H. R. 2670—856 
‘‘(b) SCOPE OF USES.—Assistance under this section may include 
programs to— 
‘‘(1) advance the adoption and deployment of secure and 
trustworthy information and communications technology (ICT) 
infrastructure and services, including efforts to grow global 
markets for secure ICT goods and services and promote a 
more diverse and resilient ICT supply chain; 
‘‘(2) provide technical and capacity building assistance to— 
‘‘(A) promote policy and regulatory frameworks that 
create an enabling environment for digital connectivity and 
a vibrant digital economy; 
‘‘(B) ensure technologies, including related new and 
emerging technologies, are developed, deployed, and used 
in ways that support and reinforce democratic values and 
human rights; 
‘‘(C) promote innovation and competition; and 
‘‘(D) support digital governance with the development 
of rights-respecting international norms and standards; 
‘‘(3) help countries prepare for, defend against, and respond 
to malicious cyber activities, including through— 
‘‘(A) the adoption of cybersecurity best practices; 
‘‘(B) the development of national strategies to enhance 
cybersecurity; 
‘‘(C) the deployment of cybersecurity tools and services 
to increase the security, strength, and resilience of net-
works and infrastructure; 
‘‘(D) support for the development of cybersecurity 
watch, warning, response, and recovery capabilities, 
including through the development of cybersecurity 
incident response teams; 
‘‘(E) support for collaboration with the Cybersecurity 
and Infrastructure Security Agency (CISA) and other rel-
evant Federal agencies to enhance cybersecurity; 
‘‘(F) programs to strengthen allied and partner govern-
ments’ capacity to detect, investigate, deter, and prosecute 
cybercrimes; 
‘‘(G) programs to provide information and resources 
to diplomats engaging in discussions and negotiations 
around international law and capacity building measures 
related to cybersecurity; 
‘‘(H) capacity building for cybersecurity partners, 
including law enforcement and military entities as 
described in subsection (f); 
‘‘(I) programs that enhance the ability of relevant 
stakeholders to act collectively against shared cybersecurity 
threats; 
‘‘(J) the advancement of programs in support of the 
Framework of Responsible State Behavior in Cyberspace; 
and 
‘‘(K) the fortification of deterrence instruments in 
cyberspace; and 
‘‘(4) such other purpose and functions as the Secretary 
of State may designate. 
‘‘(c) RESPONSIBILITY
FOR POLICY DECISIONS
AND JUSTIFICA-
TION.—The Secretary of State shall be responsible for policy 
decisions regarding programs under this chapter, with respect to—
H. R. 2670—857 
‘‘(1) whether there will be cybersecurity and digital capacity 
building programs for a foreign country or entity operating 
in that country; 
‘‘(2) the amount of funds for each foreign country or entity; 
and 
‘‘(3) the scope and nature of such uses of funding. 
‘‘(d) DETAILED JUSTIFICATION
FOR USES
AND PURPOSES
OF 
FUNDS.—The Secretary of State shall provide, on an annual basis, 
a detailed justification for the uses and purposes of the amounts 
provided under this chapter, including information concerning— 
‘‘(1) the amounts and kinds of grants; 
‘‘(2) the amounts and kinds of budgetary support provided, 
if any; and 
‘‘(3) the amounts and kinds of project assistance provided 
for what purpose and with such amounts. 
‘‘(e) ASSISTANCE AND FUNDING UNDER OTHER AUTHORITIES.— 
The authority granted under this section to provide assistance 
or funding for countries and organizations does not preclude the 
use of funds provided to carry out other authorities also available 
for such purpose. 
‘‘(f) AVAILABILITY OF FUNDS.—Amounts appropriated to carry 
out this chapter may be used, notwithstanding any other provision 
of law, to strengthen civilian cybersecurity and information and 
communications technology capacity, including participation of for-
eign law enforcement and military personnel in non-military activi-
ties, and for contributions to international organizations and inter-
national financial institutions of which the United States is a 
member, provided that such support is essential to enabling civilian 
and law enforcement of cybersecurity and information and commu-
nication technology related activities in their respective countries. 
‘‘(g) NOTIFICATION
REQUIREMENTS.—Funds made available 
under this section shall be obligated in accordance with the proce-
dures applicable to reprogramming notifications pursuant to section 
634A of this Act. 
‘‘SEC. 593. REVIEW OF EMERGENCY ASSISTANCE CAPACITY. 
‘‘(a) IN GENERAL.—The Secretary of State, in consultation as 
appropriate with other relevant Federal departments and agencies 
is authorized to conduct a review that— 
‘‘(1) analyzes the United States Government’s capacity to 
promptly and effectively deliver emergency support to countries 
experiencing major cybersecurity and ICT incidents; 
‘‘(2) identifies relevant factors constraining the support 
referred to in paragraph (1); and 
‘‘(3) develops a strategy to improve coordination among 
relevant Federal agencies and to resolve such constraints. 
‘‘(b) REPORT.—Not later than one year after the date of the 
enactment of this chapter, the Secretary of State shall submit 
to the Committee on Foreign Relations and the Committee on 
Homeland Security and Governmental Affairs of the Senate and 
the Committee on Foreign Affairs and the Committee on Oversight 
and Accountability of the House of Representatives a report that 
contains the results of the review conducted pursuant to subsection 
(a).
H. R. 2670—858 
‘‘SEC. 594. AUTHORIZATION OF APPROPRIATIONS. 
‘‘There is authorized to be appropriated $150,000,000 during 
the 5-year period beginning on October 1, 2023, to carry out the 
purposes of this chapter.’’. 
SEC. 6308. CYBER PROTECTION SUPPORT FOR PERSONNEL OF THE 
DEPARTMENT OF STATE IN POSITIONS HIGHLY VULNER-
ABLE TO CYBER ATTACK. 
(a) DEFINITIONS.—In this section: 
(1) AT-RISK
PERSONNEL.—The term ‘‘at-risk personnel’’ 
means personnel of the Department— 
(A) whom the Secretary determines to be highly vulner-
able to cyber attacks and hostile information collection 
activities because of their positions in the Department; 
and 
(B) whose personal technology devices or personal 
accounts are highly vulnerable to cyber attacks and hostile 
information collection activities. 
(2) PERSONAL ACCOUNTS.—The term ‘‘personal accounts’’ 
means accounts for online and telecommunications services, 
including telephone, residential internet access, email, text and 
multimedia messaging, cloud computing, social media, health 
care, and financial services, used by Department personnel 
outside of the scope of their employment with the Department. 
(3) PERSONAL TECHNOLOGY DEVICES.—The term ‘‘personal 
technology devices’’ means technology devices used by personnel 
of the Department outside of the scope of their employment 
with the Department, including networks to which such devices 
connect. 
(b) REQUIREMENT TO PROVIDE CYBER PROTECTION SUPPORT.— 
The Secretary, in consultation with the Secretary of Homeland 
Security and the Director of National Intelligence, as appropriate— 
(1) shall offer cyber protection support for the personal 
technology devices and personal accounts of at-risk personnel; 
and 
(2) may provide the support described in paragraph (1) 
to any Department personnel who request such support. 
(c) NATURE OF CYBER PROTECTION SUPPORT.—Subject to the 
availability of resources, the cyber protection support provided to 
personnel pursuant to subsection (b) may include training, advice, 
assistance, and other services relating to protection against cyber 
attacks and hostile information collection activities. 
(d) PRIVACY
PROTECTIONS
FOR
PERSONAL
DEVICES.—The 
Department is prohibited pursuant to this section from accessing 
or retrieving any information from any personal technology device 
or personal account of Department employees unless— 
(1) access or information retrieval is necessary for carrying 
out the cyber protection support specified in this section; and 
(2) the Department has received explicit consent from the 
employee to access a personal technology device or personal 
account prior to each time such device or account is accessed. 
(e) RULE OF CONSTRUCTION.—Nothing in this section may be 
construed— 
(1) to encourage Department personnel to use personal 
technology devices for official business; or
H. R. 2670—859 
(2) to authorize cyber protection support for senior Depart-
ment personnel using personal devices, networks, and personal 
accounts in an official capacity. 
(f) REPORT.— 
(1) IN GENERAL.—Not later than 180 days after the date 
of the enactment of this division, the Secretary shall submit 
to the appropriate committees of Congress a report regarding 
the provision of cyber protection support pursuant to subsection 
(b), which shall include— 
(A) a description of the methodology used to make 
the determination under subsection (a)(1); and 
(B) guidance for the use of cyber protection support 
and tracking of support requests for personnel receiving 
cyber protection support pursuant to subsection (b). 
(2) APPROPRIATE COMMITTEES OF CONGRESS DEFINED.—In 
this subsection, the term ‘‘appropriate committees of Congress’’ 
means— 
(A) the appropriate congressional committees; 
(B) the Select Committee on Intelligence and the Com-
mittee on Homeland Security and Governmental Affairs 
of the Senate; and 
(C) the Permanent Select Committee on Intelligence 
and the Committee on Oversight and Accountability of 
the House of Representatives. 
SEC. 6309. IMPLEMENTATION OF GAO HIGH RISK LIST RECOMMENDA-
TIONS. 
(a) IN GENERAL.—The Secretary shall implement the Govern-
ment Accountability Office’s High Risk List recommendations as 
applicable to the Department for the following activities: 
(1) Improving the management of IT acquisitions and oper-
ations. 
(2) Improving strategic human capital management. 
(3) Managing Federal real property. 
(4) Ensuring the cybersecurity of the nation. 
(5) Managing government-wide personnel security clear-
ance process. 
(b) REPORT.—Not later than 90 days after the date of the 
enactment of this division, the Secretary shall submit to the appro-
priate congressional committees a report on the Department’s 
progress in implementing all of the Government Accountability 
Office’s High Risk List recommendations as applicable to the 
Department described in subsection (a). 
(c) HIGH RISK LIST DEFINED.—In this section, the term ‘‘High 
Risk List’’ refers to GAO–23–106203, the April 20, 2023, report 
by the Government Accountability Office titled, ‘‘High-Risk Series: 
Efforts Made to Achieve Progress Need to Be Maintained and 
Expanded to Fully Address All Areas’’. 
TITLE LXIV—ORGANIZATION AND 
OPERATIONS 
SEC. 6401. PERSONAL SERVICES CONTRACTORS. 
(a) SENSE
OF CONGRESS.—It is the sense of Congress that 
the Department should seek to ensure it has sufficient full-time 
equivalent positions allotted to carry out its current mission,