

11 SEC. 104. AMENDMENTS TO SUBTITLE III OF TITLE 40. 

12 (a) MODERNIZING GOVERNMENT TECHNOLOGY.— 

13 Subtitle G of title X of Division A of the National Defense 

14 Authorization Act for Fiscal Year 2018 (40 U.S.C. 11301 

15 note) is amended in section 1078— 

16 (1) by striking subsection (a) and inserting the 

17 following: 

18 ‘‘(a) DEFINITIONS.—In this section: 

19 ‘‘(1) AGENCY.—The term ‘agency’ has the 

20 meaning given the term in section 551 of title 5, 

21 United States Code. 
71 

†S 3600 ES

1 ‘‘(2) HIGH VALUE ASSET.—The term ‘high 

2 value asset’ has the meaning given the term in sec3 tion 3552 of title 44, United States Code.’’; 

4 (2) in subsection (b), by adding at the end the 

5 following: 

6 ‘‘(8) PROPOSAL EVALUATION.—The Director 

7 shall— 

8 ‘‘(A) give consideration for the use of 

9 amounts in the Fund to improve the security of 

10 high value assets; and 

11 ‘‘(B) require that any proposal for the use 

12 of amounts in the Fund includes a cybersecu13 rity plan, including a supply chain risk manage14 ment plan, to be reviewed by the member of the 

15 Technology Modernization Board described in 

16 subsection (c)(5)(C).’’; and 

17 (3) in subsection (c)— 

18 (A) in paragraph (2)(A)(i), by inserting ‘‘, 

19 including a consideration of the impact on high 

20 value assets’’ after ‘‘operational risks’’; 

21 (B) in paragraph (5)— 

22 (i) in subparagraph (A), by striking 

23 ‘‘and’’ at the end; 
72 

†S 3600 ES

1 (ii) in subparagraph (B), by striking 

2 the period at the end and inserting ‘‘and’’; 

3 and 

4 (iii) by adding at the end the fol5 lowing: 

6 ‘‘(C) a senior official from the Cybersecu7 rity and Infrastructure Security Agency of the 

8 Department of Homeland Security, appointed 

9 by the Director.’’; and 

10 (C) in paragraph (6)(A), by striking ‘‘shall 

11 be—’’ and all that follows through ‘‘4 employ12 ees’’ and inserting ‘‘shall be 4 employees’’. 

13 (b) SUBCHAPTER I.—Subchapter I of chapter 113 of 

14 subtitle III of title 40, United States Code, is amended— 

15 (1) in section 11302— 

16 (A) in subsection (b), by striking ‘‘use, se17 curity, and disposal of’’ and inserting ‘‘use, and 

18 disposal of, and, in consultation with the Direc19 tor of the Cybersecurity and Infrastructure Se20 curity Agency and the National Cyber Director, 

21 promote and improve the security of,’’; 

22 (B) in subsection (c)— 

23 (i) in paragraph (3)— 

24 (I) in subparagraph (A)— 
73 

†S 3600 ES

1 (aa) by striking ‘‘including 

2 data’’ and inserting ‘‘which 

3 shall— 

4 ‘‘(i) include data’’; and 

5 (bb) by adding at the end 

6 the following: 

7 ‘‘(ii) specifically denote cybersecurity 

8 funding under the risk-based cyber budget 

9 model developed pursuant to section 

10 3553(a)(7) of title 44.’’; and 

11 (II) in subparagraph (B), by add12 ing at the end the following: 

13 ‘‘(iii) The Director shall provide to the 

14 National Cyber Director any cybersecurity 

15 funding information described in subpara16 graph (A)(ii) that is provided to the Direc17 tor under clause (ii) of this subpara18 graph.’’; 

19 (C) in subsection (f)— 

20 (i) by striking ‘‘heads of executive 

21 agencies to develop’’ and inserting ‘‘heads 

22 of executive agencies to— 

23 ‘‘(1) develop’’; 
74 

†S 3600 ES

1 (ii) in paragraph (1), as so des2 ignated, by striking the period at the end 

3 and inserting ‘‘; and’’; and 

4 (iii) by adding at the end the fol5 lowing: 

6 ‘‘(2) consult with the Director of the Cybersecu7 rity and Infrastructure Security Agency for the de8 velopment and use of supply chain security best 

9 practices.’’; and 

10 (D) in subsection (h), by inserting ‘‘, in11 cluding cybersecurity performances,’’ after ‘‘the 

12 performances’’; and 

13 (2) in section 11303(b)— 

14 (A) in paragraph (2)(B)— 

15 (i) in clause (i), by striking ‘‘or’’ at 

16 the end; 

17 (ii) in clause (ii), by adding ‘‘or’’ at 

18 the end; and 

19 (iii) by adding at the end the fol20 lowing: 

21 ‘‘(iii) whether the function should be 

22 performed by a shared service offered by 

23 another executive agency;’’; and 

24 (B) in paragraph (5)(B)(i), by inserting ‘‘, 

25 while taking into account the risk-based cyber 
75 

†S 3600 ES

1 budget model developed pursuant to section 

2 3553(a)(7) of title 44’’ after ‘‘title 31’’. 

3 (c) SUBCHAPTER II.—Subchapter II of chapter 113 

4 of subtitle III of title 40, United States Code, is amend5 ed— 

6 (1) in section 11312(a), by inserting ‘‘, includ7 ing security risks’’ after ‘‘managing the risks’’; 

8 (2) in section 11313(1), by striking ‘‘efficiency 

9 and effectiveness’’ and inserting ‘‘efficiency, security, 

10 and effectiveness’’; 

11 (3) in section 11315, by adding at the end the 

12 following: 

13 ‘‘(d) COMPONENT AGENCY CHIEF INFORMATION OF14 FICERS.—The Chief Information Officer or an equivalent 

15 official of a component agency shall report to— 

16 ‘‘(1) the Chief Information Officer designated 

17 under section 3506(a)(2) of title 44 or an equivalent 

18 official of the agency of which the component agency 

19 is a component; and 

20 ‘‘(2) the head of the component agency. 

21 ‘‘(e) REPORTING STRUCTURE EXEMPTION.— 

22 ‘‘(1) IN GENERAL.—On annual basis, the Direc23 tor may exempt any agency from the reporting 

24 structure requirements under subsection (d). 
76 

†S 3600 ES

1 ‘‘(2) REPORT.—On an annual basis, the Direc2 tor shall submit to the Committee on Homeland Se3 curity and Governmental Affairs of the Senate and 

4 the Committee on Oversight and Reform of the 

5 House of Representatives a report that includes a 

6 list of each exemption granted under paragraph (1) 

7 and the associated rationale for each exemption. 

8 ‘‘(3) COMPONENT OF OTHER REPORT.—The re9 port required under paragraph (2) may be incor10 porated into any other annual report required under 

11 chapter 35 of title 44, United States Code.’’; 

12 (4) in section 11317, by inserting ‘‘security,’’ 

13 before ‘‘or schedule’’; and 

14 (5) in section 11319(b)(1), in the paragraph 

15 heading, by striking ‘‘CIOS’’ and inserting ‘‘CHIEF

16 INFORMATION OFFICERS’’. 

17 SEC. 105. ACTIONS TO ENHANCE FEDERAL INCIDENT 

18 TRANSPARENCY. 

19 (a) RESPONSIBILITIES OF THE CYBERSECURITY AND

20 INFRASTRUCTURE SECURITY AGENCY.— 

21 (1) IN GENERAL.—Not later than 180 days 

22 after the date of enactment of this Act, the Director 

23 of the Cybersecurity and Infrastructure Security 

24 Agency shall— 
77 

†S 3600 ES

1 (A) develop a plan for the development of 

2 the analysis required under section 3597(a) of 

3 title 44, United States Code, as added by this 

4 title, and the report required under subsection 

5 (b) of that section that includes— 

6 (i) a description of any challenges the 

7 Director of the Cybersecurity and Infra8 structure Security Agency anticipates en9 countering; and 

10 (ii) the use of automation and ma11 chine-readable formats for collecting, com12 piling, monitoring, and analyzing data; and 

13 (B) provide to the appropriate congres14 sional committees a briefing on the plan devel15 oped under subparagraph (A). 

16 (2) BRIEFING.—Not later than 1 year after the 

17 date of enactment of this Act, the Director of the 

18 Cybersecurity and Infrastructure Security Agency 

19 shall provide to the appropriate congressional com20 mittees a briefing on— 

21 (A) the execution of the plan required 

22 under paragraph (1)(A); and 

23 (B) the development of the report required 

24 under section 3597(b) of title 44, United States 

25 Code, as added by this title. 
78 

†S 3600 ES

1 (b) RESPONSIBILITIES OF THE DIRECTOR OF THE

2 OFFICE OF MANAGEMENT AND BUDGET.— 

3 (1) FISMA.—Section 2 of the Federal Informa4 tion Security Modernization Act of 2014 (44 U.S.C. 

5 3554 note) is amended— 

6 (A) by striking subsection (b); and 

7 (B) by redesignating subsections (c) 

8 through (f) as subsections (b) through (e), re9 spectively. 

10 (2) INCIDENT DATA SHARING.— 

11 (A) IN GENERAL.—The Director shall de12 velop guidance, to be updated not less fre13 quently than once every 2 years, on the content, 

14 timeliness, and format of the information pro15 vided by agencies under section 3594(a) of title 

16 44, United States Code, as added by this title. 

17 (B) REQUIREMENTS.—The guidance devel18 oped under subparagraph (A) shall— 

19 (i) prioritize the availability of data 

20 necessary to understand and analyze— 

21 (I) the causes of incidents; 

22 (II) the scope and scale of inci23 dents within the environments and 

24 systems of an agency; 
79 

†S 3600 ES

1 (III) a root cause analysis of in2 cidents that— 

3 (aa) are common across the 

4 Federal Government; or 

5 (bb) have a Government6 wide impact; 

7 (IV) agency response, recovery, 

8 and remediation actions and the effec9 tiveness of those actions; and 

10 (V) the impact of incidents; 

11 (ii) enable the efficient development 

12 of— 

13 (I) lessons learned and rec14 ommendations in responding to, recov15 ering from, remediating, and miti16 gating future incidents; and 

17 (II) the report on Federal inci18 dents required under section 3597(b) 

19 of title 44, United States Code, as 

20 added by this title; 

21 (iii) include requirements for the time22 liness of data production; and 

23 (iv) include requirements for using 

24 automation and machine-readable data for 

25 data sharing and availability. 
80 

†S 3600 ES

1 (3) GUIDANCE ON RESPONDING TO INFORMA2 TION REQUESTS.—Not later than 1 year after the 

3 date of enactment of this Act, the Director shall de4 velop guidance for agencies to implement the re5 quirement under section 3594(c) of title 44, United 

6 States Code, as added by this title, to provide infor7 mation to other agencies experiencing incidents. 

8 (4) STANDARD GUIDANCE AND TEMPLATES.— 

9 Not later than 1 year after the date of enactment 

10 of this Act, the Director, in consultation with the 

11 Director of the Cybersecurity and Infrastructure Se12 curity Agency, shall develop guidance and templates, 

13 to be reviewed and, if necessary, updated not less 

14 frequently than once every 2 years, for use by Fed15 eral agencies in the activities required under sections 

16 3592, 3593, and 3596 of title 44, United States 

17 Code, as added by this title. 

18 (5) CONTRACTOR AND AWARDEE GUIDANCE.— 

19 (A) IN GENERAL.—Not later than 1 year 

20 after the date of enactment of this Act, the Di21 rector, in coordination with the Secretary of 

22 Homeland Security, the Secretary of Defense, 

23 the Administrator of General Services, and the 

24 heads of other agencies determined appropriate 

25 by the Director, shall issue guidance to Federal 
81 

†S 3600 ES

1 agencies on how to deconflict, to the greatest 

2 extent practicable, existing regulations, policies, 

3 and procedures relating to the responsibilities of 

4 contractors and awardees established under sec5 tion 3595 of title 44, United States Code, as 

6 added by this title. 

7 (B) EXISTING PROCESSES.—To the great8 est extent practicable, the guidance issued 

9 under subparagraph (A) shall allow contractors 

10 and awardees to use existing processes for noti11 fying Federal agencies of incidents involving in12 formation of the Federal Government. 

13 (6) UPDATED BRIEFINGS.—Not less frequently 

14 than once every 2 years, the Director shall provide 

15 to the appropriate congressional committees an up16 date on the guidance and templates developed under 

17 paragraphs (2) through (4). 

18 (c) UPDATE TO THE PRIVACY ACT OF 1974.—Sec19 tion 552a(b) of title 5, United States Code (commonly 

20 known as the ‘‘Privacy Act of 1974’’) is amended— 

21 (1) in paragraph (11), by striking ‘‘or’’ at the 

22 end; 

23 (2) in paragraph (12), by striking the period at 

24 the end and inserting ‘‘; or’’; and 

25 (3) by adding at the end the following: 
82 

†S 3600 ES

1 ‘‘(13) to another agency in furtherance of a re2 sponse to an incident (as defined in section 3552 of 

3 title 44) and pursuant to the information sharing re4 quirements in section 3594 of title 44 if the head of 

5 the requesting agency has made a written request to 

6 the agency that maintains the record specifying the 

7 particular portion desired and the activity for which 

8 the record is sought.’’. 

9 SEC. 106. ADDITIONAL GUIDANCE TO AGENCIES ON FISMA 

10 UPDATES. 

11 Not later than 1 year after the date of enactment 

12 of this Act, the Director, in consultation with the Director 

13 of the Cybersecurity and Infrastructure Security Agency, 

14 shall issue guidance for agencies on— 

15 (1) performing the ongoing and continuous 

16 agency system risk assessment required under sec17 tion 3554(a)(1)(A) of title 44, United States Code, 

18 as amended by this title; 

19 (2) implementing additional cybersecurity pro20 cedures, which shall include resources for shared 

21 services; 

22 (3) establishing a process for providing the sta23 tus of each remedial action under section 3554(b)(7) 

24 of title 44, United States Code, as amended by this 

25 title, to the Director and the Cybersecurity and In-
83 

†S 3600 ES

1 frastructure Security Agency using automation and 

2 machine-readable data, as practicable, which shall 

3 include— 

4 (A) specific guidance for the use of auto5 mation and machine-readable data; and 

6 (B) templates for providing the status of 

7 the remedial action; and 

8 (4) a requirement to coordinate with inspectors 

9 general of agencies to ensure consistent under10 standing and application of agency policies for the 

11 purpose of evaluations by inspectors general. 

12 SEC. 107. AGENCY REQUIREMENTS TO NOTIFY PRIVATE 

13 SECTOR ENTITIES IMPACTED BY INCIDENTS. 

14 (a) DEFINITIONS.—In this section: 

15 (1) REPORTING ENTITY.—The term ‘‘reporting 

16 entity’’ means private organization or governmental 

17 unit that is required by statute or regulation to sub18 mit sensitive information to an agency. 

19 (2) SENSITIVE INFORMATION.—The term ‘‘sen20 sitive information’’ has the meaning given the term 

21 by the Director in guidance issued under subsection 

22 (b). 

23 (b) GUIDANCE ON NOTIFICATION OF REPORTING EN24 TITIES.—Not later than 180 days after the date of enact25 ment of this Act, the Director shall issue guidance requir-
84 

†S 3600 ES

1 ing the head of each agency to notify a reporting entity 

2 of an incident that is likely to substantially affect— 

3 (1) the confidentiality or integrity of sensitive 

4 information submitted by the reporting entity to the 

5 agency pursuant to a statutory or regulatory re6 quirement; or 

7 (2) the agency information system or systems 

8 used in the transmission or storage of the sensitive 

9 information described in paragraph (1). 

10 SEC. 108. MOBILE SECURITY STANDARDS. 

11 (a) IN GENERAL.—Not later than 1 year after the 

12 date of enactment of this Act, the Director shall— 

13 (1) evaluate mobile application security guid14 ance promulgated by the Director; and 

15 (2) issue guidance to secure mobile devices, in16 cluding for mobile applications, for every agency. 

17 (b) CONTENTS.—The guidance issued under sub18 section (a)(2) shall include— 

19 (1) a requirement, pursuant to section 

20 3506(b)(4) of title 44, United States Code, for every 

21 agency to maintain a continuous inventory of 

22 every— 

23 (A) mobile device operated by or on behalf 

24 of the agency; and 
85 

†S 3600 ES

1 (B) vulnerability identified by the agency 

2 associated with a mobile device; and 

3 (2) a requirement for every agency to perform 

4 continuous evaluation of the vulnerabilities described 

5 in paragraph (1)(B) and other risks associated with 

6 the use of applications on mobile devices. 

7 (c) INFORMATION SHARING.—The Director, in co8 ordination with the Director of the Cybersecurity and In9 frastructure Security Agency, shall issue guidance to 

10 agencies for sharing the inventory of the agency required 

11 under subsection (b)(1) with the Director of the Cyberse12 curity and Infrastructure Security Agency, using automa13 tion and machine-readable data to the greatest extent 

14 practicable. 

15 (d) BRIEFING.—Not later than 60 days after the date 

16 on which the Director issues guidance under subsection 

17 (a)(2), the Director, in coordination with the Director of 

18 the Cybersecurity and Infrastructure Security Agency, 

19 shall provide to the appropriate congressional committees 

20 a briefing on the guidance. 

21 SEC. 109. DATA AND LOGGING RETENTION FOR INCIDENT 

22 RESPONSE. 

23 (a) RECOMMENDATIONS.—Not later than 2 years 

24 after the date of enactment of this Act, and not less fre25 quently than every 2 years thereafter, the Director of the 
86 

†S 3600 ES

1 Cybersecurity and Infrastructure Security Agency, in con2 sultation with the Attorney General, shall submit to the 

3 Director recommendations on requirements for logging 

4 events on agency systems and retaining other relevant 

5 data within the systems and networks of an agency. 

6 (b) CONTENTS.—The recommendations provided 

7 under subsection (a) shall include— 

8 (1) the types of logs to be maintained; 

9 (2) the duration that logs and other relevant 

10 data should be retained; 

11 (3) the time periods for agency implementation 

12 of recommended logging and security requirements; 

13 (4) how to ensure the confidentiality, integrity, 

14 and availability of logs; 

15 (5) requirements to ensure that, upon request, 

16 in a manner that excludes or otherwise reasonably 

17 protects personally identifiable information, and to 

18 the extent permitted by applicable law (including 

19 privacy and statistical laws), agencies provide logs 

20 to— 

21 (A) the Director of the Cybersecurity and 

22 Infrastructure Security Agency for a cybersecu23 rity purpose; and 

24 (B) the Director of the Federal Bureau of 

25 Investigation, or the appropriate Federal law 
87 

†S 3600 ES

1 enforcement agency, to investigate potential 

2 criminal activity; and 

3 (6) requirements to ensure that, subject to com4 pliance with statistical laws and other relevant data 

5 protection requirements, the highest level security 

6 operations center of each agency has visibility into 

7 all agency logs. 

8 (c) GUIDANCE.—Not later than 90 days after receiv9 ing the recommendations submitted under subsection (a), 

10 the Director, in consultation with the Director of the Cy11 bersecurity and Infrastructure Security Agency and the 

12 Attorney General, shall, as determined to be appropriate 

13 by the Director, update guidance to agencies regarding re14 quirements for logging, log retention, log management, 

15 sharing of log data with other appropriate agencies, or any 

16 other logging activity determined to be appropriate by the 

17 Director. 

18 (d) SUNSET.—This section shall cease to have force 

19 or effect on the date that is 10 years after the date of 

20 the enactment of this Act. 

21 SEC. 110. CISA AGENCY ADVISORS. 

22 (a) IN GENERAL.—Not later than 120 days after the 

23 date of enactment of this Act, the Director of the Cyberse24 curity and Infrastructure Security Agency shall assign not 

25 less than 1 cybersecurity professional employed by the Cy-
88 

†S 3600 ES

1 bersecurity and Infrastructure Security Agency to be the 

2 Cybersecurity and Infrastructure Security Agency advisor 

3 to the senior agency information security officer of each 

4 agency. 

5 (b) QUALIFICATIONS.—Each advisor assigned under 

6 subsection (a) shall have knowledge of— 

7 (1) cybersecurity threats facing agencies, in8 cluding any specific threats to the assigned agency; 

9 (2) performing risk assessments of agency sys10 tems; and 

11 (3) other Federal cybersecurity initiatives. 

12 (c) DUTIES.—The duties of each advisor assigned 

13 under subsection (a) shall include— 

14 (1) providing ongoing assistance and advice, as 

15 requested, to the agency Chief Information Officer; 

16 (2) serving as an incident response point of 

17 contact between the assigned agency and the Cyber18 security and Infrastructure Security Agency; and 

19 (3) familiarizing themselves with agency sys20 tems, processes, and procedures to better facilitate 

21 support to the agency in responding to incidents. 

22 (d) LIMITATION.—An advisor assigned under sub23 section (a) shall not be a contractor. 
89 

†S 3600 ES

1 (e) MULTIPLE ASSIGNMENTS.—One individual advi2 sor may be assigned to multiple agency Chief Information 

3 Officers under subsection (a). 

4 SEC. 111. FEDERAL PENETRATION TESTING POLICY. 

5 (a) IN GENERAL.—Subchapter II of chapter 35 of 

6 title 44, United States Code, is amended by adding at the 

7 end the following: 

8 ‘‘§ 3559A. Federal penetration testing 

9 ‘‘(a) DEFINITIONS.—In this section: 

10 ‘‘(1) AGENCY OPERATIONAL PLAN.—The term 

11 ‘agency operational plan’ means a plan of an agency 

12 for the use of penetration testing. 

13 ‘‘(2) RULES OF ENGAGEMENT.—The term 

14 ‘rules of engagement’ means a set of rules estab15 lished by an agency for the use of penetration test16 ing. 

17 ‘‘(b) GUIDANCE.— 

18 ‘‘(1) IN GENERAL.—The Director, in consulta19 tion with the Secretary, acting through the Director 

20 of the Cybersecurity and Infrastructure Security 

21 Agency, shall issue guidance to agencies that— 

22 ‘‘(A) requires agencies to use, when and 

23 where appropriate, penetration testing on agen24 cy systems by both Federal and non-Federal en25 tities; and 
90 

†S 3600 ES

1 ‘‘(B) requires agencies to develop an agen2 cy operational plan and rules of engagement 

3 that meet the requirements under subsection 

4 (c). 

5 ‘‘(2) PENETRATION TESTING GUIDANCE.—The 

6 guidance issued under this section shall— 

7 ‘‘(A) permit an agency to use, for the pur8 pose of performing penetration testing— 

9 ‘‘(i) a shared service of the agency or 

10 another agency; or 

11 ‘‘(ii) an external entity, such as a ven12 dor; and 

13 ‘‘(B) require agencies to provide the rules 

14 of engagement and results of penetration test15 ing to the Director and the Director of the Cy16 bersecurity and Infrastructure Security Agency, 

17 without regard to the status of the entity that 

18 performs the penetration testing. 

19 ‘‘(c) AGENCY PLANS AND RULES OF ENGAGE20 MENT.—The agency operational plan and rules of engage21 ment of an agency shall— 

22 ‘‘(1) require the agency to— 

23 ‘‘(A) perform penetration testing, including 

24 on the high value assets of the agency; or 
91 

†S 3600 ES

1 ‘‘(B) coordinate with the Director of the 

2 Cybersecurity and Infrastructure Security 

3 Agency to ensure that penetration testing is 

4 being performed; 

5 ‘‘(2) establish guidelines for avoiding, as a re6 sult of penetration testing— 

7 ‘‘(A) adverse impacts to the operations of 

8 the agency; 

9 ‘‘(B) adverse impacts to operational envi10 ronments and systems of the agency; and 

11 ‘‘(C) inappropriate access to data; 

12 ‘‘(3) require the results of penetration testing 

13 to include feedback to improve the cybersecurity of 

14 the agency; and 

15 ‘‘(4) include mechanisms for providing consist16 ently formatted, and, if applicable, automated and 

17 machine-readable, data to the Director and the Di18 rector of the Cybersecurity and Infrastructure Secu19 rity Agency. 

20 ‘‘(d) RESPONSIBILITIES OF CISA.—The Director of 

21 the Cybersecurity and Infrastructure Security Agency 

22 shall— 

23 ‘‘(1) establish a process to assess the perform24 ance of penetration testing by both Federal and non- 
92 

†S 3600 ES

1 Federal entities that establishes minimum quality 

2 controls for penetration testing; 

3 ‘‘(2) develop operational guidance for insti4 tuting penetration testing programs at agencies; 

5 ‘‘(3) develop and maintain a centralized capa6 bility to offer penetration testing as a service to 

7 Federal and non-Federal entities; and 

8 ‘‘(4) provide guidance to agencies on the best 

9 use of penetration testing resources. 

10 ‘‘(e) RESPONSIBILITIES OF OMB.—The Director, in 

11 coordination with the Director of the Cybersecurity and 

12 Infrastructure Security Agency, shall— 

13 ‘‘(1) not less frequently than annually, inven14 tory all Federal penetration testing assets; and 

15 ‘‘(2) develop and maintain a standardized proc16 ess for the use of penetration testing. 

17 ‘‘(f) PRIORITIZATION OF PENETRATION TESTING RE18 SOURCES.— 

19 ‘‘(1) IN GENERAL.—The Director, in coordina20 tion with the Director of the Cybersecurity and In21 frastructure Security Agency, shall develop a frame22 work for prioritizing Federal penetration testing re23 sources among agencies. 
93 

†S 3600 ES

1 ‘‘(2) CONSIDERATIONS.—In developing the 

2 framework under this subsection, the Director shall 

3 consider— 

4 ‘‘(A) agency system risk assessments per5 formed under section 3554(a)(1)(A); 

6 ‘‘(B) the Federal risk assessment per7 formed under section 3553(i); 

8 ‘‘(C) the analysis of Federal incident data 

9 performed under section 3597; and 

10 ‘‘(D) any other information determined ap11 propriate by the Director or the Director of the 

12 Cybersecurity and Infrastructure Security 

13 Agency. 

14 ‘‘(g) EXCEPTION FOR NATIONAL SECURITY SYS15 TEMS.—The guidance issued under subsection (b) shall 

16 not apply to national security systems. 

17 ‘‘(h) DELEGATION OF AUTHORITY FOR CERTAIN

18 SYSTEMS.—The authorities of the Director described in 

19 subsection (b) shall be delegated— 

20 ‘‘(1) to the Secretary of Defense in the case of 

21 systems described in section 3553(e)(2); and 

22 ‘‘(2) to the Director of National Intelligence in 

23 the case of systems described in 3553(e)(3).’’. 

24 (b) DEADLINE FOR GUIDANCE.—Not later than 180 

25 days after the date of enactment of this Act, the Director 
94 

†S 3600 ES

1 shall issue the guidance required under section 3559A(b) 

2 of title 44, United States Code, as added by subsection 

3 (a). 

4 (c) CLERICAL AMENDMENT.—The table of sections 

5 for chapter 35 of title 44, United States Code, is amended 

6 by adding after the item relating to section 3559 the fol7 lowing: 

‘‘3559A. Federal penetration testing.’’. 

8 (d) SUNSET.— 

9 (1) IN GENERAL.—Effective on the date that is 

10 10 years after the date of enactment of this Act, 

11 subchapter II of chapter 35 of title 44, United 

12 States Code, is amended by striking section 3559A. 

13 (2) CLERICAL AMENDMENT.—Effective on the 

14 date that is 10 years after the date of enactment of 

15 this Act, the table of sections for chapter 35 of title 

16 44, United States Code, is amended by striking the 

17 item relating to section 3559A. 

18 SEC. 112. ONGOING THREAT HUNTING PROGRAM. 

19 (a) THREAT HUNTING PROGRAM.— 

20 (1) IN GENERAL.—Not later than 540 days 

21 after the date of enactment of this Act, the Director 

22 of the Cybersecurity and Infrastructure Security 

23 Agency shall establish a program to provide ongoing, 

24 hypothesis-driven threat-hunting services on the net25 work of each agency. 
95 

†S 3600 ES

1 (2) PLAN.—Not later than 180 days after the 

2 date of enactment of this Act, the Director of the 

3 Cybersecurity and Infrastructure Security Agency 

4 shall develop a plan to establish the program re5 quired under paragraph (1) that describes how the 

6 Director of the Cybersecurity and Infrastructure Se7 curity Agency plans to— 

8 (A) determine the method for collecting, 

9 storing, accessing, analyzing, and safeguarding 

10 appropriate agency data; 

11 (B) provide on-premises support to agen12 cies; 

13 (C) staff threat hunting services; 

14 (D) allocate available human and financial 

15 resources to implement the plan; and 

16 (E) provide input to the heads of agencies 

17 on the use of additional cybersecurity proce18 dures under section 3554 of title 44, United 

19 States Code. 

20 (b) REPORTS.—The Director of the Cybersecurity 

21 and Infrastructure Security Agency shall submit to the ap22 propriate congressional committees— 

23 (1) not later than 30 days after the date on 

24 which the Director of the Cybersecurity and Infra25 structure Security Agency completes the plan re-
96 

†S 3600 ES

1 quired under subsection (a)(2), a report on the plan 

2 to provide threat hunting services to agencies; 

3 (2) not less than 30 days before the date on 

4 which the Director of the Cybersecurity and Infra5 structure Security Agency begins providing threat 

6 hunting services under the program under sub7 section (a)(1), a report providing any updates to the 

8 plan developed under subsection (a)(2); and 

9 (3) not later than 1 year after the date on 

10 which the Director of the Cybersecurity and Infra11 structure Security Agency begins providing threat 

12 hunting services to agencies other than the Cyberse13 curity and Infrastructure Security Agency, a report 

14 describing lessons learned from providing those serv15 ices. 

16 SEC. 113. CODIFYING VULNERABILITY DISCLOSURE PRO17 GRAMS. 

18 (a) IN GENERAL.—Chapter 35 of title 44, United 

19 States Code, is amended by inserting after section 3559A, 

20 as added by section 111 of this title, the following: 

21 ‘‘§ 3559B. Federal vulnerability disclosure programs 

22 ‘‘(a) PURPOSE; SENSE OF CONGRESS.— 

23 ‘‘(1) PURPOSE.—The purpose of Federal vul24 nerability disclosure programs is to create a mecha25 nism to use the expertise of the public to provide a 
97 

†S 3600 ES

1 service to Federal agencies by identifying informa2 tion system vulnerabilities. 

3 ‘‘(2) SENSE OF CONGRESS.—It is the sense of 

4 Congress that, in implementing the requirements of 

5 this section, the Federal Government should take 

6 appropriate steps to reduce real and perceived bur7 dens in communications between agencies and secu8 rity researchers. 

9 ‘‘(b) DEFINITIONS.—In this section: 

10 ‘‘(1) REPORT.—The term ‘report’ means a vul11 nerability disclosure made to an agency by a re12 porter. 

13 ‘‘(2) REPORTER.—The term ‘reporter’ means 

14 an individual that submits a vulnerability report 

15 pursuant to the vulnerability disclosure process of an 

16 agency. 

17 ‘‘(c) RESPONSIBILITIES OF OMB.— 

18 ‘‘(1) LIMITATION ON LEGAL ACTION.—The Di19 rector, in consultation with the Attorney General, 

20 shall issue guidance to agencies to not recommend or 

21 pursue legal action against a reporter or an indi22 vidual that conducts a security research activity that 

23 the head of the agency determines— 
98 

†S 3600 ES

1 ‘‘(A) represents a good faith effort to fol2 low the vulnerability disclosure policy of the 

3 agency developed under subsection (e)(2); and 

4 ‘‘(B) is authorized under the vulnerability 

5 disclosure policy of the agency developed under 

6 subsection (e)(2). 

7 ‘‘(2) SHARING INFORMATION WITH CISA.—The 

8 Director, in coordination with the Director of the 

9 Cybersecurity and Infrastructure Security Agency 

10 and in consultation with the National Cyber Direc11 tor, shall issue guidance to agencies on sharing rel12 evant information in a consistent, automated, and 

13 machine readable manner with the Director of the 

14 Cybersecurity and Infrastructure Security Agency, 

15 including— 

16 ‘‘(A) any valid or credible reports of newly 

17 discovered or not publicly known vulnerabilities 

18 (including misconfigurations) on Federal infor19 mation systems that use commercial software or 

20 services; 

21 ‘‘(B) information relating to vulnerability 

22 disclosure, coordination, or remediation activi23 ties of an agency, particularly as those activities 

24 relate to outside organizations— 
99 

†S 3600 ES

1 ‘‘(i) with which the head of the agency 

2 believes the Director of the Cybersecurity 

3 and Infrastructure Security Agency can as4 sist; or 

5 ‘‘(ii) about which the head of the 

6 agency believes the Director of the Cyber7 security and Infrastructure Security Agen8 cy should know; and 

9 ‘‘(C) any other information with respect to 

10 which the head of the agency determines helpful 

11 or necessary to involve the Director of the Cy12 bersecurity and Infrastructure Security Agency. 

13 ‘‘(3) AGENCY VULNERABILITY DISCLOSURE

14 POLICIES.—The Director shall issue guidance to 

15 agencies on the required minimum scope of agency 

16 systems covered by the vulnerability disclosure policy 

17 of an agency required under subsection (e)(2). 

18 ‘‘(d) RESPONSIBILITIES OF CISA.—The Director of 

19 the Cybersecurity and Infrastructure Security Agency 

20 shall— 

21 ‘‘(1) provide support to agencies with respect to 

22 the implementation of the requirements of this sec23 tion; 

24 ‘‘(2) develop tools, processes, and other mecha25 nisms determined appropriate to offer agencies capa-
100 

†S 3600 ES

1 bilities to implement the requirements of this sec2 tion; and 

3 ‘‘(3) upon a request by an agency, assist the 

4 agency in the disclosure to vendors of newly identi5 fied vulnerabilities in vendor products and services. 

6 ‘‘(e) RESPONSIBILITIES OF AGENCIES.— 

7 ‘‘(1) PUBLIC INFORMATION.—The head of each 

8 agency shall make publicly available, with respect to 

9 each internet domain under the control of the agen10 cy that is not a national security system— 

11 ‘‘(A) an appropriate security contact; and 

12 ‘‘(B) the component of the agency that is 

13 responsible for the internet accessible services 

14 offered at the domain. 

15 ‘‘(2) VULNERABILITY DISCLOSURE POLICY.— 

16 The head of each agency shall develop and make 

17 publicly available a vulnerability disclosure policy for 

18 the agency, which shall— 

19 ‘‘(A) describe— 

20 ‘‘(i) the scope of the systems of the 

21 agency included in the vulnerability disclo22 sure policy; 

23 ‘‘(ii) the type of information system 

24 testing that is authorized by the agency; 
101 

†S 3600 ES

1 ‘‘(iii) the type of information system 

2 testing that is not authorized by the agen3 cy; and 

4 ‘‘(iv) the disclosure policy of the agen5 cy for sensitive information; 

6 ‘‘(B) with respect to a report to an agency, 

7 describe— 

8 ‘‘(i) how the reporter should submit 

9 the report; and 

10 ‘‘(ii) if the report is not anonymous, 

11 when the reporter should anticipate an ac12 knowledgment of receipt of the report by 

13 the agency; 

14 ‘‘(C) include any other relevant informa15 tion; and 

16 ‘‘(D) be mature in scope and cover every 

17 internet accessible Federal information system 

18 used or operated by that agency or on behalf of 

19 that agency. 

20 ‘‘(3) IDENTIFIED VULNERABILITIES.—The head 

21 of each agency shall incorporate any vulnerabilities 

22 reported under paragraph (2) into the vulnerability 

23 management process of the agency in order to track 

24 and remediate the vulnerability. 
102 

†S 3600 ES

1 ‘‘(f) CONGRESSIONAL REPORTING.—Not later than 

2 90 days after the date of enactment of the Federal Infor3 mation Security Modernization Act of 2022, and annually 

4 thereafter for a 3-year period, the Director of the Cyberse5 curity and Infrastructure Security Agency, in consultation 

6 with the Director, shall provide to the Committee on 

7 Homeland Security and Governmental Affairs of the Sen8 ate and the Committee on Oversight and Reform of the 

9 House of Representatives a briefing on the status of the 

10 use of vulnerability disclosure policies under this section 

11 at agencies, including, with respect to the guidance issued 

12 under subsection (c)(3), an identification of the agencies 

13 that are compliant and not compliant. 

14 ‘‘(g) EXEMPTIONS.—The authorities and functions of 

15 the Director and Director of the Cybersecurity and Infra16 structure Security Agency under this section shall not 

17 apply to national security systems. 

18 ‘‘(h) DELEGATION OF AUTHORITY FOR CERTAIN

19 SYSTEMS.—The authorities of the Director and the Direc20 tor of the Cybersecurity and Infrastructure Security Agen21 cy described in this section shall be delegated— 

22 ‘‘(1) to the Secretary of Defense in the case of 

23 systems described in section 3553(e)(2); and 
103 

†S 3600 ES

1 ‘‘(2) to the Director of National Intelligence in 

2 the case of systems described in section 

3 3553(e)(3).’’. 

4 (b) CLERICAL AMENDMENT.—The table of sections 

5 for chapter 35 of title 44, United States Code, is amended 

6 by adding after the item relating to section 3559A, as 

7 added by section 111, the following: 

‘‘3559B. Federal vulnerability disclosure programs.’’. 

8 (c) SUNSET.— 

9 (1) IN GENERAL.—Effective on the date that is 

10 10 years after the date of enactment of this Act, 

11 subchapter II of chapter 35 of title 44, United 

12 States Code, is amended by striking section 3559B. 

13 (2) CLERICAL AMENDMENT.—Effective on the 

14 date that is 10 years after the date of enactment of 

15 this Act, the table of sections for chapter 35 of title 

16 44, United States Code, is amended by striking the 

17 item relating to section 3559B. 

18 SEC. 114. IMPLEMENTING ZERO TRUST ARCHITECTURE. 

19 (a) GUIDANCE.—Not later than 18 months after the 

20 date of enactment of this Act, the Director shall provide 

21 an update to the appropriate congressional committees on 

22 progress in increasing the internal defenses of agency sys23 tems, including— 
104 

†S 3600 ES

1 (1) shifting away from ‘‘trusted networks’’ to 

2 implement security controls based on a presumption 

3 of compromise; 

4 (2) implementing principles of least privilege in 

5 administering information security programs; 

6 (3) limiting the ability of entities that cause in7 cidents to move laterally through or between agency 

8 systems; 

9 (4) identifying incidents quickly; 

10 (5) isolating and removing unauthorized entities 

11 from agency systems as quickly as practicable, ac12 counting for intelligence or law enforcement pur13 poses; 

14 (6) otherwise increasing the resource costs for 

15 entities that cause incidents to be successful; and 

16 (7) a summary of the agency progress reports 

17 required under subsection (b). 

18 (b) AGENCY PROGRESS REPORTS.—Not later than 

19 270 days after the date of enactment of this Act, the head 

20 of each agency shall submit to the Director a progress re21 port on implementing an information security program 

22 based on the presumption of compromise and least privi23 lege principles, which shall include— 

24 (1) a description of any steps the agency has 

25 completed, including progress toward achieving re-
105 

†S 3600 ES

1 quirements issued by the Director, including the 

2 adoption of any models or reference architecture; 

3 (2) an identification of activities that have not 

4 yet been completed and that would have the most 

5 immediate security impact; and 

6 (3) a schedule to implement any planned activi7 ties. 

8 SEC. 115. AUTOMATION REPORTS. 

9 (a) OMB REPORT.—Not later than 180 days after 

10 the date of enactment of this Act, the Director shall pro11 vide to the appropriate congressional committees an up12 date on the use of automation under paragraphs (1), 

13 (5)(C), and (8)(B) of section 3554(b) of title 44, United 

14 States Code. 

15 (b) GAO REPORT.—Not later than 1 year after the 

16 date of enactment of this Act, the Comptroller General 

17 of the United States shall perform a study on the use of 

18 automation and machine readable data across the Federal 

19 Government for cybersecurity purposes, including the 

20 automated updating of cybersecurity tools, sensors, or 

21 processes by agencies. 
106 

†S 3600 ES

1 SEC. 116. EXTENSION OF FEDERAL ACQUISITION SECURITY 

2 COUNCIL AND SOFTWARE INVENTORY. 

3 (a) EXTENSION.—Section 1328 of title 41, United 

4 States Code, is amended by striking ‘‘the date that’’ and 

5 all that follows and inserting ‘‘December 31, 2026.’’. 

6 (b) REQUIREMENT.—Subsection 1326(b) of title 41, 

7 United States Code, is amended— 

8 (1) in paragraph (5), by striking ‘‘and’’ at the 

9 end; 

10 (2) by redesignating paragraph (6) as para11 graph (7); and 

12 (3) by inserting after paragraph (5) the fol13 lowing: 

14 ‘‘(6) maintaining an up-to-date and accurate in15 ventory of software in use by the agency and, if 

16 available and applicable, the components of such 

17 software, that can be communicated at the request 

18 of the Federal Acquisition Security Council, the Na19 tional Cyber Director, or the Secretary of Homeland 

20 Security, acting through the Director of Cybersecu21 rity and Infrastructure Security Agency; and’’. 

22 SEC. 117. COUNCIL OF THE INSPECTORS GENERAL ON IN23 TEGRITY AND EFFICIENCY DASHBOARD. 

24 (a) DASHBOARD REQUIRED.—Section 11(e)(2) of the 

25 Inspector General Act of 1978 (5 U.S.C. App.) is amend26 ed— 
107 

†S 3600 ES

1 (1) in subparagraph (A), by striking ‘‘and’’ at 

2 the end; 

3 (2) by redesignating subparagraph (B) as sub4 paragraph (C); and 

5 (3) by inserting after subparagraph (A) the fol6 lowing: 

7 ‘‘(B) that shall include a dashboard of 

8 open information security recommendations 

9 identified in the independent evaluations re10 quired by section 3555(a) of title 44, United 

11 States Code; and’’. 

12 SEC. 118. QUANTITATIVE CYBERSECURITY METRICS. 

13 (a) DEFINITION OF COVERED METRICS.—In this sec14 tion, the term ‘‘covered metrics’’ means the metrics estab15 lished, reviewed, and updated under section 224(c) of the 

16 Cybersecurity Act of 2015 (6 U.S.C. 1522(c)). 

17 (b) UPDATING AND ESTABLISHING METRICS.—Not 

18 later than 1 year after the date of enactment of this Act, 

19 and as appropriate thereafter, the Director of the Cyberse20 curity and Infrastructure Security Agency, in coordination 

21 with the Director, shall— 

22 (1) evaluate any covered metrics established as 

23 of the date of enactment of this Act; and 
108 

†S 3600 ES

1 (2) as appropriate and pursuant to section 

2 224(c) of the Cybersecurity Act of 2015 (6 U.S.C. 

3 1522(c)) update or establish new covered metrics. 

4 (c) IMPLEMENTATION.— 

5 (1) IN GENERAL.—Not later than 540 days 

6 after the date of enactment of this Act, the Director, 

7 in coordination with the Director of the Cybersecu8 rity and Infrastructure Security Agency, shall pro9 mulgate guidance that requires each agency to use 

10 covered metrics to track trends in the cybersecurity 

11 and incident response capabilities of the agency. 

12 (2) PERFORMANCE DEMONSTRATION.—The 

13 guidance issued under paragraph (1) and any subse14 quent guidance shall require agencies to share with 

15 the Director of the Cybersecurity and Infrastructure 

16 Security Agency data demonstrating the perform17 ance of the agency using the covered metrics in18 cluded in the guidance. 

19 (3) PENETRATION TESTS.—On not less than 2 

20 occasions during the 2-year period following the date 

21 on which guidance is promulgated under paragraph 

22 (1), the Director shall ensure that not less than 3 

23 agencies are subjected to substantially similar pene24 tration tests, as determined by the Director, in co25 ordination with the Director of the Cybersecurity 
109 

†S 3600 ES

1 and Infrastructure Security Agency, in order to vali2 date the utility of the covered metrics. 

3 (4) ANALYSIS CAPACITY.—The Director of the 

4 Cybersecurity and Infrastructure Security Agency 

5 shall develop a capability that allows for the analysis 

6 of the covered metrics, including cross-agency per7 formance of agency cybersecurity and incident re8 sponse capability trends. 

9 (5) TIME-BASED METRIC.—With respect the 

10 first update or establishment of covered metrics re11 quired under subsection (b)(2), the Director of the 

12 Cybersecurity and Infrastructure Security Agency 

13 shall establish covered metrics that include not less 

14 than 1 metric addressing the time it takes for agen15 cies to identify and respond to incidents. 

16 (d) CONGRESSIONAL REPORTS.—Not later than 1 

17 year after the date of enactment of this Act, the Director 

18 of the Cybersecurity and Infrastructure Security Agency, 

19 in coordination with the Director, shall submit to the ap20 propriate congressional committees a report on the utility 

21 and use of the covered metrics. 

22 SEC. 119. ESTABLISHMENT OF RISK-BASED BUDGET 

23 MODEL. 

24 (a) DEFINITIONS.—In this section: 
110 

†S 3600 ES

1 (1) APPROPRIATE CONGRESSIONAL COMMIT2 TEES.—The term ‘‘appropriate congressional com3 mittees’’ means— 

4 (A) the Committee on Homeland Security 

5 and Governmental Affairs and the Committee 

6 on Appropriations of the Senate; and 

7 (B) the Committee on Oversight and Re8 form, the Committee on Homeland Security, 

9 and the Committee on Appropriations of the 

10 House of Representatives. 

11 (2) COVERED AGENCY.—The term ‘‘covered 

12 agency’’ has the meaning given the term ‘‘executive 

13 agency’’ in section 133 of title 41, United States 

14 Code. 

15 (3) DIRECTOR.—The term ‘‘Director’’ means 

16 the Director of the Office of Management and Budg17 et. 

18 (4) INFORMATION TECHNOLOGY.—The term 

19 ‘‘information technology’’— 

20 (A) has the meaning given the term in sec21 tion 11101 of title 40, United States Code; and 

22 (B) includes the hardware and software 

23 systems of a Federal agency that monitor and 

24 control physical equipment and processes of the 

25 Federal agency. 
111 

†S 3600 ES

1 (5) RISK-BASED BUDGET.—The term ‘‘risk2 based budget’’ means a budget— 

3 (A) developed by identifying and 

4 prioritizing cybersecurity risks and 

5 vulnerabilities, including impact on agency oper6 ations in the case of a cyber attack, through 

7 analysis of cyber threat intelligence, incident 

8 data, and tactics, techniques, procedures, and 

9 capabilities of cyber threats; and 

10 (B) that allocates resources based on the 

11 risks identified and prioritized under subpara12 graph (A). 

13 (b) ESTABLISHMENT OF RISK-BASED BUDGET

14 MODEL.— 

15 (1) IN GENERAL.— 

16 (A) MODEL.—Not later than 1 year after 

17 the first publication of the budget submitted by 

18 the President under section 1105 of title 31, 

19 United States Code, following the date of enact20 ment of this Act, the Director, in consultation 

21 with the Director of the Cybersecurity and In22 frastructure Security Agency and the National 

23 Cyber Director and in coordination with the Di24 rector of the National Institute of Standards 

25 and Technology, shall develop a standard model 
112 

†S 3600 ES

1 for informing a risk-based budget for cybersecu2 rity spending. 

3 (B) RESPONSIBILITY OF DIRECTOR.—Sec4 tion 3553(a) of title 44, United States Code, as 

5 amended by section 103 of this title, is further 

6 amended by inserting after paragraph (6) the 

7 following: 

8 ‘‘(7) developing a standard risk-based budget 

9 model to inform Federal agency cybersecurity budget 

10 development; and’’. 

11 (C) CONTENTS OF MODEL.—The model re12 quired to be developed under subparagraph (A) 

13 shall utilize appropriate information to evaluate 

14 risk, including, as determined appropriate by 

15 the Director— 

16 (i) Federal and non-Federal cyber 

17 threat intelligence products, where avail18 able, to identify threats, vulnerabilities, 

19 and risks; 

20 (ii) analysis of the impact of agency 

21 operations of compromise of systems, in22 cluding the interconnectivity to other agen23 cy systems and the operations of other 

24 agencies; and 
113 

†S 3600 ES

1 (iii) to the greatest extent practicable, 

2 analysis of where resources should be allo3 cated to have the greatest impact on miti4 gating current and future threats and cur5 rent and future cybersecurity capabilities. 

6 (D) USE OF MODEL.—The model required 

7 to be developed under subparagraph (A) shall 

8 be used to— 

9 (i) inform acquisition and sustainment 

10 of— 

11 (I) information technology and 

12 cybersecurity tools; 

13 (II) information technology and 

14 cybersecurity architectures; 

15 (III) information technology and 

16 cybersecurity personnel; and 

17 (IV) cybersecurity and informa18 tion technology concepts of operations; 

19 and 

20 (ii) evaluate and inform Government21 wide cybersecurity programs. 

22 (E) MODEL VARIATION.—The Director 

23 may develop multiple models under subpara24 graph (A) based on different agency character25 istics, such as size or cybersecurity maturity. 
114 

†S 3600 ES

1 (F) REQUIRED UPDATES.—Not less fre2 quently than once every 3 years, the Director 

3 shall review, and update as necessary, the 

4 model required to be developed under subpara5 graph (A). 

6 (G) PUBLICATION.—Not earlier than 5 

7 years after the date on which the model devel8 oped under subparagraph (A) is completed, the 

9 Director shall, taking into account any classi10 fied or sensitive information, publish the model, 

11 and any updates necessary under subparagraph 

12 (F), on the public website of the Office of Man13 agement and Budget. 

14 (H) REPORTS.—Not later than 2 years 

15 after the first publication of the budget sub16 mitted by the President under section 1105 of 

17 title 31, United States Code, following the date 

18 of enactment of this Act, and annually there19 after for each of the 2 following fiscal years or 

20 until the date on which the model required to 

21 be developed under subparagraph (A) is com22 pleted, whichever is sooner, the Director shall 

23 submit to the appropriate congressional com24 mittees a report on the development of the 

25 model. 
115 

†S 3600 ES

1 (2) PHASED IMPLEMENTATION OF RISK-BASED

2 BUDGET MODEL.— 

3 (A) INITIAL PHASE.— 

4 (i) IN GENERAL.—Not later than 2 

5 years after the date on which the model 

6 developed under paragraph (1) is com7 pleted, the Director shall require not less 

8 than 5 covered agencies to use the model 

9 to inform the development of the annual 

10 cybersecurity and information technology 

11 budget requests of those covered agencies. 

12 (ii) BRIEFING.—Not later than 1 year 

13 after the date on which the covered agen14 cies selected under clause (i) begin using 

15 the model developed under paragraph (1), 

16 the Director shall provide to the appro17 priate congressional committees a briefing 

18 on implementation of risk-based budgeting 

19 for cybersecurity spending, an assessment 

20 of agency implementation, and an evalua21 tion of whether the risk-based budget helps 

22 to mitigate cybersecurity vulnerabilities. 

23 (B) FULL DEPLOYMENT.—Not later than 

24 5 years after the date on which the model devel25 oped under paragraph (1) is completed, the 
116 

†S 3600 ES

1 head of each covered agency shall use the 

2 model, or any updated model pursuant to para3 graph (1)(F), to the greatest extent practicable, 

4 to inform the development of the annual cyber5 security and information technology budget re6 quests of the covered agency. 

7 (C) AGENCY PERFORMANCE PLANS.— 

8 (i) AMENDMENT.—Section 3554(d)(2) 

9 of title 44, United States Code, is amended 

10 by inserting ‘‘and the risk-based budget 

11 model required under section 3553(a)(7)’’ 

12 after ‘‘paragraph (1)’’. 

13 (ii) EFFECTIVE DATE.—The amend14 ment made by clause (i) shall take effect 

15 on the date that is 5 years after the date 

16 on which the model developed under para17 graph (1) is completed. 

18 (3) VERIFICATION.— 

19 (A) IN GENERAL.—Section 

20 1105(a)(35)(A)(i) of title 31, United States 

21 Code, is amended— 

22 (i) in the matter preceding subclause 

23 (I), by striking ‘‘by agency, and by initia24 tive area (as determined by the administra25 tion)’’ and inserting ‘‘and by agency’’; 
117 

†S 3600 ES

1 (ii) in subclause (III), by striking 

2 ‘‘and’’ at the end; and 

3 (iii) by adding at the end the fol4 lowing: 

5 ‘‘(V) a validation that the budg6 ets submitted were informed by using 

7 a risk-based methodology; and 

8 ‘‘(VI) a report on the progress of 

9 each agency on closing recommenda10 tions identified under the independent 

11 evaluation required by section 

12 3555(a)(1) of title 44.’’. 

13 (B) EFFECTIVE DATE.—The amendments 

14 made by subparagraph (A) shall take effect on 

15 the date that is 5 years after the date on which 

16 the model developed under paragraph (1) is 

17 completed. 

18 (4) REPORTS.— 

19 (A) INDEPENDENT EVALUATION.—Section 

20 3555(a)(2) of title 44, United States Code, is 

21 amended— 

22 (i) in subparagraph (B), by striking 

23 ‘‘and’’ at the end; 
118 

†S 3600 ES

1 (ii) in subparagraph (C), by striking 

2 the period at the end and inserting ‘‘; 

3 and’’; and 

4 (iii) by adding at the end the fol5 lowing: 

6 ‘‘(D) an assessment of how the agency was 

7 informed by the risk-based budget model re8 quired under section 3553(a)(7) and an evalua9 tion of whether the model mitigates agency 

10 cyber vulnerabilities.’’. 

11 (B) ASSESSMENT.— 

12 (i) AMENDMENT.—Section 3553(c) of 

13 title 44, United States Code, as amended 

14 by section 103 of this title, is further 

15 amended by inserting after paragraph (5) 

16 the following: 

17 ‘‘(6) an assessment of— 

18 ‘‘(A) Federal agency utilization of the 

19 model required under subsection (a)(7); and 

20 ‘‘(B) whether the model mitigates the 

21 cyber vulnerabilities of the Federal Govern22 ment.’’. 

23 (ii) EFFECTIVE DATE.—The amend24 ment made by clause (i) shall take effect 

25 on the date that is 5 years after the date 
119 

†S 3600 ES

1 on which the model developed under para2 graph (1) is completed. 

3 (5) GAO REPORT.—Not later than 3 years 

4 after the date on which the first budget of the Presi5 dent is submitted to Congress containing the valida6 tion required under section 1105(a)(35)(A)(i)(V) of 

7 title 31, United States Code, as amended by para8 graph (3), the Comptroller General of the United 

9 States shall submit to the appropriate congressional 

10 committees a report that includes— 

11 (A) an evaluation of the success of covered 

12 agencies in utilizing the risk-based budget 

13 model; 

14 (B) an evaluation of the success of covered 

15 agencies in implementing risk-based budgets; 

16 (C) an evaluation of whether the risk-based 

17 budgets developed by covered agencies are effec18 tive at informing Federal Government-wide cy19 bersecurity programs; and 

20 (D) any other information relating to risk21 based budgets the Comptroller General deter22 mines appropriate. 

23 SEC. 120. ACTIVE CYBER DEFENSIVE STUDY. 

24 (a) DEFINITION.—In this section, the term ‘‘active 

25 defense technique’’— 
120 

†S 3600 ES

1 (1) means an action taken on the systems of an 

2 entity to increase the security of information on the 

3 network of an agency by misleading an adversary; 

4 and 

5 (2) includes a honeypot, deception, or purpose6 fully feeding false or misleading data to an adver7 sary when the adversary is on the systems of the en8 tity. 

9 (b) STUDY.—Not later than 180 days after the date 

10 of enactment of this Act, the Director of the Cybersecurity 

11 and Infrastructure Security Agency, in coordination with 

12 the Director and the National Cyber Director, shall per13 form a study on the use of active defense techniques to 

14 enhance the security of agencies, which shall include— 

15 (1) a review of legal restrictions on the use of 

16 different active cyber defense techniques in Federal 

17 environments, in consultation with the Department 

18 of Justice; 

19 (2) an evaluation of— 

20 (A) the efficacy of a selection of active de21 fense techniques determined by the Director of 

22 the Cybersecurity and Infrastructure Security 

23 Agency; and 
121 

†S 3600 ES

1 (B) factors that impact the efficacy of the 

2 active defense techniques evaluated under sub3 paragraph (A); 

4 (3) recommendations on safeguards and proce5 dures that shall be established to require that active 

6 defense techniques are adequately coordinated to en7 sure that active defense techniques do not impede 

8 agency operations and mission delivery, threat re9 sponse efforts, criminal investigations, and national 

10 security activities, including intelligence collection; 

11 and 

12 (4) the development of a framework for the use 

13 of different active defense techniques by agencies. 

14 SEC. 121. SECURITY OPERATIONS CENTER AS A SERVICE 

15 PILOT. 

16 (a) PURPOSE.—The purpose of this section is for the 

17 Cybersecurity and Infrastructure Security Agency to run 

18 a security operation center on behalf of another agency, 

19 alleviating the need to duplicate this function at every 

20 agency, and empowering a greater centralized cybersecu21 rity capability. 

22 (b) PLAN.—Not later than 1 year after the date of 

23 enactment of this Act, the Director of the Cybersecurity 

24 and Infrastructure Security Agency shall develop a plan 

25 to establish a centralized Federal security operations cen-
122 

†S 3600 ES

1 ter shared service offering within the Cybersecurity and 

2 Infrastructure Security Agency. 

3 (c) CONTENTS.—The plan required under subsection 

4 (b) shall include considerations for— 

5 (1) collecting, organizing, and analyzing agency 

6 information system data in real time; 

7 (2) staffing and resources; and 

8 (3) appropriate interagency agreements, con9 cepts of operations, and governance plans. 

10 (d) PILOT PROGRAM.— 

11 (1) IN GENERAL.—Not later than 180 days 

12 after the date on which the plan required under sub13 section (b) is developed, the Director of the Cyberse14 curity and Infrastructure Security Agency, in con15 sultation with the Director, shall enter into a 1-year 

16 agreement with not less than 2 agencies to offer a 

17 security operations center as a shared service. 

18 (2) ADDITIONAL AGREEMENTS.—After the date 

19 on which the briefing required under subsection 

20 (e)(1) is provided, the Director of the Cybersecurity 

21 and Infrastructure Security Agency, in consultation 

22 with the Director, may enter into additional 1-year 

23 agreements described in paragraph (1) with agen24 cies. 

25 (e) BRIEFING AND REPORT.— 
123 

†S 3600 ES

1 (1) BRIEFING.—Not later than 270 days after 

2 the date of enactment of this Act, the Director of 

3 the Cybersecurity and Infrastructure Security Agen4 cy shall provide to the Committee on Homeland Se5 curity and Governmental Affairs of the Senate and 

6 the Committee on Homeland Security and the Com7 mittee on Oversight and Reform of the House of 

8 Representatives a briefing on the parameters of any 

9 1-year agreements entered into under subsection 

10 (d)(1). 

11 (2) REPORT.—Not later than 90 days after the 

12 date on which the first 1-year agreement entered 

13 into under subsection (d) expires, the Director of the 

14 Cybersecurity and Infrastructure Security Agency 

15 shall submit to the Committee on Homeland Secu16 rity and Governmental Affairs of the Senate and the 

17 Committee on Homeland Security and the Com18 mittee on Oversight and Reform of the House of 

19 Representatives a report on— 

20 (A) the agreement; and 

21 (B) any additional agreements entered into 

22 with agencies under subsection (d). 

23 SEC. 122. EXTENSION OF CHIEF DATA OFFICER COUNCIL. 

24 Section 3520A(e)(2) of title 44, United States Code, 

25 is amended by striking ‘‘upon the expiration of the 2-year 
124 

†S 3600 ES

1 period that begins on the date the Comptroller General 

2 submits the report under paragraph (1) to Congress’’ and 

3 inserting ‘‘January 31, 2030’’. 

4 SEC. 123. FEDERAL CYBERSECURITY REQUIREMENTS. 

5 (a) EXEMPTION FROM FEDERAL REQUIREMENTS.— 

6 Section 225(b)(2) of the Federal Cybersecurity Enhance7 ment Act of 2015 (6 U.S.C. 1523(b)(2)) is amended to 

8 read as follows: 

9 ‘‘(2) EXCEPTION.— 

10 ‘‘(A) IN GENERAL.—A particular require11 ment under paragraph (1) shall not apply to an 

12 agency information system of an agency if— 

13 ‘‘(i) with respect to the agency infor14 mation system, the head of the agency sub15 mits to the Director an application for an 

16 exemption from the particular requirement, 

17 in which the head of the agency personally 

18 certifies to the Director with particularity 

19 that— 

20 ‘‘(I) operational requirements ar21 ticulated in the certification and re22 lated to the agency information sys23 tem would make it excessively burden24 some to implement the particular re25 quirement; 
125 

†S 3600 ES

1 ‘‘(II) the particular requirement 

2 is not necessary to secure the agency 

3 information system or agency infor4 mation stored on or transiting the 

5 agency information system; and 

6 ‘‘(III) the agency has taken all 

7 necessary steps to secure the agency 

8 information system and agency infor9 mation stored on or transiting the 

10 agency information system; 

11 ‘‘(ii) the head of the agency or the 

12 designee of the head of the agency has 

13 submitted the certification described in 

14 clause (i) to the appropriate congressional 

15 committees and any other congressional 

16 committee with jurisdiction over the agen17 cy; and 

18 ‘‘(iii) the Director grants the exemp19 tion from the particular requirement. 

20 ‘‘(B) DURATION OF EXEMPTION.— 

21 ‘‘(i) IN GENERAL.—An exemption 

22 granted under subparagraph (A) shall ex23 pire on the date that is 1 year after the 

24 date on which the Director granted the ex25 emption. 
126 

†S 3600 ES

1 ‘‘(ii) RENEWAL.—Upon the expiration 

2 of an exemption granted to an agency 

3 under subparagraph (A), the head of the 

4 agency may apply for an additional exemp5 tion.’’. 

6 (b) REPORT ON EXEMPTIONS.—Section 3554(c)(1) 

7 of title 44, United States Code, as amended by section 

8 103(c) of this title, is amended— 

9 (1) in subparagraph (C), by striking ‘‘and’’ at 

10 the end; 

11 (2) in subparagraph (D), by striking the period 

12 at the end and inserting ‘‘; and’’; and 

13 (3) by adding at the end the following: 

14 ‘‘(E) with respect to any exemption the Di15 rector of the Office of Management and Budget 

16 has granted the agency under section 225(b)(2) 

17 of the Federal Cybersecurity Enhancement Act 

18 of 2015 (6 U.S.C. 1523(b)(2)) that is effective 

19 on the date of submission of the report— 

20 ‘‘(i) an identification of each par21 ticular requirement from which any agency 

22 information system (as defined in section 

23 2210 of the Homeland Security Act of 

24 2002 (6 U.S.C. 660)) is exempted; and 
127 

†S 3600 ES

1 ‘‘(ii) for each requirement identified 

2 under clause (i)— 

3 ‘‘(I) an identification of the agen4 cy information system described in 

5 clause (i) exempted from the require6 ment; and 

7 ‘‘(II) an estimate of the date on 

8 which the agency will to be able to 

9 comply with the requirement.’’. 

10 (c) EFFECTIVE DATE.—The amendments made by 

11 this section shall take effect on the date that is 1 year 

12 after the date of enactment of this Act. 

13 TITLE II—CYBER INCIDENT RE14 PORTING FOR CRITICAL IN15 FRASTRUCTURE ACT OF 2022 

16 SEC. 201. SHORT TITLE. 

17 This title may be cited as the ‘‘Cyber Incident Re18 porting for Critical Infrastructure Act of 2022’’. 

19 SEC. 202. DEFINITIONS. 

20 In this title: 

21 (1) COVERED CYBER INCIDENT; COVERED ENTI22 TY; CYBER INCIDENT; INFORMATION SYSTEM; RAN23 SOM PAYMENT; RANSOMWARE ATTACK; SECURITY

24 VULNERABILITY.—The terms ‘‘covered cyber inci25 dent’’, ‘‘covered entity’’, ‘‘cyber incident’’, ‘‘informa-
128 

†S 3600 ES

1 tion system’’, ‘‘ransom payment’’, ‘‘ransomware at2 tack’’, and ‘‘security vulnerability’’ have the mean3 ings given those terms in section 2240 of the Home4 land Security Act of 2002, as added by section 203 

5 of this title. 

6 (2) DIRECTOR.—The term ‘‘Director’’ means 

7 the Director of the Cybersecurity and Infrastructure 

8 Security Agency. 

9 SEC. 203. CYBER INCIDENT REPORTING. 

10 (a) CYBER INCIDENT REPORTING.—Title XXII of 

11 the Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

12 is amended— 

13 (1) in section 2209(c) (6 U.S.C. 659(c))— 

14 (A) in paragraph (11), by striking ‘‘; and’’ 

15 and inserting a semicolon; 

16 (B) in paragraph (12), by striking the pe17 riod at the end and inserting ‘‘; and’’; and 

18 (C) by adding at the end the following: 

19 ‘‘(13) receiving, aggregating, and analyzing re20 ports related to covered cyber incidents (as defined 

21 in section 2240) submitted by covered entities (as 

22 defined in section 2240) and reports related to ran23 som payments (as defined in section 2240) sub24 mitted by covered entities (as defined in section 

25 2240) in furtherance of the activities specified in 
129 

†S 3600 ES

1 sections 2202(e), 2203, and 2241, this subsection, 

2 and any other authorized activity of the Director, to 

3 enhance the situational awareness of cybersecurity 

4 threats across critical infrastructure sectors.’’; and 

5 (2) by adding at the end the following: 

6 ‘‘Subtitle D—Cyber Incident 

7 Reporting 

8 ‘‘SEC. 2240. DEFINITIONS. 

9 ‘‘In this subtitle: 

10 ‘‘(1) CENTER.—The term ‘Center’ means the 

11 center established under section 2209. 

12 ‘‘(2) CLOUD SERVICE PROVIDER.—The term 

13 ‘cloud service provider’ means an entity offering 

14 products or services related to cloud computing, as 

15 defined by the National Institute of Standards and 

16 Technology in NIST Special Publication 800–145 

17 and any amendatory or superseding document relat18 ing thereto. 

19 ‘‘(3) COUNCIL.—The term ‘Council’ means the 

20 Cyber Incident Reporting Council described in sec21 tion 2246. 

22 ‘‘(4) COVERED CYBER INCIDENT.—The term 

23 ‘covered cyber incident’ means a substantial cyber 

24 incident experienced by a covered entity that satis25 fies the definition and criteria established by the Di-
130 

†S 3600 ES

1 rector in the final rule issued pursuant to section 

2 2242(b). 

3 ‘‘(5) COVERED ENTITY.—The term ‘covered en4 tity’ means an entity in a critical infrastructure sec5 tor, as defined in Presidential Policy Directive 21, 

6 that satisfies the definition established by the Direc7 tor in the final rule issued pursuant to section 

8 2242(b). 

9 ‘‘(6) CYBER INCIDENT.—The term ‘cyber inci10 dent’— 

11 ‘‘(A) has the meaning given the term ‘inci12 dent’ in section 2209; and 

13 ‘‘(B) does not include an occurrence that 

14 imminently, but not actually, jeopardizes— 

15 ‘‘(i) information on information sys16 tems; or 

17 ‘‘(ii) information systems. 

18 ‘‘(7) CYBER THREAT.—The term ‘cyber threat’ 

19 has the meaning given the term ‘cybersecurity 

20 threat’ in section 2201. 

21 ‘‘(8) CYBER THREAT INDICATOR; CYBERSECU22 RITY PURPOSE; DEFENSIVE MEASURE; FEDERAL EN23 TITY; SECURITY VULNERABILITY.—The terms ‘cyber 

24 threat indicator’, ‘cybersecurity purpose’, ‘defensive 

25 measure’, ‘Federal entity’, and ‘security vulner-
131 

†S 3600 ES

1 ability’ have the meanings given those terms in sec2 tion 102 of the Cybersecurity Act of 2015 (6 U.S.C. 

3 1501). 

4 ‘‘(9) INCIDENT; SHARING.—The terms ‘inci5 dent’ and ‘sharing’ have the meanings given those 

6 terms in section 2209. 

7 ‘‘(10) INFORMATION SHARING AND ANALYSIS

8 ORGANIZATION.—The term ‘Information Sharing 

9 and Analysis Organization’ has the meaning given 

10 the term in section 2222. 

11 ‘‘(11) INFORMATION SYSTEM.—The term ‘infor12 mation system’— 

13 ‘‘(A) has the meaning given the term in 

14 section 3502 of title 44, United States Code; 

15 and 

16 ‘‘(B) includes industrial control systems, 

17 such as supervisory control and data acquisition 

18 systems, distributed control systems, and pro19 grammable logic controllers. 

20 ‘‘(12) MANAGED SERVICE PROVIDER.—The 

21 term ‘managed service provider’ means an entity 

22 that delivers services, such as network, application, 

23 infrastructure, or security services, via ongoing and 

24 regular support and active administration on the 

25 premises of a customer, in the data center of the en-
132 

†S 3600 ES

1 tity (such as hosting), or in a third party data cen2 ter. 

3 ‘‘(13) RANSOM PAYMENT.—The term ‘ransom 

4 payment’ means the transmission of any money or 

5 other property or asset, including virtual currency, 

6 or any portion thereof, which has at any time been 

7 delivered as ransom in connection with a 

8 ransomware attack. 

9 ‘‘(14) RANSOMWARE ATTACK.—The term 

10 ‘ransomware attack’— 

11 ‘‘(A) means an incident that includes the 

12 use or threat of use of unauthorized or mali13 cious code on an information system, or the use 

14 or threat of use of another digital mechanism 

15 such as a denial of service attack, to interrupt 

16 or disrupt the operations of an information sys17 tem or compromise the confidentiality, avail18 ability, or integrity of electronic data stored on, 

19 processed by, or transiting an information sys20 tem to extort a demand for a ransom payment; 

21 and 

22 ‘‘(B) does not include any such event 

23 where the demand for payment is— 

24 ‘‘(i) not genuine; or 
133 

†S 3600 ES

1 ‘‘(ii) made in good faith by an entity 

2 in response to a specific request by the 

3 owner or operator of the information sys4 tem. 

5 ‘‘(15) SECTOR RISK MANAGEMENT AGENCY.— 

6 The term ‘Sector Risk Management Agency’ has the 

7 meaning given the term in section 2201. 

8 ‘‘(16) SIGNIFICANT CYBER INCIDENT.—The 

9 term ‘significant cyber incident’ means a cyber inci10 dent, or a group of related cyber incidents, that the 

11 Secretary determines is likely to result in demon12 strable harm to the national security interests, for13 eign relations, or economy of the United States or 

14 to the public confidence, civil liberties, or public 

15 health and safety of the people of the United States. 

16 ‘‘(17) SUPPLY CHAIN COMPROMISE.—The term 

17 ‘supply chain compromise’ means an incident within 

18 the supply chain of an information system that an 

19 adversary can leverage or does leverage to jeopardize 

20 the confidentiality, integrity, or availability of the in21 formation system or the information the system 

22 processes, stores, or transmits, and can occur at any 

23 point during the life cycle. 

24 ‘‘(18) VIRTUAL CURRENCY.—The term ‘virtual 

25 currency’ means the digital representation of value 
134 

†S 3600 ES

1 that functions as a medium of exchange, a unit of 

2 account, or a store of value. 

3 ‘‘(19) VIRTUAL CURRENCY ADDRESS.—The 

4 term ‘virtual currency address’ means a unique pub5 lic cryptographic key identifying the location to 

6 which a virtual currency payment can be made. 

7 ‘‘SEC. 2241. CYBER INCIDENT REVIEW. 

8 ‘‘(a) ACTIVITIES.—The Center shall— 

9 ‘‘(1) receive, aggregate, analyze, and secure, 

10 using processes consistent with the processes devel11 oped pursuant to the Cybersecurity Information 

12 Sharing Act of 2015 (6 U.S.C. 1501 et seq.) reports 

13 from covered entities related to a covered cyber inci14 dent to assess the effectiveness of security controls, 

15 identify tactics, techniques, and procedures adver16 saries use to overcome those controls and other cy17 bersecurity purposes, including to assess potential 

18 impact of cyber incidents on public health and safety 

19 and to enhance situational awareness of cyber 

20 threats across critical infrastructure sectors; 

21 ‘‘(2) coordinate and share information with ap22 propriate Federal departments and agencies to iden23 tify and track ransom payments, including those uti24 lizing virtual currencies; 
135 

†S 3600 ES

1 ‘‘(3) leverage information gathered about cyber 

2 incidents to— 

3 ‘‘(A) enhance the quality and effectiveness 

4 of information sharing and coordination efforts 

5 with appropriate entities, including agencies, 

6 sector coordinating councils, Information Shar7 ing and Analysis Organizations, State, local, 

8 Tribal, and territorial governments, technology 

9 providers, critical infrastructure owners and op10 erators, cybersecurity and cyber incident re11 sponse firms, and security researchers; and 

12 ‘‘(B) provide appropriate entities, including 

13 sector coordinating councils, Information Shar14 ing and Analysis Organizations, State, local, 

15 Tribal, and territorial governments, technology 

16 providers, cybersecurity and cyber incident re17 sponse firms, and security researchers, with 

18 timely, actionable, and anonymized reports of 

19 cyber incident campaigns and trends, including, 

20 to the maximum extent practicable, related con21 textual information, cyber threat indicators, and 

22 defensive measures, pursuant to section 2245; 

23 ‘‘(4) establish mechanisms to receive feedback 

24 from stakeholders on how the Agency can most ef25 fectively receive covered cyber incident reports, ran-
136 

†S 3600 ES

1 som payment reports, and other voluntarily provided 

2 information, and how the Agency can most effec3 tively support private sector cybersecurity; 

4 ‘‘(5) facilitate the timely sharing, on a vol5 untary basis, between relevant critical infrastructure 

6 owners and operators of information relating to cov7 ered cyber incidents and ransom payments, particu8 larly with respect to ongoing cyber threats or secu9 rity vulnerabilities and identify and disseminate 

10 ways to prevent or mitigate similar cyber incidents 

11 in the future; 

12 ‘‘(6) for a covered cyber incident, including a 

13 ransomware attack, that also satisfies the definition 

14 of a significant cyber incident, or is part of a group 

15 of related cyber incidents that together satisfy such 

16 definition, conduct a review of the details sur17 rounding the covered cyber incident or group of 

18 those incidents and identify and disseminate ways to 

19 prevent or mitigate similar incidents in the future; 

20 ‘‘(7) with respect to covered cyber incident re21 ports under section 2242(a) and 2243 involving an 

22 ongoing cyber threat or security vulnerability, imme23 diately review those reports for cyber threat indica24 tors that can be anonymized and disseminated, with 

25 defensive measures, to appropriate stakeholders, in 
137 

†S 3600 ES

1 coordination with other divisions within the Agency, 

2 as appropriate; 

3 ‘‘(8) publish quarterly unclassified, public re4 ports that describe aggregated, anonymized observa5 tions, findings, and recommendations based on cov6 ered cyber incident reports, which may be based on 

7 the unclassified information contained in the brief8 ings required under subsection (c); 

9 ‘‘(9) proactively identify opportunities, con10 sistent with the protections in section 2245, to lever11 age and utilize data on cyber incidents in a manner 

12 that enables and strengthens cybersecurity research 

13 carried out by academic institutions and other pri14 vate sector organizations, to the greatest extent 

15 practicable; and 

16 ‘‘(10) in accordance with section 2245 and sub17 section (b) of this section, as soon as possible but 

18 not later than 24 hours after receiving a covered 

19 cyber incident report, ransom payment report, volun20 tarily submitted information pursuant to section 

21 2243, or information received pursuant to a request 

22 for information or subpoena under section 2244, 

23 make available the information to appropriate Sector 

24 Risk Management Agencies and other appropriate 

25 Federal agencies. 
138 

†S 3600 ES

1 ‘‘(b) INTERAGENCY SHARING.—The President or a 

2 designee of the President— 

3 ‘‘(1) may establish a specific time requirement 

4 for sharing information under subsection (a)(11); 

5 and 

6 ‘‘(2) shall determine the appropriate Federal 

7 agencies under subsection (a)(11). 

8 ‘‘(c) PERIODIC BRIEFING.—Not later than 60 days 

9 after the effective date of the final rule required under 

10 section 2242(b), and on the first day of each month there11 after, the Director, in consultation with the National 

12 Cyber Director, the Attorney General, and the Director 

13 of National Intelligence, shall provide to the majority lead14 er of the Senate, the minority leader of the Senate, the 

15 Speaker of the House of Representatives, the minority 

16 leader of the House of Representatives, the Committee on 

17 Homeland Security and Governmental Affairs of the Sen18 ate, and the Committee on Homeland Security of the 

19 House of Representatives a briefing that characterizes the 

20 national cyber threat landscape, including the threat fac21 ing Federal agencies and covered entities, and applicable 

22 intelligence and law enforcement information, covered 

23 cyber incidents, and ransomware attacks, as of the date 

24 of the briefing, which shall— 
139 

†S 3600 ES

1 ‘‘(1) include the total number of reports sub2 mitted under sections 2242 and 2243 during the 

3 preceding month, including a breakdown of required 

4 and voluntary reports; 

5 ‘‘(2) include any identified trends in covered 

6 cyber incidents and ransomware attacks over the 

7 course of the preceding month and as compared to 

8 previous reports, including any trends related to the 

9 information collected in the reports submitted under 

10 sections 2242 and 2243, including— 

11 ‘‘(A) the infrastructure, tactics, and tech12 niques malicious cyber actors commonly use; 

13 and 

14 ‘‘(B) intelligence gaps that have impeded, 

15 or currently are impeding, the ability to counter 

16 covered cyber incidents and ransomware 

17 threats; 

18 ‘‘(3) include a summary of the known uses of 

19 the information in reports submitted under sections 

20 2242 and 2243; and 

21 ‘‘(4) include an unclassified portion, but may 

22 include a classified component. 

23 ‘‘SEC. 2242. REQUIRED REPORTING OF CERTAIN CYBER IN24 CIDENTS. 

25 ‘‘(a) IN GENERAL.— 
140 

†S 3600 ES

1 ‘‘(1) COVERED CYBER INCIDENT REPORTS.— 

2 ‘‘(A) IN GENERAL.—A covered entity that 

3 experiences a covered cyber incident shall report 

4 the covered cyber incident to the Agency not 

5 later than 72 hours after the covered entity rea6 sonably believes that the covered cyber incident 

7 has occurred. 

8 ‘‘(B) LIMITATION.—The Director may not 

9 require reporting under subparagraph (A) any 

10 earlier than 72 hours after the covered entity 

11 reasonably believes that a covered cyber inci12 dent has occurred. 

13 ‘‘(2) RANSOM PAYMENT REPORTS.— 

14 ‘‘(A) IN GENERAL.—A covered entity that 

15 makes a ransom payment as the result of a 

16 ransomware attack against the covered entity 

17 shall report the payment to the Agency not 

18 later than 24 hours after the ransom payment 

19 has been made. 

20 ‘‘(B) APPLICATION.—The requirements 

21 under subparagraph (A) shall apply even if the 

22 ransomware attack is not a covered cyber inci23 dent subject to the reporting requirements 

24 under paragraph (1). 
141 

†S 3600 ES

1 ‘‘(3) SUPPLEMENTAL REPORTS.—A covered en2 tity shall promptly submit to the Agency an update 

3 or supplement to a previously submitted covered 

4 cyber incident report if substantial new or different 

5 information becomes available or if the covered enti6 ty makes a ransom payment after submitting a cov7 ered cyber incident report required under paragraph 

8 (1), until such date that such covered entity notifies 

9 the Agency that the covered cyber incident at issue 

10 has concluded and has been fully mitigated and re11 solved. 

12 ‘‘(4) PRESERVATION OF INFORMATION.—Any 

13 covered entity subject to requirements of paragraph 

14 (1), (2), or (3) shall preserve data relevant to the 

15 covered cyber incident or ransom payment in accord16 ance with procedures established in the final rule 

17 issued pursuant to subsection (b). 

18 ‘‘(5) EXCEPTIONS.— 

19 ‘‘(A) REPORTING OF COVERED CYBER IN20 CIDENT WITH RANSOM PAYMENT.—If a covered 

21 entity is the victim of a covered cyber incident 

22 and makes a ransom payment prior to the 72 

23 hour requirement under paragraph (1), such 

24 that the reporting requirements under para25 graphs (1) and (2) both apply, the covered enti-
142 

†S 3600 ES

1 ty may submit a single report to satisfy the re2 quirements of both paragraphs in accordance 

3 with procedures established in the final rule 

4 issued pursuant to subsection (b). 

5 ‘‘(B) SUBSTANTIALLY SIMILAR REPORTED

6 INFORMATION.— 

7 ‘‘(i) IN GENERAL.—Subject to the 

8 limitation described in clause (ii), where 

9 the Agency has an agreement in place that 

10 satisfies the requirements of section 4(a) of 

11 the Cyber Incident Reporting for Critical 

12 Infrastructure Act of 2022, the require13 ments under paragraphs (1), (2), and (3) 

14 shall not apply to a covered entity required 

15 by law, regulation, or contract to report 

16 substantially similar information to an17 other Federal agency within a substantially 

18 similar timeframe. 

19 ‘‘(ii) LIMITATION.—The exemption in 

20 clause (i) shall take effect with respect to 

21 a covered entity once an agency agreement 

22 and sharing mechanism is in place between 

23 the Agency and the respective Federal 

24 agency, pursuant to section 4(a) of the 
143 

†S 3600 ES

1 Cyber Incident Reporting for Critical In2 frastructure Act of 2022. 

3 ‘‘(iii) RULES OF CONSTRUCTION.— 

4 Nothing in this paragraph shall be con5 strued to— 

6 ‘‘(I) exempt a covered entity 

7 from the reporting requirements 

8 under paragraph (3) unless the sup9 plemental report also meets the re10 quirements of clauses (i) and (ii) of 

11 this paragraph; 

12 ‘‘(II) prevent the Agency from 

13 contacting an entity submitting infor14 mation to another Federal agency 

15 that is provided to the Agency pursu16 ant to section 4 of the Cyber Incident 

17 Reporting for Critical Infrastructure 

18 Act of 2022; or 

19 ‘‘(III) prevent an entity from 

20 communicating with the Agency. 

21 ‘‘(C) DOMAIN NAME SYSTEM.—The re22 quirements under paragraphs (1), (2) and (3) 

23 shall not apply to a covered entity or the func24 tions of a covered entity that the Director de25 termines constitute critical infrastructure 
144 

†S 3600 ES

1 owned, operated, or governed by multi-stake2 holder organizations that develop, implement, 

3 and enforce policies concerning the Domain 

4 Name System, such as the Internet Corporation 

5 for Assigned Names and Numbers or the Inter6 net Assigned Numbers Authority. 

7 ‘‘(6) MANNER, TIMING, AND FORM OF RE8 PORTS.—Reports made under paragraphs (1), (2), 

9 and (3) shall be made in the manner and form, and 

10 within the time period in the case of reports made 

11 under paragraph (3), prescribed in the final rule 

12 issued pursuant to subsection (b). 

13 ‘‘(7) EFFECTIVE DATE.—Paragraphs (1) 

14 through (4) shall take effect on the dates prescribed 

15 in the final rule issued pursuant to subsection (b). 

16 ‘‘(b) RULEMAKING.— 

17 ‘‘(1) NOTICE OF PROPOSED RULEMAKING.—Not 

18 later than 24 months after the date of enactment of 

19 this section, the Director, in consultation with Sector 

20 Risk Management Agencies, the Department of Jus21 tice, and other Federal agencies, shall publish in the 

22 Federal Register a notice of proposed rulemaking to 

23 implement subsection (a). 

24 ‘‘(2) FINAL RULE.—Not later than 18 months 

25 after publication of the notice of proposed rule-
145 

†S 3600 ES

1 making under paragraph (1), the Director shall 

2 issue a final rule to implement subsection (a). 

3 ‘‘(3) SUBSEQUENT RULEMAKINGS.— 

4 ‘‘(A) IN GENERAL.—The Director is au5 thorized to issue regulations to amend or revise 

6 the final rule issued pursuant to paragraph (2). 

7 ‘‘(B) PROCEDURES.—Any subsequent rules 

8 issued under subparagraph (A) shall comply 

9 with the requirements under chapter 5 of title 

10 5, United States Code, including the issuance of 

11 a notice of proposed rulemaking under section 

12 553 of such title. 

13 ‘‘(c) ELEMENTS.—The final rule issued pursuant to 

14 subsection (b) shall be composed of the following elements: 

15 ‘‘(1) A clear description of the types of entities 

16 that constitute covered entities, based on— 

17 ‘‘(A) the consequences that disruption to 

18 or compromise of such an entity could cause to 

19 national security, economic security, or public 

20 health and safety; 

21 ‘‘(B) the likelihood that such an entity 

22 may be targeted by a malicious cyber actor, in23 cluding a foreign country; and 

24 ‘‘(C) the extent to which damage, disrup25 tion, or unauthorized access to such an entity, 
146 

†S 3600 ES

1 including the accessing of sensitive cybersecu2 rity vulnerability information or penetration 

3 testing tools or techniques, will likely enable the 

4 disruption of the reliable operation of critical 

5 infrastructure. 

6 ‘‘(2) A clear description of the types of substan7 tial cyber incidents that constitute covered cyber in8 cidents, which shall— 

9 ‘‘(A) at a minimum, require the occurrence 

10 of— 

11 ‘‘(i) a cyber incident that leads to sub12 stantial loss of confidentiality, integrity, or 

13 availability of such information system or 

14 network, or a serious impact on the safety 

15 and resiliency of operational systems and 

16 processes; 

17 ‘‘(ii) a disruption of business or indus18 trial operations, including due to a denial 

19 of service attack, ransomware attack, or 

20 exploitation of a zero day vulnerability, 

21 against 

22 ‘‘(I) an information system or 

23 network; or 

24 ‘‘(II) an operational technology 

25 system or process; or 
147 

†S 3600 ES

1 ‘‘(iii) unauthorized access or disrup2 tion of business or industrial operations 

3 due to loss of service facilitated through, 

4 or caused by, a compromise of a cloud 

5 service provider, managed service provider, 

6 or other third-party data hosting provider 

7 or by a supply chain compromise; 

8 ‘‘(B) consider— 

9 ‘‘(i) the sophistication or novelty of 

10 the tactics used to perpetrate such a cyber 

11 incident, as well as the type, volume, and 

12 sensitivity of the data at issue; 

13 ‘‘(ii) the number of individuals di14 rectly or indirectly affected or potentially 

15 affected by such a cyber incident; and 

16 ‘‘(iii) potential impacts on industrial 

17 control systems, such as supervisory con18 trol and data acquisition systems, distrib19 uted control systems, and programmable 

20 logic controllers; and 

21 ‘‘(C) exclude— 

22 ‘‘(i) any event where the cyber inci23 dent is perpetrated in good faith by an en24 tity in response to a specific request by the 
148 

†S 3600 ES

1 owner or operator of the information sys2 tem; and 

3 ‘‘(ii) the threat of disruption as extor4 tion, as described in section 2240(14)(A). 

5 ‘‘(3) A requirement that, if a covered cyber inci6 dent or a ransom payment occurs following an ex7 empted threat described in paragraph (2)(C)(ii), the 

8 covered entity shall comply with the requirements in 

9 this subtitle in reporting the covered cyber incident 

10 or ransom payment. 

11 ‘‘(4) A clear description of the specific required 

12 contents of a report pursuant to subsection (a)(1), 

13 which shall include the following information, to the 

14 extent applicable and available, with respect to a 

15 covered cyber incident: 

16 ‘‘(A) A description of the covered cyber in17 cident, including— 

18 ‘‘(i) identification and a description of 

19 the function of the affected information 

20 systems, networks, or devices that were, or 

21 are reasonably believed to have been, af22 fected by such cyber incident; 

23 ‘‘(ii) a description of the unauthorized 

24 access with substantial loss of confiden25 tiality, integrity, or availability of the af-
149 

†S 3600 ES

1 fected information system or network or 

2 disruption of business or industrial oper3 ations; 

4 ‘‘(iii) the estimated date range of such 

5 incident; and 

6 ‘‘(iv) the impact to the operations of 

7 the covered entity. 

8 ‘‘(B) Where applicable, a description of the 

9 vulnerabilities exploited and the security de10 fenses that were in place, as well as the tactics, 

11 techniques, and procedures used to perpetrate 

12 the covered cyber incident. 

13 ‘‘(C) Where applicable, any identifying or 

14 contact information related to each actor rea15 sonably believed to be responsible for such cyber 

16 incident. 

17 ‘‘(D) Where applicable, identification of 

18 the category or categories of information that 

19 were, or are reasonably believed to have been, 

20 accessed or acquired by an unauthorized per21 son. 

22 ‘‘(E) The name and other information that 

23 clearly identifies the covered entity impacted by 

24 the covered cyber incident, including, as appli25 cable, the State of incorporation or formation of 
150 

†S 3600 ES

1 the covered entity, trade names, legal names, or 

2 other identifiers. 

3 ‘‘(F) Contact information, such as tele4 phone number or electronic mail address, that 

5 the Agency may use to contact the covered enti6 ty or an authorized agent of such covered enti7 ty, or, where applicable, the service provider of 

8 such covered entity acting with the express per9 mission of, and at the direction of, the covered 

10 entity to assist with compliance with the re11 quirements of this subtitle. 

12 ‘‘(5) A clear description of the specific required 

13 contents of a report pursuant to subsection (a)(2), 

14 which shall be the following information, to the ex15 tent applicable and available, with respect to a ran16 som payment: 

17 ‘‘(A) A description of the ransomware at18 tack, including the estimated date range of the 

19 attack. 

20 ‘‘(B) Where applicable, a description of the 

21 vulnerabilities, tactics, techniques, and proce22 dures used to perpetrate the ransomware at23 tack. 

24 ‘‘(C) Where applicable, any identifying or 

25 contact information related to the actor or ac-
151 

†S 3600 ES

1 tors reasonably believed to be responsible for 

2 the ransomware attack. 

3 ‘‘(D) The name and other information that 

4 clearly identifies the covered entity that made 

5 the ransom payment or on whose behalf the 

6 payment was made. 

7 ‘‘(E) Contact information, such as tele8 phone number or electronic mail address, that 

9 the Agency may use to contact the covered enti10 ty that made the ransom payment or an author11 ized agent of such covered entity, or, where ap12 plicable, the service provider of such covered en13 tity acting with the express permission of, and 

14 at the direction of, that covered entity to assist 

15 with compliance with the requirements of this 

16 subtitle. 

17 ‘‘(F) The date of the ransom payment. 

18 ‘‘(G) The ransom payment demand, includ19 ing the type of virtual currency or other com20 modity requested, if applicable. 

21 ‘‘(H) The ransom payment instructions, 

22 including information regarding where to send 

23 the payment, such as the virtual currency ad24 dress or physical address the funds were re25 quested to be sent to, if applicable. 
152 

†S 3600 ES

1 ‘‘(I) The amount of the ransom payment. 

2 ‘‘(6) A clear description of the types of data re3 quired to be preserved pursuant to subsection (a)(4), 

4 the period of time for which the data is required to 

5 be preserved, and allowable uses, processes, and pro6 cedures. 

7 ‘‘(7) Deadlines and criteria for submitting sup8 plemental reports to the Agency required under sub9 section (a)(3), which shall— 

10 ‘‘(A) be established by the Director in con11 sultation with the Council; 

12 ‘‘(B) consider any existing regulatory re13 porting requirements similar in scope, purpose, 

14 and timing to the reporting requirements to 

15 which such a covered entity may also be sub16 ject, and make efforts to harmonize the timing 

17 and contents of any such reports to the max18 imum extent practicable; 

19 ‘‘(C) balance the need for situational 

20 awareness with the ability of the covered entity 

21 to conduct cyber incident response and inves22 tigations; and 

23 ‘‘(D) provide a clear description of what 

24 constitutes substantial new or different infor25 mation. 
153 

†S 3600 ES

1 ‘‘(8) Procedures for— 

2 ‘‘(A) entities, including third parties pur3 suant to subsection (d)(1), to submit reports re4 quired by paragraphs (1), (2), and (3) of sub5 section (a), including the manner and form 

6 thereof, which shall include, at a minimum, a 

7 concise, user-friendly web-based form; 

8 ‘‘(B) the Agency to carry out— 

9 ‘‘(i) the enforcement provisions of sec10 tion 2244, including with respect to the 

11 issuance, service, withdrawal, referral proc12 ess, and enforcement of subpoenas, appeals 

13 and due process procedures; 

14 ‘‘(ii) other available enforcement 

15 mechanisms including acquisition, suspen16 sion and debarment procedures; and 

17 ‘‘(iii) other aspects of noncompliance; 

18 ‘‘(C) implementing the exceptions provided 

19 in subsection (a)(5); and 

20 ‘‘(D) protecting privacy and civil liberties 

21 consistent with processes adopted pursuant to 

22 section 105(b) of the Cybersecurity Act of 2015 

23 (6 U.S.C. 1504(b)) and anonymizing and safe24 guarding, or no longer retaining, information 

25 received and disclosed through covered cyber in-
154 

†S 3600 ES

1 cident reports and ransom payment reports that 

2 is known to be personal information of a spe3 cific individual or information that identifies a 

4 specific individual that is not directly related to 

5 a cybersecurity threat. 

6 ‘‘(9) Other procedural measures directly nec7 essary to implement subsection (a). 

8 ‘‘(d) THIRD PARTY REPORT SUBMISSION AND RAN9 SOM PAYMENT.— 

10 ‘‘(1) REPORT SUBMISSION.—A covered entity 

11 that is required to submit a covered cyber incident 

12 report or a ransom payment report may use a third 

13 party, such as an incident response company, insur14 ance provider, service provider, Information Sharing 

15 and Analysis Organization, or law firm, to submit 

16 the required report under subsection (a). 

17 ‘‘(2) RANSOM PAYMENT.—If a covered entity 

18 impacted by a ransomware attack uses a third party 

19 to make a ransom payment, the third party shall not 

20 be required to submit a ransom payment report for 

21 itself under subsection (a)(2). 

22 ‘‘(3) DUTY TO REPORT.—Third-party reporting 

23 under this subparagraph does not relieve a covered 

24 entity from the duty to comply with the require-
155 

†S 3600 ES

1 ments for covered cyber incident report or ransom 

2 payment report submission. 

3 ‘‘(4) RESPONSIBILITY TO ADVISE.—Any third 

4 party used by a covered entity that knowingly makes 

5 a ransom payment on behalf of a covered entity im6 pacted by a ransomware attack shall advise the im7 pacted covered entity of the responsibilities of the 

8 impacted covered entity regarding reporting ransom 

9 payments under this section. 

10 ‘‘(e) OUTREACH TO COVERED ENTITIES.— 

11 ‘‘(1) IN GENERAL.—The Agency shall conduct 

12 an outreach and education campaign to inform likely 

13 covered entities, entities that offer or advertise as a 

14 service to customers to make or facilitate ransom 

15 payments on behalf of covered entities impacted by 

16 ransomware attacks and other appropriate entities 

17 of the requirements of paragraphs (1), (2), and (3) 

18 of subsection (a). 

19 ‘‘(2) ELEMENTS.—The outreach and education 

20 campaign under paragraph (1) shall include the fol21 lowing: 

22 ‘‘(A) An overview of the final rule issued 

23 pursuant to subsection (b). 

24 ‘‘(B) An overview of mechanisms to submit 

25 to the Agency covered cyber incident reports, 
156 

†S 3600 ES

1 ransom payment reports, and information relat2 ing to the disclosure, retention, and use of cov3 ered cyber incident reports and ransom pay4 ment reports under this section. 

5 ‘‘(C) An overview of the protections af6 forded to covered entities for complying with 

7 the requirements under paragraphs (1), (2), 

8 and (3) of subsection (a). 

9 ‘‘(D) An overview of the steps taken under 

10 section 2244 when a covered entity is not in 

11 compliance with the reporting requirements 

12 under subsection (a). 

13 ‘‘(E) Specific outreach to cybersecurity 

14 vendors, cyber incident response providers, cy15 bersecurity insurance entities, and other entities 

16 that may support covered entities. 

17 ‘‘(F) An overview of the privacy and civil 

18 liberties requirements in this subtitle. 

19 ‘‘(3) COORDINATION.—In conducting the out20 reach and education campaign required under para21 graph (1), the Agency may coordinate with— 

22 ‘‘(A) the Critical Infrastructure Partner23 ship Advisory Council established under section 

24 871; 
157 

†S 3600 ES

1 ‘‘(B) Information Sharing and Analysis 

2 Organizations; 

3 ‘‘(C) trade associations; 

4 ‘‘(D) information sharing and analysis cen5 ters; 

6 ‘‘(E) sector coordinating councils; and 

7 ‘‘(F) any other entity as determined appro8 priate by the Director. 

9 ‘‘(f) EXEMPTION.—Sections 3506(c), 3507, 3508, 

10 and 3509 of title 44, United States Code, shall not apply 

11 to any action to carry out this section. 

12 ‘‘(g) RULE OF CONSTRUCTION.—Nothing in this sec13 tion shall affect the authorities of the Federal Government 

14 to implement the requirements of Executive Order 14028 

15 (86 Fed. Reg. 26633; relating to improving the nation’s 

16 cybersecurity), including changes to the Federal Acquisi17 tion Regulations and remedies to include suspension and 

18 debarment. 

19 ‘‘(h) SAVINGS PROVISION.—Nothing in this section 

20 shall be construed to supersede or to abrogate, modify, 

21 or otherwise limit the authority that is vested in any offi22 cer or any agency of the United States Government to reg23 ulate or take action with respect to the cybersecurity of 

24 an entity. 
158 

†S 3600 ES

1 ‘‘SEC. 2243. VOLUNTARY REPORTING OF OTHER CYBER IN2 CIDENTS. 

3 ‘‘(a) IN GENERAL.—Entities may voluntarily report 

4 cyber incidents or ransom payments to the Agency that 

5 are not required under paragraph (1), (2), or (3) of sec6 tion 2242(a), but may enhance the situational awareness 

7 of cyber threats. 

8 ‘‘(b) VOLUNTARY PROVISION OF ADDITIONAL INFOR9 MATION IN REQUIRED REPORTS.—Covered entities may 

10 voluntarily include in reports required under paragraph 

11 (1), (2), or (3) of section 2242(a) information that is not 

12 required to be included, but may enhance the situational 

13 awareness of cyber threats. 

14 ‘‘(c) APPLICATION OF PROTECTIONS.—The protec15 tions under section 2245 applicable to reports made under 

16 section 2242 shall apply in the same manner and to the 

17 same extent to reports and information submitted under 

18 subsections (a) and (b). 

19 ‘‘SEC. 2244. NONCOMPLIANCE WITH REQUIRED REPORTING. 

20 ‘‘(a) PURPOSE.—In the event that a covered entity 

21 that is required to submit a report under section 2242(a) 

22 fails to comply with the requirement to report, the Direc23 tor may obtain information about the cyber incident or 

24 ransom payment by engaging the covered entity directly 

25 to request information about the cyber incident or ransom 

26 payment, and if the Director is unable to obtain informa-
159 

†S 3600 ES

1 tion through such engagement, by issuing a subpoena to 

2 the covered entity, pursuant to subsection (c), to gather 

3 information sufficient to determine whether a covered 

4 cyber incident or ransom payment has occurred. 

5 ‘‘(b) INITIAL REQUEST FOR INFORMATION.— 

6 ‘‘(1) IN GENERAL.—If the Director has reason 

7 to believe, whether through public reporting or other 

8 information in the possession of the Federal Govern9 ment, including through analysis performed pursu10 ant to paragraph (1) or (2) of section 2241(a), that 

11 a covered entity has experienced a covered cyber in12 cident or made a ransom payment but failed to re13 port such cyber incident or payment to the Agency 

14 in accordance with section 2242(a), the Director 

15 may request additional information from the covered 

16 entity to confirm whether or not a covered cyber in17 cident or ransom payment has occurred. 

18 ‘‘(2) TREATMENT.—Information provided to the 

19 Agency in response to a request under paragraph 

20 (1) shall be treated as if it was submitted through 

21 the reporting procedures established in section 2242. 

22 ‘‘(c) ENFORCEMENT.— 

23 ‘‘(1) IN GENERAL.—If, after the date that is 72 

24 hours from the date on which the Director made the 

25 request for information in subsection (b), the Direc-
160 

†S 3600 ES

1 tor has received no response from the covered entity 

2 from which such information was requested, or re3 ceived an inadequate response, the Director may 

4 issue to such covered entity a subpoena to compel 

5 disclosure of information the Director deems nec6 essary to determine whether a covered cyber incident 

7 or ransom payment has occurred and obtain the in8 formation required to be reported pursuant to sec9 tion 2242 and any implementing regulations, and as10 sess potential impacts to national security, economic 

11 security, or public health and safety. 

12 ‘‘(2) CIVIL ACTION.— 

13 ‘‘(A) IN GENERAL.—If a covered entity 

14 fails to comply with a subpoena, the Director 

15 may refer the matter to the Attorney General 

16 to bring a civil action in a district court of the 

17 United States to enforce such subpoena. 

18 ‘‘(B) VENUE.—An action under this para19 graph may be brought in the judicial district in 

20 which the covered entity against which the ac21 tion is brought resides, is found, or does busi22 ness. 

23 ‘‘(C) CONTEMPT OF COURT.—A court may 

24 punish a failure to comply with a subpoena 
161 

†S 3600 ES

1 issued under this subsection as contempt of 

2 court. 

3 ‘‘(3) NON-DELEGATION.—The authority of the 

4 Director to issue a subpoena under this subsection 

5 may not be delegated. 

6 ‘‘(4) AUTHENTICATION.— 

7 ‘‘(A) IN GENERAL.—Any subpoena issued 

8 electronically pursuant to this subsection shall 

9 be authenticated with a cryptographic digital 

10 signature of an authorized representative of the 

11 Agency, or other comparable successor tech12 nology, that allows the Agency to demonstrate 

13 that such subpoena was issued by the Agency 

14 and has not been altered or modified since such 

15 issuance. 

16 ‘‘(B) INVALID IF NOT AUTHENTICATED.— 

17 Any subpoena issued electronically pursuant to 

18 this subsection that is not authenticated in ac19 cordance with subparagraph (A) shall not be 

20 considered to be valid by the recipient of such 

21 subpoena. 

22 ‘‘(d) PROVISION OF CERTAIN INFORMATION TO AT23 TORNEY GENERAL.— 

24 ‘‘(1) IN GENERAL.—Notwithstanding section 

25 2245(a)(5) and paragraph (b)(2) of this section, if 
162 

†S 3600 ES

1 the Director determines, based on the information 

2 provided in response to a subpoena issued pursuant 

3 to subsection (c), that the facts relating to the cyber 

4 incident or ransom payment at issue may constitute 

5 grounds for a regulatory enforcement action or 

6 criminal prosecution, the Director may provide such 

7 information to the Attorney General or the head of 

8 the appropriate Federal regulatory agency, who may 

9 use such information for a regulatory enforcement 

10 action or criminal prosecution. 

11 ‘‘(2) CONSULTATION.—The Director may con12 sult with the Attorney General or the head of the 

13 appropriate Federal regulatory agency when making 

14 the determination under paragraph (1). 

15 ‘‘(e) CONSIDERATIONS.—When determining whether 

16 to exercise the authorities provided under this section, the 

17 Director shall take into consideration— 

18 ‘‘(1) the complexity in determining if a covered 

19 cyber incident has occurred; and 

20 ‘‘(2) prior interaction with the Agency or 

21 awareness of the covered entity of the policies and 

22 procedures of the Agency for reporting covered cyber 

23 incidents and ransom payments. 

24 ‘‘(f) EXCLUSIONS.—This section shall not apply to a 

25 State, local, Tribal, or territorial government entity. 
163 

†S 3600 ES

1 ‘‘(g) REPORT TO CONGRESS.—The Director shall 

2 submit to Congress an annual report on the number of 

3 times the Director— 

4 ‘‘(1) issued an initial request for information 

5 pursuant to subsection (b); 

6 ‘‘(2) issued a subpoena pursuant to subsection 

7 (c); or 

8 ‘‘(3) referred a matter to the Attorney General 

9 for a civil action pursuant to subsection (c)(2). 

10 ‘‘(h) PUBLICATION OF THE ANNUAL REPORT.—The 

11 Director shall publish a version of the annual report re12 quired under subsection (g) on the website of the Agency, 

13 which shall include, at a minimum, the number of times 

14 the Director— 

15 ‘‘(1) issued an initial request for information 

16 pursuant to subsection (b); or 

17 ‘‘(2) issued a subpoena pursuant to subsection 

18 (c). 

19 ‘‘(i) ANONYMIZATION OF REPORTS.—The Director 

20 shall ensure any victim information contained in a report 

21 required to be published under subsection (h) be 

22 anonymized before the report is published. 

23 ‘‘SEC. 2245. INFORMATION SHARED WITH OR PROVIDED TO 

24 THE FEDERAL GOVERNMENT. 

25 ‘‘(a) DISCLOSURE, RETENTION, AND USE.— 
164 

†S 3600 ES

1 ‘‘(1) AUTHORIZED ACTIVITIES.—Information 

2 provided to the Agency pursuant to section 2242 or 

3 2243 may be disclosed to, retained by, and used by, 

4 consistent with otherwise applicable provisions of 

5 Federal law, any Federal agency or department, 

6 component, officer, employee, or agent of the Fed7 eral Government solely for— 

8 ‘‘(A) a cybersecurity purpose; 

9 ‘‘(B) the purpose of identifying— 

10 ‘‘(i) a cyber threat, including the 

11 source of the cyber threat; or 

12 ‘‘(ii) a security vulnerability; 

13 ‘‘(C) the purpose of responding to, or oth14 erwise preventing or mitigating, a specific 

15 threat of death, a specific threat of serious bod16 ily harm, or a specific threat of serious eco17 nomic harm, including a terrorist act or use of 

18 a weapon of mass destruction; 

19 ‘‘(D) the purpose of responding to, inves20 tigating, prosecuting, or otherwise preventing or 

21 mitigating, a serious threat to a minor, includ22 ing sexual exploitation and threats to physical 

23 safety; or 

24 ‘‘(E) the purpose of preventing, inves25 tigating, disrupting, or prosecuting an offense 
165 

†S 3600 ES

1 arising out of a cyber incident reported pursu2 ant to section 2242 or 2243 or any of the of3 fenses listed in section 105(d)(5)(A)(v) of the 

4 Cybersecurity Act of 2015 (6 U.S.C. 

5 1504(d)(5)(A)(v)). 

6 ‘‘(2) AGENCY ACTIONS AFTER RECEIPT.— 

7 ‘‘(A) RAPID, CONFIDENTIAL SHARING OF

8 CYBER THREAT INDICATORS.—Upon receiving a 

9 covered cyber incident or ransom payment re10 port submitted pursuant to this section, the 

11 Agency shall immediately review the report to 

12 determine whether the cyber incident that is the 

13 subject of the report is connected to an ongoing 

14 cyber threat or security vulnerability and where 

15 applicable, use such report to identify, develop, 

16 and rapidly disseminate to appropriate stake17 holders actionable, anonymized cyber threat in18 dicators and defensive measures. 

19 ‘‘(B) PRINCIPLES FOR SHARING SECURITY

20 VULNERABILITIES.—With respect to informa21 tion in a covered cyber incident or ransom pay22 ment report regarding a security vulnerability 

23 referred to in paragraph (1)(B)(ii), the Director 

24 shall develop principles that govern the timing 

25 and manner in which information relating to se-
166 

†S 3600 ES

1 curity vulnerabilities may be shared, consistent 

2 with common industry best practices and 

3 United States and international standards. 

4 ‘‘(3) PRIVACY AND CIVIL LIBERTIES.—Informa5 tion contained in covered cyber incident and ransom 

6 payment reports submitted to the Agency pursuant 

7 to section 2242 shall be retained, used, and dissemi8 nated, where permissible and appropriate, by the 

9 Federal Government in accordance with processes to 

10 be developed for the protection of personal informa11 tion consistent with processes adopted pursuant to 

12 section 105 of the Cybersecurity Act of 2015 (6 

13 U.S.C. 1504) and in a manner that protects from 

14 unauthorized use or disclosure any information that 

15 may contain— 

16 ‘‘(A) personal information of a specific in17 dividual that is not directly related to a cyberse18 curity threat; or 

19 ‘‘(B) information that identifies a specific 

20 individual that is not directly related to a cyber21 security threat. 

22 ‘‘(4) DIGITAL SECURITY.—The Agency shall en23 sure that reports submitted to the Agency pursuant 

24 to section 2242, and any information contained in 

25 those reports, are collected, stored, and protected at 
167 

†S 3600 ES

1 a minimum in accordance with the requirements for 

2 moderate impact Federal information systems, as 

3 described in Federal Information Processing Stand4 ards Publication 199, or any successor document. 

5 ‘‘(5) PROHIBITION ON USE OF INFORMATION IN

6 REGULATORY ACTIONS.— 

7 ‘‘(A) IN GENERAL.—A Federal, State, 

8 local, or Tribal government shall not use infor9 mation about a covered cyber incident or ran10 som payment obtained solely through reporting 

11 directly to the Agency in accordance with this 

12 subtitle to regulate, including through an en13 forcement action, the activities of the covered 

14 entity or entity that made a ransom payment, 

15 unless the government entity expressly allows 

16 entities to submit reports to the Agency to meet 

17 regulatory reporting obligations of the entity. 

18 ‘‘(B) CLARIFICATION.—A report submitted 

19 to the Agency pursuant to section 2242 or 2243 

20 may, consistent with Federal or State regu21 latory authority specifically relating to the pre22 vention and mitigation of cybersecurity threats 

23 to information systems, inform the development 

24 or implementation of regulations relating to 

25 such systems. 
168 

†S 3600 ES

1 ‘‘(b) PROTECTIONS FOR REPORTING ENTITIES AND

2 INFORMATION.—Reports describing covered cyber inci3 dents or ransom payments submitted to the Agency by en4 tities in accordance with section 2242, as well as volun5 tarily-submitted cyber incident reports submitted to the 

6 Agency pursuant to section 2243, shall— 

7 ‘‘(1) be considered the commercial, financial, 

8 and proprietary information of the covered entity 

9 when so designated by the covered entity; 

10 ‘‘(2) be exempt from disclosure under section 

11 552(b)(3) of title 5, United States Code (commonly 

12 known as the ‘Freedom of Information Act’), as well 

13 as any provision of State, Tribal, or local freedom of 

14 information law, open government law, open meet15 ings law, open records law, sunshine law, or similar 

16 law requiring disclosure of information or records; 

17 ‘‘(3) be considered not to constitute a waiver of 

18 any applicable privilege or protection provided by 

19 law, including trade secret protection; and 

20 ‘‘(4) not be subject to a rule of any Federal 

21 agency or department or any judicial doctrine re22 garding ex parte communications with a decision23 making official. 

24 ‘‘(c) LIABILITY PROTECTIONS.— 
169 

†S 3600 ES

1 ‘‘(1) IN GENERAL.—No cause of action shall lie 

2 or be maintained in any court by any person or enti3 ty and any such action shall be promptly dismissed 

4 for the submission of a report pursuant to section 

5 2242(a) that is submitted in conformance with this 

6 subtitle and the rule promulgated under section 

7 2242(b), except that this subsection shall not apply 

8 with regard to an action by the Federal Government 

9 pursuant to section 2244(c)(2). 

10 ‘‘(2) SCOPE.—The liability protections provided 

11 in this subsection shall only apply to or affect litiga12 tion that is solely based on the submission of a cov13 ered cyber incident report or ransom payment report 

14 to the Agency. 

15 ‘‘(3) RESTRICTIONS.—Notwithstanding para16 graph (2), no report submitted to the Agency pursu17 ant to this subtitle or any communication, document, 

18 material, or other record, created for the sole pur19 pose of preparing, drafting, or submitting such re20 port, may be received in evidence, subject to dis21 covery, or otherwise used in any trial, hearing, or 

22 other proceeding in or before any court, regulatory 

23 body, or other authority of the United States, a 

24 State, or a political subdivision thereof, provided 

25 that nothing in this subtitle shall create a defense to 
170 

†S 3600 ES

1 discovery or otherwise affect the discovery of any 

2 communication, document, material, or other record 

3 not created for the sole purpose of preparing, draft4 ing, or submitting such report. 

5 ‘‘(d) SHARING WITH NON-FEDERAL ENTITIES.— 

6 The Agency shall anonymize the victim who reported the 

7 information when making information provided in reports 

8 received under section 2242 available to critical infrastruc9 ture owners and operators and the general public. 

10 ‘‘(e) STORED COMMUNICATIONS ACT.—Nothing in 

11 this subtitle shall be construed to permit or require disclo12 sure by a provider of a remote computing service or a pro13 vider of an electronic communication service to the public 

14 of information not otherwise permitted or required to be 

15 disclosed under chapter 121 of title 18, United States 

16 Code (commonly known as the ‘Stored Communications 

17 Act’). 

18 ‘‘SEC. 2246. CYBER INCIDENT REPORTING COUNCIL. 

19 ‘‘(a) RESPONSIBILITY OF THE SECRETARY.—The 

20 Secretary shall lead an intergovernmental Cyber Incident 

21 Reporting Council, in consultation with the Director of the 

22 Office of Management and Budget, the Attorney General, 

23 the National Director Cyber Director, Sector Risk Man24 agement Agencies, and other appropriate Federal agen25 cies, to coordinate, deconflict, and harmonize Federal inci-
171 

†S 3600 ES

1 dent reporting requirements, including those issued 

2 through regulations. 

3 ‘‘(b) RULE OF CONSTRUCTION.—Nothing in sub4 section (a) shall be construed to provide any additional 

5 regulatory authority to any Federal entity.’’. 

6 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

7 The table of contents in section 1(b) of the Homeland Se8 curity Act of 2002 (Public Law 107–296; 116 Stat. 2135) 

9 is amended by inserting after the items relating to subtitle 

10 C of title XXII the following: 

‘‘Subtitle D—Cyber Incident Reporting 

‘‘Sec. 2240. Definitions. 

‘‘Sec. 2241. Cyber Incident Review. 

‘‘Sec. 2242. Required reporting of certain cyber incidents. 

‘‘Sec. 2243. Voluntary reporting of other cyber incidents. 

‘‘Sec. 2244. Noncompliance with required reporting. 

‘‘Sec. 2245. Information shared with or provided to the Federal Government. 

‘‘Sec. 2246. Cyber Incident Reporting Council.’’. 

11 SEC. 204. FEDERAL SHARING OF INCIDENT REPORTS. 

12 (a) CYBER INCIDENT REPORTING SHARING.— 

13 (1) IN GENERAL.—Notwithstanding any other 

14 provision of law or regulation, any Federal agency, 

15 including any independent establishment (as defined 

16 in section 104 of title 5, United States Code), that 

17 receives a report from an entity of a cyber incident, 

18 including a ransomware attack, shall provide the re19 port to the Agency as soon as possible, but not later 

20 than 24 hours after receiving the report, unless a 

21 shorter period is required by an agreement made be-
172 

†S 3600 ES

1 tween the Department of Homeland Security (in2 cluding the Cybersecurity and Infrastructure Secu3 rity Agency) and the recipient Federal agency. The 

4 Director shall share and coordinate each report pur5 suant to section 2241(b) of the Homeland Security 

6 Act of 2002, as added by section 203 of this title. 

7 (2) RULE OF CONSTRUCTION.—The require8 ments described in paragraph (1) and section 

9 2245(d) of the Homeland Security Act of 2002, as 

10 added by section 203 of this title, may not be con11 strued to be a violation of any provision of law or 

12 policy that would otherwise prohibit disclosure or 

13 provision of information within the executive branch. 

14 (3) PROTECTION OF INFORMATION.—The Di15 rector shall comply with any obligations of the re16 cipient Federal agency described in paragraph (1) to 

17 protect information, including with respect to pri18 vacy, confidentiality, or information security, if those 

19 obligations would impose greater protection require20 ments than this Act or the amendments made by 

21 this Act. 

22 (4) EFFECTIVE DATE.—This subsection shall 

23 take effect on the effective date of the final rule 

24 issued pursuant to section 2242(b) of the Homeland 
173 

†S 3600 ES

1 Security Act of 2002, as added by section 203 of 

2 this title. 

3 (5) AGENCY AGREEMENTS.— 

4 (A) IN GENERAL.—The Agency and any 

5 Federal agency, including any independent es6 tablishment (as defined in section 104 of title 

7 5, United States Code) that receives incident 

8 reports from entities, including due to 

9 ransomware attacks, shall, as appropriate, enter 

10 into a documented agreement to establish poli11 cies, processes, procedures, and mechanisms to 

12 ensure reports are shared with the Agency pur13 suant to paragraph (1). 

14 (B) AVAILABILITY.—To the maximum ex15 tent practicable, each documented agreement 

16 required under subparagraph (A) shall be made 

17 publicly available. 

18 (C) REQUIREMENT.—The documented 

19 agreements required by subparagraph (A) shall 

20 require reports be shared from Federal agencies 

21 with the Agency in such time as to meet the 

22 overall timeline for covered entity reporting of 

23 covered cyber incidents and ransom payments 

24 established in section 2242 of the Homeland 
174 

†S 3600 ES

1 Security Act of 2002, as added by section 203 

2 of this title. 

3 (b) HARMONIZING REPORTING REQUIREMENTS.— 

4 The Secretary of Homeland Security, acting through the 

5 Director, shall, in consultation with the Cyber Incident 

6 Reporting Council described in section 2246 of the Home7 land Security Act of 2002, as added by section 203 of 

8 this title, to the maximum extent practicable— 

9 (1) periodically review existing regulatory re10 quirements, including the information required in 

11 such reports, to report incidents and ensure that any 

12 such reporting requirements and procedures avoid 

13 conflicting, duplicative, or burdensome requirements; 

14 and 

15 (2) coordinate with appropriate Federal part16 ners and regulatory authorities that receive reports 

17 relating to incidents to identify opportunities to 

18 streamline reporting processes, and where feasible, 

19 facilitate interagency agreements between such au20 thorities to permit the sharing of such reports, con21 sistent with applicable law and policy, without im22 pacting the ability of the Agency to gain timely situ23 ational awareness of a covered cyber incident or ran24 som payment. 
175 

†S 3600 ES

1 SEC. 205. RANSOMWARE VULNERABILITY WARNING PILOT 

2 PROGRAM. 

3 (a) PROGRAM.—Not later than 1 year after the date 

4 of enactment of this Act, the Director shall establish a 

5 ransomware vulnerability warning pilot program to lever6 age existing authorities and technology to specifically de7 velop processes and procedures for, and to dedicate re8 sources to, identifying information systems that contain 

9 security vulnerabilities associated with common 

10 ransomware attacks, and to notify the owners of those vul11 nerable systems of their security vulnerability. 

12 (b) IDENTIFICATION OF VULNERABLE SYSTEMS.— 

13 The pilot program established under subsection (a) shall— 

14 (1) identify the most common security 

15 vulnerabilities utilized in ransomware attacks and 

16 mitigation techniques; and 

17 (2) utilize existing authorities to identify infor18 mation systems that contain the security 

19 vulnerabilities identified in paragraph (1). 

20 (c) ENTITY NOTIFICATION.— 

21 (1) IDENTIFICATION.—If the Director is able to 

22 identify the entity at risk that owns or operates a 

23 vulnerable information system identified in sub24 section (b), the Director may notify the owner of the 

25 information system. 
176 

†S 3600 ES

1 (2) NO IDENTIFICATION.—If the Director is not 

2 able to identify the entity at risk that owns or oper3 ates a vulnerable information system identified in 

4 subsection (b), the Director may utilize the subpoena 

5 authority pursuant to section 2209 of the Homeland 

6 Security Act of 2002 (6 U.S.C. 659) to identify and 

7 notify the entity at risk pursuant to the procedures 

8 under that section. 

9 (3) REQUIRED INFORMATION.—A notification 

10 made under paragraph (1) shall include information 

11 on the identified security vulnerability and mitiga12 tion techniques. 

13 (d) PRIORITIZATION OF NOTIFICATIONS.—To the ex14 tent practicable, the Director shall prioritize covered enti15 ties for identification and notification activities under the 

16 pilot program established under this section. 

17 (e) LIMITATION ON PROCEDURES.—No procedure, 

18 notification, or other authorities utilized in the execution 

19 of the pilot program established under subsection (a) shall 

20 require an owner or operator of a vulnerable information 

21 system to take any action as a result of a notice of a secu22 rity vulnerability made pursuant to subsection (c). 

23 (f) RULE OF CONSTRUCTION.—Nothing in this sec24 tion shall be construed to provide additional authorities 
177 

†S 3600 ES

1 to the Director to identify vulnerabilities or vulnerable sys2 tems. 

3 (g) TERMINATION.—The pilot program established 

4 under subsection (a) shall terminate on the date that is 

5 4 years after the date of enactment of this Act. 

6 SEC. 206. RANSOMWARE THREAT MITIGATION ACTIVITIES. 

7 (a) JOINT RANSOMWARE TASK FORCE.— 

8 (1) IN GENERAL.—Not later than 180 days 

9 after the date of enactment of this Act, the Director, 

10 in consultation with the National Cyber Director, 

11 the Attorney General, and the Director of the Fed12 eral Bureau of Investigation, shall establish and 

13 chair the Joint Ransomware Task Force to coordi14 nate an ongoing nationwide campaign against 

15 ransomware attacks, and identify and pursue oppor16 tunities for international cooperation. 

17 (2) COMPOSITION.—The Joint Ransomware 

18 Task Force shall consist of participants from Fed19 eral agencies, as determined appropriate by the Na20 tional Cyber Director in consultation with the Sec21 retary of Homeland Security. 

22 (3) RESPONSIBILITIES.—The Joint 

23 Ransomware Task Force, utilizing only existing au24 thorities of each participating Federal agency, shall 
178 

†S 3600 ES

1 coordinate across the Federal Government the fol2 lowing activities: 

3 (A) Prioritization of intelligence-driven op4 erations to disrupt specific ransomware actors. 

5 (B) Consult with relevant private sector, 

6 State, local, Tribal, and territorial governments 

7 and international stakeholders to identify needs 

8 and establish mechanisms for providing input 

9 into the Joint Ransomware Task Force. 

10 (C) Identifying, in consultation with rel11 evant entities, a list of highest threat 

12 ransomware entities updated on an ongoing 

13 basis, in order to facilitate— 

14 (i) prioritization for Federal action by 

15 appropriate Federal agencies; and 

16 (ii) identify metrics for success of said 

17 actions. 

18 (D) Disrupting ransomware criminal ac19 tors, associated infrastructure, and their fi20 nances. 

21 (E) Facilitating coordination and collabo22 ration between Federal entities and relevant en23 tities, including the private sector, to improve 

24 Federal actions against ransomware threats. 
179 

†S 3600 ES

1 (F) Collection, sharing, and analysis of 

2 ransomware trends to inform Federal actions. 

3 (G) Creation of after-action reports and 

4 other lessons learned from Federal actions that 

5 identify successes and failures to improve sub6 sequent actions. 

7 (H) Any other activities determined appro8 priate by the Joint Ransomware Task Force to 

9 mitigate the threat of ransomware attacks. 

10 (b) RULE OF CONSTRUCTION.—Nothing in this sec11 tion shall be construed to provide any additional authority 

12 to any Federal agency. 

13 SEC. 207. CONGRESSIONAL REPORTING. 

14 (a) REPORT ON STAKEHOLDER ENGAGEMENT.—Not 

15 later than 30 days after the date on which the Director 

16 issues the final rule under section 2242(b) of the Home17 land Security Act of 2002, as added by section 203(b) of 

18 this title, the Director shall submit to the Committee on 

19 Homeland Security and Governmental Affairs of the Sen20 ate and the Committee on Homeland Security of the 

21 House of Representatives a report that describes how the 

22 Director engaged stakeholders in the development of the 

23 final rule. 

24 (b) REPORT ON OPPORTUNITIES TO STRENGTHEN

25 SECURITY RESEARCH.—Not later than 1 year after the 
180 

†S 3600 ES

1 date of enactment of this Act, the Director shall submit 

2 to the Committee on Homeland Security and Govern3 mental Affairs of the Senate and the Committee on Home4 land Security of the House of Representatives a report de5 scribing how the National Cybersecurity and Communica6 tions Integration Center established under section 2209 

7 of the Homeland Security Act of 2002 (6 U.S.C. 659) has 

8 carried out activities under section 2241(a)(9) of the 

9 Homeland Security Act of 2002, as added by section 

10 203(a) of this title, by proactively identifying opportunities 

11 to use cyber incident data to inform and enable cybersecu12 rity research within the academic and private sector. 

13 (c) REPORT ON RANSOMWARE VULNERABILITY

14 WARNING PILOT PROGRAM.—Not later than 1 year after 

15 the date of enactment of this Act, and annually thereafter 

16 for the duration of the pilot program established under 

17 section 205, the Director shall submit to the Committee 

18 on Homeland Security and Governmental Affairs of the 

19 Senate and the Committee on Homeland Security of the 

20 House of Representatives a report, which may include a 

21 classified annex, on the effectiveness of the pilot program, 

22 which shall include a discussion of the following: 

23 (1) The effectiveness of the notifications under 

24 section 205(c) in mitigating security vulnerabilities 

25 and the threat of ransomware. 
181 

†S 3600 ES

1 (2) Identification of the most common 

2 vulnerabilities utilized in ransomware. 

3 (3) The number of notifications issued during 

4 the preceding year. 

5 (4) To the extent practicable, the number of 

6 vulnerable devices or systems mitigated under the 

7 pilot program by the Agency during the preceding 

8 year. 

9 (d) REPORT ON HARMONIZATION OF REPORTING

10 REGULATIONS.— 

11 (1) IN GENERAL.—Not later than 180 days 

12 after the date on which the Secretary of Homeland 

13 Security convenes the Cyber Incident Reporting 

14 Council described in section 2246 of the Homeland 

15 Security Act of 2002, as added by section 203 of 

16 this title, the Secretary of Homeland Security shall 

17 submit to the appropriate congressional committees 

18 a report that includes— 

19 (A) a list of duplicative Federal cyber inci20 dent reporting requirements on covered entities; 

21 (B) a description of any challenges in har22 monizing the duplicative reporting require23 ments; 
182 

†S 3600 ES

1 (C) any actions the Director intends to 

2 take to facilitate harmonizing the duplicative 

3 reporting requirements; and 

4 (D) any proposed legislative changes nec5 essary to address the duplicative reporting. 

6 (2) RULE OF CONSTRUCTION.—Nothing in 

7 paragraph (1) shall be construed to provide any ad8 ditional regulatory authority to any Federal agency. 

9 (e) GAO REPORTS.— 

10 (1) IMPLEMENTATION OF THIS ACT.—Not later 

11 than 2 years after the date of enactment of this Act, 

12 the Comptroller General of the United States shall 

13 submit to the Committee on Homeland Security and 

14 Governmental Affairs of the Senate and the Com15 mittee on Homeland Security of the House of Rep16 resentatives a report on the implementation of this 

17 Act and the amendments made by this Act. 

18 (2) EXEMPTIONS TO REPORTING.—Not later 

19 than 1 year after the date on which the Director 

20 issues the final rule required under section 2242(b) 

21 of the Homeland Security Act of 2002, as added by 

22 section 203 of this title, the Comptroller General of 

23 the United States shall submit to the Committee on 

24 Homeland Security and Governmental Affairs of the 

25 Senate and the Committee on Homeland Security of 
183 

†S 3600 ES

1 the House of Representatives a report on the exemp2 tions to reporting under paragraphs (2) and (5) of 

3 section 2242(a) of the Homeland Security Act of 

4 2002, as added by section 203 of this title, which 

5 shall include— 

6 (A) to the extent practicable, an evaluation 

7 of the quantity of cyber incidents not reported 

8 to the Federal Government; 

9 (B) an evaluation of the impact on im10 pacted entities, homeland security, and the na11 tional economy due to cyber incidents, 

12 ransomware attacks, and ransom payments, in13 cluding a discussion on the scope of impact of 

14 cyber incidents that were not reported to the 

15 Federal Government; 

16 (C) an evaluation of the burden, financial 

17 and otherwise, on entities required to report 

18 cyber incidents under this Act, including an 

19 analysis of entities that meet the definition of 

20 a small business concern under section 3 of the 

21 Small Business Act (15 U.S.C. 632); and 

22 (D) a description of the consequences and 

23 effects of limiting covered cyber incident and 

24 ransom payment reporting to only covered enti25 ties. 
184 

†S 3600 ES

1 (f) REPORT ON EFFECTIVENESS OF ENFORCEMENT

2 MECHANISMS.—Not later than 1 year after the date on 

3 which the Director issues the final rule required under sec4 tion 2242(b) of the Homeland Security Act of 2002, as 

5 added by section 203 of this title, the Director shall sub6 mit to the Committee on Homeland Security and Govern7 mental Affairs of the Senate and the Committee on Home8 land Security of the House of Representatives a report on 

9 the effectiveness of the enforcement mechanisms within 

10 section 2244 of the Homeland Security Act of 2002, as 

11 added by section 203 of this title. 

12 TITLE III—FEDERAL SECURE 

13 CLOUD IMPROVEMENT AND 

14 JOBS ACT OF 2022 

15 SEC. 301. SHORT TITLE. 

16 This title may be cited as the ‘‘Federal Secure Cloud 

17 Improvement and Jobs Act of 2022’’. 

18 SEC. 302. FINDINGS. 

19 Congress finds the following: 

20 (1) Ensuring that the Federal Government can 

21 securely leverage cloud computing products and serv22 ices is key to expediting the modernization of legacy 

23 information technology systems, increasing cyberse24 curity within and across departments and agencies, 

25 and supporting the continued leadership of the 
185 

†S 3600 ES

1 United States in technology innovation and job cre2 ation. 

3 (2) According to independent analysis, as of 

4 calendar year 2019, the size of the cloud computing 

5 market had tripled since 2004, enabling more than 

6 2,000,000 jobs and adding more than 

7 $200,000,000,000 to the gross domestic product of 

8 the United States. 

9 (3) The Federal Government, across multiple 

10 presidential administrations and Congresses, has 

11 continued to support the ability of agencies to move 

12 to the cloud, including through— 

13 (A) President Barack Obama’s ‘‘Cloud 

14 First Strategy’’; 

15 (B) President Donald Trump’s ‘‘Cloud 

16 Smart Strategy’’; 

17 (C) the prioritization of cloud security in 

18 Executive Order 14028 (86 Fed. Reg. 26633; 

19 relating to improving the nation’s cybersecu20 rity), which was issued by President Joe Biden; 

21 and 

22 (D) more than a decade of appropriations 

23 and authorization legislation that provides 

24 agencies with relevant authorities and appro25 priations to modernize on-premises information 
186 

†S 3600 ES

1 technology systems and more readily adopt 

2 cloud computing products and services. 

3 (4) Since it was created in 2011, the Federal 

4 Risk and Authorization Management Program (re5 ferred to in this section as ‘‘FedRAMP’’) at the 

6 General Services Administration has made steady 

7 and sustained improvements in supporting the se8 cure authorization and reuse of cloud computing 

9 products and services within the Federal Govern10 ment, including by reducing the costs and burdens 

11 on both agencies and cloud companies to quickly and 

12 securely enter the Federal market. 

13 (5) According to data from the General Services 

14 Administration, as of the end of fiscal year 2021, 

15 there were 239 cloud providers with FedRAMP au16 thorizations, and those authorizations had been re17 used more than 2,700 times across various agencies. 

18 (6) Providing a legislative framework for 

19 FedRAMP and new authorities to the General Serv20 ices Administration, the Office of Management and 

21 Budget, and Federal agencies will— 

22 (A) improve the speed at which new cloud 

23 computing products and services can be se24 curely authorized; 
187 

†S 3600 ES

1 (B) enhance the ability of agencies to ef2 fectively evaluate FedRAMP authorized pro3 viders for reuse; 

4 (C) reduce the costs and burdens to cloud 

5 providers seeking a FedRAMP authorization; 

6 and 

7 (D) provide for more robust transparency 

8 and dialogue between industry and the Federal 

9 Government to drive stronger adoption of se10 cure cloud capabilities, create jobs, and reduce 

11 wasteful legacy information technology. 

12 SEC. 303. TITLE 44 AMENDMENTS. 

13 (a) AMENDMENT.—Chapter 36 of title 44, United 

14 States Code, is amended by adding at the end the fol15 lowing: 

16 ‘‘§ 3607. Definitions 

17 ‘‘(a) IN GENERAL.—Except as provided under sub18 section (b), the definitions under sections 3502 and 3552 

19 apply to this section through section 3616. 

20 ‘‘(b) ADDITIONAL DEFINITIONS.—In this section 

21 through section 3616: 

22 ‘‘(1) ADMINISTRATOR.—The term ‘Adminis23 trator’ means the Administrator of General Services. 

24 ‘‘(2) APPROPRIATE CONGRESSIONAL COMMIT25 TEES.—The term ‘appropriate congressional com-
188 

†S 3600 ES

1 mittees’ means the Committee on Homeland Secu2 rity and Governmental Affairs of the Senate and the 

3 Committee on Oversight and Reform of the House 

4 of Representatives. 

5 ‘‘(3) AUTHORIZATION TO OPERATE; FEDERAL

6 INFORMATION.—The terms ‘authorization to oper7 ate’ and ‘Federal information’ have the meaning 

8 given those term in Circular A–130 of the Office of 

9 Management and Budget entitled ‘Managing Infor10 mation as a Strategic Resource’, or any successor 

11 document. 

12 ‘‘(4) CLOUD COMPUTING.—The term ‘cloud 

13 computing’ has the meaning given the term in Spe14 cial Publication 800–145 of the National Institute of 

15 Standards and Technology, or any successor docu16 ment. 

17 ‘‘(5) CLOUD SERVICE PROVIDER.—The term 

18 ‘cloud service provider’ means an entity offering 

19 cloud computing products or services to agencies. 

20 ‘‘(6) FEDRAMP.—The term ‘FedRAMP’ 

21 means the Federal Risk and Authorization Manage22 ment Program established under section 3608. 

23 ‘‘(7) FEDRAMP AUTHORIZATION.—The term 

24 ‘FedRAMP authorization’ means a certification that 

25 a cloud computing product or service has— 
189 

†S 3600 ES

1 ‘‘(A) completed a FedRAMP authorization 

2 process, as determined by the Administrator; or 

3 ‘‘(B) received a FedRAMP provisional au4 thorization to operate, as determined by the 

5 FedRAMP Board. 

6 ‘‘(8) FEDRAMP AUTHORIZATION PACKAGE.— 

7 The term ‘FedRAMP authorization package’ means 

8 the essential information that can be used by an 

9 agency to determine whether to authorize the oper10 ation of an information system or the use of a des11 ignated set of common controls for all cloud com12 puting products and services authorized by 

13 FedRAMP. 

14 ‘‘(9) FEDRAMP BOARD.—The term ‘FedRAMP 

15 Board’ means the board established under section 

16 3610. 

17 ‘‘(10) INDEPENDENT ASSESSMENT SERVICE.— 

18 The term ‘independent assessment service’ means a 

19 third-party organization accredited by the Adminis20 trator to undertake conformity assessments of cloud 

21 service providers and the products or services of 

22 cloud service providers. 

23 ‘‘(11) SECRETARY.—The term ‘Secretary’ 

24 means the Secretary of Homeland Security. 
190 

†S 3600 ES

1 ‘‘§ 3608. Federal Risk and Authorization Management 

2 Program 

3 ‘‘There is established within the General Services Ad4 ministration the Federal Risk and Authorization Manage5 ment Program. The Administrator, subject to section 

6 3614, shall establish a Government-wide program that 

7 provides a standardized, reusable approach to security as8 sessment and authorization for cloud computing products 

9 and services that process unclassified information used by 

10 agencies. 

11 ‘‘§ 3609. Roles and responsibilities of the General 

12 Services Administration 

13 ‘‘(a) ROLES AND RESPONSIBILITIES.—The Adminis14 trator shall— 

15 ‘‘(1) in consultation with the Secretary, develop, 

16 coordinate, and implement a process to support 

17 agency review, reuse, and standardization, where ap18 propriate, of security assessments of cloud com19 puting products and services, including, as appro20 priate, oversight of continuous monitoring of cloud 

21 computing products and services, pursuant to guid22 ance issued by the Director pursuant to section 

23 3614; 

24 ‘‘(2) establish processes and identify criteria 

25 consistent with guidance issued by the Director 

26 under section 3614 to make a cloud computing prod-
191 

†S 3600 ES

1 uct or service eligible for a FedRAMP authorization 

2 and validate whether a cloud computing product or 

3 service has a FedRAMP authorization; 

4 ‘‘(3) develop and publish templates, best prac5 tices, technical assistance, and other materials to 

6 support the authorization of cloud computing prod7 ucts and services and increase the speed, effective8 ness, and transparency of the authorization process, 

9 consistent with standards and guidelines established 

10 by the Director of the National Institute of Stand11 ards and Technology and relevant statutes; 

12 ‘‘(4) establish and update guidance on the 

13 boundaries of FedRAMP authorization packages to 

14 enhance the security and protection of Federal infor15 mation and promote transparency for agencies and 

16 users as to which services are included in the scope 

17 of a FedRAMP authorization; 

18 ‘‘(5) grant FedRAMP authorizations to cloud 

19 computing products and services consistent with the 

20 guidance and direction of the FedRAMP Board; 

21 ‘‘(6) establish and maintain a public comment 

22 process for proposed guidance and other FedRAMP 

23 directives that may have a direct impact on cloud 

24 service providers and agencies before the issuance of 

25 such guidance or other FedRAMP directives; 
192 

†S 3600 ES

1 ‘‘(7) coordinate with the FedRAMP Board, the 

2 Director of the Cybersecurity and Infrastructure Se3 curity Agency, and other entities identified by the 

4 Administrator, with the concurrence of the Director 

5 and the Secretary, to establish and regularly update 

6 a framework for continuous monitoring under sec7 tion 3553; 

8 ‘‘(8) provide a secure mechanism for storing 

9 and sharing necessary data, including FedRAMP 

10 authorization packages, to enable better reuse of 

11 such packages across agencies, including making 

12 available any information and data necessary for 

13 agencies to fulfill the requirements of section 3613; 

14 ‘‘(9) provide regular updates to applicant cloud 

15 service providers on the status of any cloud com16 puting product or service during an assessment 

17 process; 

18 ‘‘(10) regularly review, in consultation with the 

19 FedRAMP Board— 

20 ‘‘(A) the costs associated with the inde21 pendent assessment services described in section 

22 3611; and 

23 ‘‘(B) the information relating to foreign in24 terests submitted pursuant to section 3612; 
193 

†S 3600 ES

1 ‘‘(11) in coordination with the Director of the 

2 National Institute of Standards and Technology, the 

3 Director, the Secretary, and other stakeholders, as 

4 appropriate, determine the sufficiency of underlying 

5 standards and requirements to identify and assess 

6 the provenance of the software in cloud services and 

7 products; 

8 ‘‘(12) support the Federal Secure Cloud Advi9 sory Committee established pursuant to section 

10 3616; and 

11 ‘‘(13) take such other actions as the Adminis12 trator may determine necessary to carry out 

13 FedRAMP. 

14 ‘‘(b) WEBSITE.— 

15 ‘‘(1) IN GENERAL.—The Administrator shall 

16 maintain a public website to serve as the authori17 tative repository for FedRAMP, including the timely 

18 publication and updates for all relevant information, 

19 guidance, determinations, and other materials re20 quired under subsection (a). 

21 ‘‘(2) CRITERIA AND PROCESS FOR FEDRAMP

22 AUTHORIZATION PRIORITIES.—The Administrator 

23 shall develop and make publicly available on the 

24 website described in paragraph (1) the criteria and 

25 process for prioritizing and selecting cloud com-
194 

†S 3600 ES

1 puting products and services that will receive a 

2 FedRAMP authorization, in consultation with the 

3 FedRAMP Board and the Chief Information Offi4 cers Council. 

5 ‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 

6 ‘‘(1) IN GENERAL.—The Administrator, in co7 ordination with the Secretary, shall assess and 

8 evaluate available automation capabilities and proce9 dures to improve the efficiency and effectiveness of 

10 the issuance of FedRAMP authorizations, including 

11 continuous monitoring of cloud computing products 

12 and services. 

13 ‘‘(2) MEANS FOR AUTOMATION.—Not later than 

14 1 year after the date of enactment of this section, 

15 and updated regularly thereafter, the Administrator 

16 shall establish a means for the automation of secu17 rity assessments and reviews. 

18 ‘‘(d) METRICS FOR AUTHORIZATION.—The Adminis19 trator shall establish annual metrics regarding the time 

20 and quality of the assessments necessary for completion 

21 of a FedRAMP authorization process in a manner that 

22 can be consistently tracked over time in conjunction with 

23 the periodic testing and evaluation process pursuant to 

24 section 3554 in a manner that minimizes the agency re25 porting burden. 
195 

†S 3600 ES

1 ‘‘§ 3610. FedRAMP Board 

2 ‘‘(a) ESTABLISHMENT.—There is established a 

3 FedRAMP Board to provide input and recommendations 

4 to the Administrator regarding the requirements and 

5 guidelines for, and the prioritization of, security assess6 ments of cloud computing products and services. 

7 ‘‘(b) MEMBERSHIP.—The FedRAMP Board shall 

8 consist of not more than 7 senior officials or experts from 

9 agencies appointed by the Director, in consultation with 

10 the Administrator, from each of the following: 

11 ‘‘(1) The Department of Defense. 

12 ‘‘(2) The Department of Homeland Security. 

13 ‘‘(3) The General Services Administration. 

14 ‘‘(4) Such other agencies as determined by the 

15 Director, in consultation with the Administrator. 

16 ‘‘(c) QUALIFICATIONS.—Members of the FedRAMP 

17 Board appointed under subsection (b) shall have technical 

18 expertise in domains relevant to FedRAMP, such as— 

19 ‘‘(1) cloud computing; 

20 ‘‘(2) cybersecurity; 

21 ‘‘(3) privacy; 

22 ‘‘(4) risk management; and 

23 ‘‘(5) other competencies identified by the Direc24 tor to support the secure authorization of cloud serv25 ices and products. 

26 ‘‘(d) DUTIES.—The FedRAMP Board shall— 
196 

†S 3600 ES

1 ‘‘(1) in consultation with the Administrator, 

2 serve as a resource for best practices to accelerate 

3 the process for obtaining a FedRAMP authorization; 

4 ‘‘(2) establish and regularly update require5 ments and guidelines for security authorizations of 

6 cloud computing products and services, consistent 

7 with standards and guidelines established by the Di8 rector of the National Institute of Standards and 

9 Technology, to be used in the determination of 

10 FedRAMP authorizations; 

11 ‘‘(3) monitor and oversee, to the greatest extent 

12 practicable, the processes and procedures by which 

13 agencies determine and validate requirements for a 

14 FedRAMP authorization, including periodic review 

15 of the agency determinations described in section 

16 3613(b); 

17 ‘‘(4) ensure consistency and transparency be18 tween agencies and cloud service providers in a man19 ner that minimizes confusion and engenders trust; 

20 and 

21 ‘‘(5) perform such other roles and responsibil22 ities as the Director may assign, with concurrence 

23 from the Administrator. 

24 ‘‘(e) DETERMINATIONS OF DEMAND FOR CLOUD

25 COMPUTING PRODUCTS AND SERVICES.—The FedRAMP 
197 

†S 3600 ES

1 Board may consult with the Chief Information Officers 

2 Council to establish a process, which may be made avail3 able on the website maintained under section 3609(b), for 

4 prioritizing and accepting the cloud computing products 

5 and services to be granted a FedRAMP authorization. 

6 ‘‘§ 3611. Independent assessment 

7 ‘‘The Administrator may determine whether 

8 FedRAMP may use an independent assessment service to 

9 analyze, validate, and attest to the quality and compliance 

10 of security assessment materials provided by cloud service 

11 providers during the course of a determination of whether 

12 to use a cloud computing product or service. 

13 ‘‘§ 3612. Declaration of foreign interests 

14 ‘‘(a) IN GENERAL.—An independent assessment serv15 ice that performs services described in section 3611 shall 

16 annually submit to the Administrator information relating 

17 to any foreign interest, foreign influence, or foreign con18 trol of the independent assessment service. 

19 ‘‘(b) UPDATES.—Not later than 48 hours after there 

20 is a change in foreign ownership or control of an inde21 pendent assessment service that performs services de22 scribed in section 3611, the independent assessment serv23 ice shall submit to the Administrator an update to the in24 formation submitted under subsection (a). 
198 

†S 3600 ES

1 ‘‘(c) CERTIFICATION.—The Administrator may re2 quire a representative of an independent assessment serv3 ice to certify the accuracy and completeness of any infor4 mation submitted under this section. 

5 ‘‘§ 3613. Roles and responsibilities of agencies 

6 ‘‘(a) IN GENERAL.—In implementing the require7 ments of FedRAMP, the head of each agency shall, con8 sistent with guidance issued by the Director pursuant to 

9 section 3614— 

10 ‘‘(1) promote the use of cloud computing prod11 ucts and services that meet FedRAMP security re12 quirements and other risk-based performance re13 quirements as determined by the Director, in con14 sultation with the Secretary; 

15 ‘‘(2) confirm whether there is a FedRAMP au16 thorization in the secure mechanism provided under 

17 section 3609(a)(8) before beginning the process of 

18 granting a FedRAMP authorization for a cloud com19 puting product or service; 

20 ‘‘(3) to the extent practicable, for any cloud 

21 computing product or service the agency seeks to au22 thorize that has received a FedRAMP authorization, 

23 use the existing assessments of security controls and 

24 materials within any FedRAMP authorization pack25 age for that cloud computing product or service; and 
199 

†S 3600 ES

1 ‘‘(4) provide to the Director data and informa2 tion required by the Director pursuant to section 

3 3614 to determine how agencies are meeting metrics 

4 established by the Administrator. 

5 ‘‘(b) ATTESTATION.—Upon completing an assess6 ment or authorization activity with respect to a particular 

7 cloud computing product or service, if an agency deter8 mines that the information and data the agency has re9 viewed under paragraph (2) or (3) of subsection (a) is 

10 wholly or substantially deficient for the purposes of per11 forming an authorization of the cloud computing product 

12 or service, the head of the agency shall document as part 

13 of the resulting FedRAMP authorization package the rea14 sons for this determination. 

15 ‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE

16 REQUIRED.—Upon issuance of an agency authorization to 

17 operate based on a FedRAMP authorization, the head of 

18 the agency shall provide a copy of its authorization to op19 erate letter and any supplementary information required 

20 pursuant to section 3609(a) to the Administrator. 

21 ‘‘(d) SUBMISSION OF POLICIES REQUIRED.—Not 

22 later than 180 days after the date on which the Director 

23 issues guidance in accordance with section 3614(1), the 

24 head of each agency, acting through the chief information 

25 officer of the agency, shall submit to the Director all agen-
200 

†S 3600 ES

1 cy policies relating to the authorization of cloud computing 

2 products and services. 

3 ‘‘(e) PRESUMPTION OF ADEQUACY.— 

4 ‘‘(1) IN GENERAL.—The assessment of security 

5 controls and materials within the authorization 

6 package for a FedRAMP authorization shall be pre7 sumed adequate for use in an agency authorization 

8 to operate cloud computing products and services. 

9 ‘‘(2) INFORMATION SECURITY REQUIRE10 MENTS.—The presumption under paragraph (1) 

11 does not modify or alter— 

12 ‘‘(A) the responsibility of any agency to en13 sure compliance with subchapter II of chapter 

14 35 for any cloud computing product or service 

15 used by the agency; or 

16 ‘‘(B) the authority of the head of any 

17 agency to make a determination that there is a 

18 demonstrable need for additional security re19 quirements beyond the security requirements 

20 included in a FedRAMP authorization for a 

21 particular control implementation. 

22 ‘‘§ 3614. Roles and responsibilities of the Office of 

23 Management and Budget 

24 ‘‘The Director shall— 
201 

†S 3600 ES

1 ‘‘(1) in consultation with the Administrator and 

2 the Secretary, issue guidance that— 

3 ‘‘(A) specifies the categories or characteris4 tics of cloud computing products and services 

5 that are within the scope of FedRAMP; 

6 ‘‘(B) includes requirements for agencies to 

7 obtain a FedRAMP authorization when oper8 ating a cloud computing product or service de9 scribed in subparagraph (A) as a Federal infor10 mation system; and 

11 ‘‘(C) encompasses, to the greatest extent 

12 practicable, all necessary and appropriate cloud 

13 computing products and services; 

14 ‘‘(2) issue guidance describing additional re15 sponsibilities of FedRAMP and the FedRAMP 

16 Board to accelerate the adoption of secure cloud 

17 computing products and services by the Federal 

18 Government; 

19 ‘‘(3) in consultation with the Administrator, es20 tablish a process to periodically review FedRAMP 

21 authorization packages to support the secure author22 ization and reuse of secure cloud products and serv23 ices; 

24 ‘‘(4) oversee the effectiveness of FedRAMP and 

25 the FedRAMP Board, including the compliance by 
202 

†S 3600 ES

1 the FedRAMP Board with the duties described in 

2 section 3610(d); and 

3 ‘‘(5) to the greatest extent practicable, encour4 age and promote consistency of the assessment, au5 thorization, adoption, and use of secure cloud com6 puting products and services within and across agen7 cies. 

8 ‘‘§ 3615. Reports to Congress; GAO report 

9 ‘‘(a) REPORTS TO CONGRESS.—Not later than 1 year 

10 after the date of enactment of this section, and annually 

11 thereafter, the Director shall submit to the appropriate 

12 congressional committees a report that includes the fol13 lowing: 

14 ‘‘(1) During the preceding year, the status, effi15 ciency, and effectiveness of the General Services Ad16 ministration under section 3609 and agencies under 

17 section 3613 and in supporting the speed, effective18 ness, sharing, reuse, and security of authorizations 

19 to operate for secure cloud computing products and 

20 services. 

21 ‘‘(2) Progress towards meeting the metrics re22 quired under section 3609(d). 

23 ‘‘(3) Data on FedRAMP authorizations. 

24 ‘‘(4) The average length of time to issue 

25 FedRAMP authorizations. 
203 

†S 3600 ES

1 ‘‘(5) The number of FedRAMP authorizations 

2 submitted, issued, and denied for the preceding year. 

3 ‘‘(6) A review of progress made during the pre4 ceding year in advancing automation techniques to 

5 securely automate FedRAMP processes and to accel6 erate reporting under this section. 

7 ‘‘(7) The number and characteristics of author8 ized cloud computing products and services in use at 

9 each agency consistent with guidance provided by 

10 the Director under section 3614. 

11 ‘‘(8) A review of FedRAMP measures to ensure 

12 the security of data stored or processed by cloud 

13 service providers, which may include— 

14 ‘‘(A) geolocation restrictions for provided 

15 products or services; 

16 ‘‘(B) disclosures of foreign elements of 

17 supply chains of acquired products or services; 

18 ‘‘(C) continued disclosures of ownership of 

19 cloud service providers by foreign entities; and 

20 ‘‘(D) encryption for data processed, stored, 

21 or transmitted by cloud service providers. 

22 ‘‘(b) GAO REPORT.—Not later than 180 days after 

23 the date of enactment of this section, the Comptroller 

24 General of the United States shall report to the appro-
204 

†S 3600 ES

1 priate congressional committees an assessment of the fol2 lowing: 

3 ‘‘(1) The costs incurred by agencies and cloud 

4 service providers relating to the issuance of 

5 FedRAMP authorizations. 

6 ‘‘(2) The extent to which agencies have proc7 esses in place to continuously monitor the implemen8 tation of cloud computing products and services op9 erating as Federal information systems. 

10 ‘‘(3) How often and for which categories of 

11 products and services agencies use FedRAMP au12 thorizations. 

13 ‘‘(4) The unique costs and potential burdens in14 curred by cloud computing companies that are small 

15 business concerns (as defined in section 3(a) of the 

16 Small Business Act (15 U.S.C. 632(a)) as a part of 

17 the FedRAMP authorization process. 

18 ‘‘§ 3616. Federal Secure Cloud Advisory Committee 

19 ‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 

20 ‘‘(1) ESTABLISHMENT.—There is established a 

21 Federal Secure Cloud Advisory Committee (referred 

22 to in this section as the ‘Committee’) to ensure ef23 fective and ongoing coordination of agency adoption, 

24 use, authorization, monitoring, acquisition, and secu-
205 

†S 3600 ES

1 rity of cloud computing products and services to en2 able agency mission and administrative priorities. 

3 ‘‘(2) PURPOSES.—The purposes of the Com4 mittee are the following: 

5 ‘‘(A) To examine the operations of 

6 FedRAMP and determine ways that authoriza7 tion processes can continuously be improved, in8 cluding the following: 

9 ‘‘(i) Measures to increase agency 

10 reuse of FedRAMP authorizations. 

11 ‘‘(ii) Proposed actions that can be 

12 adopted to reduce the burden, confusion, 

13 and cost associated with FedRAMP au14 thorizations for cloud service providers. 

15 ‘‘(iii) Measures to increase the num16 ber of FedRAMP authorizations for cloud 

17 computing products and services offered by 

18 small businesses concerns (as defined by 

19 section 3(a) of the Small Business Act (15 

20 U.S.C. 632(a)). 

21 ‘‘(iv) Proposed actions that can be 

22 adopted to reduce the burden and cost of 

23 FedRAMP authorizations for agencies. 
206 

†S 3600 ES

1 ‘‘(B) Collect information and feedback on 

2 agency compliance with and implementation of 

3 FedRAMP requirements. 

4 ‘‘(C) Serve as a forum that facilitates com5 munication and collaboration among the 

6 FedRAMP stakeholder community. 

7 ‘‘(3) DUTIES.—The duties of the Committee in8 clude providing advice and recommendations to the 

9 Administrator, the FedRAMP Board, and agencies 

10 on technical, financial, programmatic, and oper11 ational matters regarding secure adoption of cloud 

12 computing products and services. 

13 ‘‘(b) MEMBERS.— 

14 ‘‘(1) COMPOSITION.—The Committee shall be 

15 comprised of not more than 15 members who are 

16 qualified representatives from the public and private 

17 sectors, appointed by the Administrator, in consulta18 tion with the Director, as follows: 

19 ‘‘(A) The Administrator or the Administra20 tor’s designee, who shall be the Chair of the 

21 Committee. 

22 ‘‘(B) At least 1 representative each from 

23 the Cybersecurity and Infrastructure Security 

24 Agency and the National Institute of Standards 

25 and Technology. 
207 

†S 3600 ES

1 ‘‘(C) At least 2 officials who serve as the 

2 Chief Information Security Officer within an 

3 agency, who shall be required to maintain such 

4 a position throughout the duration of their serv5 ice on the Committee. 

6 ‘‘(D) At least 1 official serving as Chief 

7 Procurement Officer (or equivalent) in an agen8 cy, who shall be required to maintain such a po9 sition throughout the duration of their service 

10 on the Committee. 

11 ‘‘(E) At least 1 individual representing an 

12 independent assessment service. 

13 ‘‘(F) At least 5 representatives from 

14 unique businesses that primarily provide cloud 

15 computing services or products, including at 

16 least 2 representatives from a small business 

17 concern (as defined by section 3(a) of the Small 

18 Business Act (15 U.S.C. 632(a))). 

19 ‘‘(G) At least 2 other representatives of the 

20 Federal Government as the Administrator de21 termines necessary to provide sufficient balance, 

22 insights, or expertise to the Committee. 

23 ‘‘(2) DEADLINE FOR APPOINTMENT.—Each 

24 member of the Committee shall be appointed not 
208 

†S 3600 ES

1 later than 90 days after the date of enactment of 

2 this section. 

3 ‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 

4 ‘‘(A) IN GENERAL.—Each non-Federal 

5 member of the Committee shall be appointed 

6 for a term of 3 years, except that the initial 

7 terms for members may be staggered 1-, 2-, or 

8 3-year terms to establish a rotation in which 

9 one-third of the members are selected each 

10 year. Any such member may be appointed for 

11 not more than 2 consecutive terms. 

12 ‘‘(B) VACANCIES.—Any vacancy in the 

13 Committee shall not affect its powers, but shall 

14 be filled in the same manner in which the origi15 nal appointment was made. Any member ap16 pointed to fill a vacancy occurring before the 

17 expiration of the term for which the member’s 

18 predecessor was appointed shall be appointed 

19 only for the remainder of that term. A member 

20 may serve after the expiration of that member’s 

21 term until a successor has taken office. 

22 ‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 

23 ‘‘(1) MEETINGS.—The Committee shall hold 

24 not fewer than 3 meetings in a calendar year, at 

25 such time and place as determined by the Chair. 
209 

†S 3600 ES

1 ‘‘(2) INITIAL MEETING.—Not later than 120 

2 days after the date of enactment of this section, the 

3 Committee shall meet and begin the operations of 

4 the Committee. 

5 ‘‘(3) RULES OF PROCEDURE.—The Committee 

6 may establish rules for the conduct of the business 

7 of the Committee if such rules are not inconsistent 

8 with this section or other applicable law. 

9 ‘‘(d) EMPLOYEE STATUS.— 

10 ‘‘(1) IN GENERAL.—A member of the Com11 mittee (other than a member who is appointed to the 

12 Committee in connection with another Federal ap13 pointment) shall not be considered an employee of 

14 the Federal Government by reason of any service as 

15 such a member, except for the purposes of section 

16 5703 of title 5, relating to travel expenses. 

17 ‘‘(2) PAY NOT PERMITTED.—A member of the 

18 Committee covered by paragraph (1) may not receive 

19 pay by reason of service on the Committee. 

20 ‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY

21 COMMITTEE ACT.—Section 14 of the Federal Advisory 

22 Committee Act (5 U.S.C. App.) shall not apply to the 

23 Committee. 

24 ‘‘(f) DETAIL OF EMPLOYEES.—Any Federal Govern25 ment employee may be detailed to the Committee without 
210 

†S 3600 ES

1 reimbursement from the Committee, and such detailee 

2 shall retain the rights, status, and privileges of his or her 

3 regular employment without interruption. 

4 ‘‘(g) POSTAL SERVICES.—The Committee may use 

5 the United States mails in the same manner and under 

6 the same conditions as agencies. 

7 ‘‘(h) REPORTS.— 

8 ‘‘(1) INTERIM REPORTS.—The Committee may 

9 submit to the Administrator and Congress interim 

10 reports containing such findings, conclusions, and 

11 recommendations as have been agreed to by the 

12 Committee. 

13 ‘‘(2) ANNUAL REPORTS.—Not later than 540 

14 days after the date of enactment of this section, and 

15 annually thereafter, the Committee shall submit to 

16 the Administrator and Congress a report containing 

17 such findings, conclusions, and recommendations as 

18 have been agreed to by the Committee.’’. 

19 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

20 The table of sections for chapter 36 of title 44, United 

21 States Code, is amended by adding at the end the fol22 lowing new items: 

‘‘3607. Definitions. 

‘‘3608. Federal Risk and Authorization Management Program. 

‘‘3609. Roles and responsibilities of the General Services Administration. 

‘‘3610. FedRAMP Board. 

‘‘3611. Independent assessment. 

‘‘3612. Declaration of foreign interests. 

‘‘3613. Roles and responsibilities of agencies. 
211 

†S 3600 ES

‘‘3614. Roles and responsibilities of the Office of Management and Budget. 

‘‘3615. Reports to Congress; GAO report. 

‘‘3616. Federal Secure Cloud Advisory Committee.’’. 

1 (c) SUNSET.— 

2 (1) IN GENERAL.—Effective on the date that is 

3 5 years after the date of enactment of this Act, 

4 chapter 36 of title 44, United States Code, is 

5 amended by striking sections 3607 through 3616. 

6 (2) CONFORMING AMENDMENT.—Effective on 

7 the date that is 5 years after the date of enactment 

8 of this Act, the table of sections for chapter 36 of 

9 title 44, United States Code, is amended by striking 

10 the items relating to sections 3607 through 3616. 

11 (d) RULE OF CONSTRUCTION.—Nothing in this sec12 tion or any amendment made by this section shall be con13 strued as altering or impairing the authorities of the Di14 rector of the Office of Management and Budget or the 

15 Secretary of Homeland Security under subchapter II of 

16 chapter 35 of title 44, United States Code. 

Passed the Senate March 1, 2022. 

Attest: 

Secretary. 
117TH CONGRESS 

2D SESSION S. 3600 

AN ACT 

To improve the cybersecurity of the Federal 

Government, and for other purposes.