HR 1560 RDS
whether and how such relationships could be 
improved. 
(2) A list and an assessment of the countries 
and non-state actors that are the primary threats of 
carrying out a cybersecurity threat (including a 
cyber attack, theft, or data breach) against the 
United States and that threaten the United States 
national security, economy, and intellectual property. 
(3) A description of the extent to which the ca-
pabilities of the United States Government to re-
spond to or prevent cybersecurity threats (including 
cyber attacks, theft, or data breaches) directed 
against the United States private sector are de-
graded by a delay in the prompt notification by pri-
vate entities of such threats or cyber attacks, theft, 
and breaches. 
(4) An assessment of additional technologies or 
capabilities that would enhance the ability of the 
United States to prevent and to respond to cyberse-
curity threats (including cyber attacks, theft, and 
data breaches). 
(5) An assessment of any technologies or prac-
tices utilized by the private sector that could be rap-
idly fielded to assist the intelligence community in 
preventing and responding to cybersecurity threats. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(c) FORM OF REPORT.—The report required by sub-
section (a) shall be submitted in unclassified form, but 
may include a classified annex. 
(d) PUBLIC AVAILABILITY OF REPORT.—The Direc-
tor of National Intelligence shall make publicly available 
the unclassified portion of the report required by sub-
section (a). 
(e) INTELLIGENCE COMMUNITY DEFINED.—In this 
section, the term ‘‘intelligence community’’ has the mean-
ing given that term in section 3 of the National Security 
Act of 1947 (50 U.S.C. 3003). 
SEC. 109. CONSTRUCTION AND PREEMPTION. 
(a) PROHIBITION OF SURVEILLANCE.—Nothing in 
this title or the amendments made by this title shall be 
construed to authorize the Department of Defense or the 
National Security Agency or any other element of the in-
telligence community to target a person for surveillance. 
(b) OTHERWISE LAWFUL DISCLOSURES.—Nothing in 
this title or the amendments made by this title shall be 
construed to limit or prohibit— 
(1) otherwise lawful disclosures of communica-
tions, records, or other information, including re-
porting of known or suspected criminal activity, by 
a non-Federal entity to any other non-Federal entity 
or the Federal Government; or 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(2) any otherwise lawful use of such disclosures 
by any entity of the Federal Government, without 
regard to whether such otherwise lawful disclosures 
duplicate or replicate disclosures made under this 
title. 
(c) WHISTLE BLOWER PROTECTIONS.—Nothing in 
this title or the amendments made by this title shall be 
construed to prohibit or limit the disclosure of information 
protected under section 2302(b)(8) of title 5, United 
States Code (governing disclosures of illegality, waste, 
fraud, abuse, or public health or safety threats), section 
7211 of title 5, United States Code (governing disclosures 
to Congress), section 1034 of title 10, United States Code 
(governing disclosure to Congress by members of the mili-
tary), or any similar provision of Federal or State law. 
(d) PROTECTION
OF SOURCES
AND METHODS.— 
Nothing in this title or the amendments made by this title 
shall be construed— 
(1) as creating any immunity against, or other-
wise affecting, any action brought by the Federal 
Government, or any department or agency thereof, 
to enforce any law, Executive order, or procedure 
governing the appropriate handling, disclosure, or 
use of classified information; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(2) to affect the conduct of authorized law en-
forcement or intelligence activities; or 
(3) to modify the authority of the President or 
a department or agency of the Federal Government 
to protect and control the dissemination of classified 
information, intelligence sources and methods, and 
the national security of the United States. 
(e) RELATIONSHIP TO OTHER LAWS.—Nothing in 
this title or the amendments made by this title shall be 
construed to affect any requirement under any other pro-
vision of law for a non-Federal entity to provide informa-
tion to the Federal Government. 
(f) INFORMATION SHARING RELATIONSHIPS.—Noth-
ing in this title or the amendments made by this title shall 
be construed— 
(1) to limit or modify an existing information- 
sharing relationship; 
(2) to prohibit a new information-sharing rela-
tionship; or 
(3) to require a new information-sharing rela-
tionship between any non-Federal entity and the 
Federal Government. 
(g) PRESERVATION OF CONTRACTUAL OBLIGATIONS 
AND RIGHTS.—Nothing in this title or the amendments 
made by this title shall be construed— 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(1) to amend, repeal, or supersede any current 
or future contractual agreement, terms of service 
agreement, or other contractual relationship between 
any non-Federal entities, or between any non-Fed-
eral entity and a Federal entity; or 
(2) to abrogate trade secret or intellectual prop-
erty rights of any non-Federal entity or Federal 
entity. 
(h) ANTI-TASKING RESTRICTION.—Nothing in this 
title or the amendments made by this title shall be con-
strued to permit the Federal Government— 
(1) to require a non-Federal entity to provide 
information to the Federal Government; 
(2) to condition the sharing of a cyber threat 
indicator with a non-Federal entity on such non- 
Federal entity’s provision of a cyber threat indicator 
to the Federal Government; or 
(3) to condition the award of any Federal 
grant, contract, or purchase on the provision of a 
cyber threat indicator to a Federal entity. 
(i) NO LIABILITY FOR NON-PARTICIPATION.—Noth-
ing in this title or the amendments made by this title shall 
be construed to subject any non-Federal entity to liability 
for choosing not to engage in a voluntary activity author-
ized in this title and the amendments made by this title. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(j) USE AND RETENTION OF INFORMATION.—Noth-
ing in this title or the amendments made by this title shall 
be construed to authorize, or to modify any existing au-
thority of, a department or agency of the Federal Govern-
ment to retain or use any information shared under this 
title or the amendments made by this title for any use 
other than permitted in this title or the amendments made 
by this title. 
(k) FEDERAL PREEMPTION.— 
(1) IN GENERAL.—This title and the amend-
ments made by this title supersede any statute or 
other provision of law of a State or political subdivi-
sion of a State that restricts or otherwise expressly 
regulates an activity authorized under this title or 
the amendments made by this title. 
(2) STATE
LAW
ENFORCEMENT.—Nothing in 
this title or the amendments made by this title shall 
be construed to supersede any statute or other provi-
sion of law of a State or political subdivision of a 
State concerning the use of authorized law enforce-
ment practices and procedures. 
(3) STATE REGULATION OF UTILITIES.—Except 
as provided by section 103(d)(4)(B), nothing in this 
title or the amendments made by this title shall be 
construed to supersede any statute, regulation, or 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
other provision of law of a State or political subdivi-
sion of a State relating to the regulation of a private 
entity performing utility services, except to the ex-
tent such statute, regulation, or other provision of 
law restricts activity authorized under this title or 
the amendments made by this title. 
(l) REGULATORY AUTHORITY.—Nothing in this title 
or the amendments made by this title shall be construed— 
(1) to authorize the promulgation of any regu-
lations not specifically authorized by this title or the 
amendments made by this title; 
(2) to establish any regulatory authority not 
specifically established under this title or the amend-
ments made by this title; or 
(3) to authorize regulatory actions that would 
duplicate or conflict with regulatory requirements, 
mandatory standards, or related processes under an-
other provision of Federal law. 
SEC. 110. DEFINITIONS. 
In this title: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given the term in section 3502 of title 44, 
United States Code. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(2) APPROPRIATE
FEDERAL
ENTITIES.—The 
term ‘‘appropriate Federal entities’’ means the fol-
lowing: 
(A) The Department of Commerce. 
(B) The Department of Defense. 
(C) The Department of Energy. 
(D) The Department of Homeland Secu-
rity. 
(E) The Department of Justice. 
(F) The Department of the Treasury. 
(G) The Office of the Director of National 
Intelligence. 
(3) CYBERSECURITY PURPOSE.—The term ‘‘cy-
bersecurity purpose’’ means the purpose of pro-
tecting (including through the use of a defensive 
measure) an information system or information that 
is stored on, processed by, or transiting an informa-
tion system from a cybersecurity threat or security 
vulnerability or identifying the source of a cyberse-
curity threat. 
(4) CYBERSECURITY THREAT.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘cybersecurity 
threat’’ means an action, not protected by the 
first amendment to the Constitution of the 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
United States, on or through an information 
system that may result in an unauthorized ef-
fort to adversely impact the security, confiden-
tiality, integrity, or availability of an informa-
tion system or information that is stored on, 
processed by, or transiting an information sys-
tem. 
(B) EXCLUSION.—The term ‘‘cybersecurity 
threat’’ does not include any action that solely 
involves a violation of a consumer term of serv-
ice or a consumer licensing agreement. 
(5) CYBER
THREAT
INDICATOR.—The term 
‘‘cyber threat indicator’’ means information or a 
physical object that is necessary to describe or iden-
tify— 
(A) malicious reconnaissance, including 
anomalous patterns of communications that ap-
pear to be transmitted for the purpose of gath-
ering technical information related to a cyberse-
curity threat or security vulnerability; 
(B) a method of defeating a security con-
trol or exploitation of a security vulnerability; 
(C) a security vulnerability, including 
anomalous activity that appears to indicate the 
existence of a security vulnerability; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(D) a method of causing a user with legiti-
mate access to an information system or infor-
mation that is stored on, processed by, or 
transiting an information system to unwittingly 
enable the defeat of a security control or exploi-
tation of a security vulnerability; 
(E) malicious cyber command and control; 
(F) the actual or potential harm caused by 
an incident, including a description of the infor-
mation exfiltrated as a result of a particular cy-
bersecurity threat; or 
(G) any other attribute of a cybersecurity 
threat, if disclosure of such attribute is not oth-
erwise prohibited by law. 
(6) DEFENSIVE MEASURE.—The term ‘‘defen-
sive measure’’ means an action, device, procedure, 
technique, or other measure executed on an informa-
tion system or information that is stored on, proc-
essed by, or transiting an information system that 
prevents or mitigates a known or suspected cyberse-
curity threat or security vulnerability. 
(7) FEDERAL ENTITY.—The term ‘‘Federal en-
tity’’ means a department or agency of the United 
States or any component of such department or 
agency. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(8) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’— 
(A) has the meaning given the term in sec-
tion 3502 of title 44, United States Code; and 
(B) includes industrial control systems, 
such as supervisory control and data acquisition 
systems, distributed control systems, and pro-
grammable logic controllers. 
(9) LOCAL
GOVERNMENT.—The term ‘‘local 
government’’ means any borough, city, county, par-
ish, town, township, village, or other political sub-
division of a State. 
(10) MALICIOUS
CYBER
COMMAND
AND
CON-
TROL.—The term ‘‘malicious cyber command and 
control’’ means a method for unauthorized remote 
identification of, access to, or use of, an information 
system or information that is stored on, processed 
by, or transiting an information system. 
(11) MALICIOUS RECONNAISSANCE.—The term 
‘‘malicious reconnaissance’’ means a method for ac-
tively probing or passively monitoring an information 
system for the purpose of discerning security 
vulnerabilities of the information system, if such 
method is associated with a known or suspected cy-
bersecurity threat. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(12) MONITOR.—The term ‘‘monitor’’ means to 
acquire, identify, scan, or otherwise possess informa-
tion that is stored on, processed by, or transiting an 
information system. 
(13) NON-FEDERAL ENTITY.— 
(A) IN
GENERAL.—Except as otherwise 
provided in this paragraph, the term ‘‘non-Fed-
eral entity’’ means any private entity, non-Fed-
eral Government department or agency, or 
State, tribal, or local government (including a 
political subdivision, department, officer, em-
ployee, or agent thereof). 
(B) INCLUSIONS.—The term ‘‘non-Federal 
entity’’ includes a government department or 
agency (including an officer, employee, or agent 
thereof) of the District of Columbia, the Com-
monwealth of Puerto Rico, the Virgin Islands, 
Guam, American Samoa, the Northern Mariana 
Islands, and any other territory or possession of 
the United States. 
(C) EXCLUSION.—The term ‘‘non-Federal 
entity’’ does not include a foreign power or 
known agent of a foreign power, as both terms 
are defined in section 101 of the Foreign Intel-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
ligence Surveillance Act of 1978 (50 U.S.C. 
1801). 
(14) PRIVATE ENTITY.— 
(A) IN
GENERAL.—Except as otherwise 
provided in this paragraph, the term ‘‘private 
entity’’ means any person or private group, or-
ganization, proprietorship, partnership, trust, 
cooperative, corporation, or other commercial or 
nonprofit entity, including an officer, employee, 
or agent thereof. 
(B) INCLUSION.—The term ‘‘private enti-
ty’’ includes a component of a State, tribal, or 
local government performing utility services. 
(C) EXCLUSION.—The term ‘‘private enti-
ty’’ does not include a foreign power as defined 
in section 101 of the Foreign Intelligence Sur-
veillance Act of 1978 (50 U.S.C. 1801). 
(15) REAL TIME; REAL-TIME.—The terms ‘‘real 
time’’ and ‘‘real-time’’ mean a process by which an 
automated, machine-to-machine system processes 
cyber threat indicators such that the time in which 
the occurrence of an event and the reporting or re-
cording of it are as simultaneous as technologically 
and operationally practicable. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(16) SECURITY CONTROL.—The term ‘‘security 
control’’ means the management, operational, and 
technical controls used to protect against an unau-
thorized effort to adversely impact the security, con-
fidentiality, integrity, and availability of an informa-
tion system or its information. 
(17) SECURITY
VULNERABILITY.—The term 
‘‘security vulnerability’’ means any attribute of hard-
ware, software, process, or procedure that could en-
able or facilitate the defeat of a security control. 
(18) TRIBAL.—The term ‘‘tribal’’ has the 
meaning given the term ‘‘Indian tribe’’ in section 4 
of the Indian Self-Determination and Education As-
sistance Act (25 U.S.C. 450b). 
SEC. 111. COMPTROLLER GENERAL REPORT ON REMOVAL 
OF PERSONAL IDENTIFYING INFORMATION. 
(a) REPORT.—Not later than 3 years after the date 
of the enactment of this title, the Comptroller General of 
the United States shall submit to Congress a report on 
the actions taken by the Federal Government to remove 
personal information from cyber threat indicators pursu-
ant to section 104(b). 
(b) FORM.—The report under subsection (a) shall be 
submitted in unclassified form, but may include a classi-
fied annex. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
SEC. 112. SUNSET. 
This title and the amendments made by this title 
shall terminate on the date that is 7 years after the date 
of the enactment of this title. 
TITLE II—NATIONAL CYBERSE-
CURITY 
PROTECTION 
AD-
VANCEMENT ACT 
SEC. 201. SHORT TITLE. 
This title may be cited as the ‘‘National Cybersecu-
rity Protection Advancement Act of 2015’’. 
SEC. 202. NATIONAL CYBERSECURITY AND COMMUNICA-
TIONS INTEGRATION CENTER. 
(a) IN GENERAL.—Subsection (a) of the second sec-
tion 226 of the Homeland Security Act of 2002 (6 U.S.C. 
148; relating to the National Cybersecurity and Commu-
nications Integration Center) is amended— 
(1) by amending paragraph (1) to read as fol-
lows: 
‘‘(1)(A) except as provided in subparagraph 
(B), the term ‘cybersecurity risk’ means threats to 
and vulnerabilities of information or information sys-
tems and any related consequences caused by or re-
sulting from unauthorized access, use, disclosure, 
degradation, disruption, modification, or destruction 
of such information or information systems, includ-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
ing such related consequences caused by an act of 
terrorism; 
‘‘(B) such term does not include any action that 
solely involves a violation of a consumer term of 
service or a consumer licensing agreement;’’. 
(2) by amending paragraph (2) to read as fol-
lows: 
‘‘(2) the term ‘incident’ means an occurrence 
that actually or imminently jeopardizes, without law-
ful authority, the integrity, confidentiality, or avail-
ability of information on an information system, or 
actually or imminently jeopardizes, without lawful 
authority, an information system;’’. 
(3) in paragraph (3), by striking ‘‘and’’ at the 
end; 
(4) in paragraph (4), by striking the period at 
the end and inserting ‘‘; and’’; and 
(5) by adding at the end the following new 
paragraphs: 
‘‘(5) the term ‘cyber threat indicator’ means 
technical information that is necessary to describe or 
identify— 
‘‘(A) a method for probing, monitoring, 
maintaining, or establishing network awareness 
of an information system for the purpose of dis-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
cerning technical vulnerabilities of such infor-
mation system, if such method is known or rea-
sonably suspected of being associated with a 
known or suspected cybersecurity risk, includ-
ing communications that reasonably appear to 
be transmitted for the purpose of gathering 
technical information related to a cybersecurity 
risk; 
‘‘(B) a method for defeating a technical or 
security control of an information system; 
‘‘(C) a technical vulnerability, including 
anomalous technical behavior that may become 
a vulnerability; 
‘‘(D) a method of causing a user with le-
gitimate access to an information system or in-
formation that is stored on, processed by, or 
transiting an information system to inadvert-
ently enable the defeat of a technical or oper-
ational control; 
‘‘(E) a method for unauthorized remote 
identification of, access to, or use of an infor-
mation system or information that is stored on, 
processed by, or transiting an information sys-
tem that is known or reasonably suspected of 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
being associated with a known or suspected cy-
bersecurity risk; 
‘‘(F) the actual or potential harm caused 
by a cybersecurity risk, including a description 
of the information exfiltrated as a result of a 
particular cybersecurity risk; 
‘‘(G) any other attribute of a cybersecurity 
risk that cannot be used to identify specific per-
sons reasonably believed to be unrelated to such 
cybersecurity risk, if disclosure of such at-
tribute is not otherwise prohibited by law; or 
‘‘(H) any combination of subparagraphs 
(A) through (G); 
‘‘(6) the term ‘cybersecurity purpose’ means the 
purpose of protecting an information system or in-
formation that is stored on, processed by, or 
transiting an information system from a cybersecu-
rity risk or incident, or the purpose of identifying 
the source of a cybersecurity risk or incident; 
‘‘(7)(A) except as provided in subparagraph 
(B), the term ‘defensive measure’ means an action, 
device, procedure, signature, technique, or other 
measure applied to an information system or infor-
mation that is stored on, processed by, or transiting 
an information system that detects, prevents, or 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
mitigates a known or suspected cybersecurity risk or 
incident, or any attribute of hardware, software, 
process, or procedure that could enable or facilitate 
the defeat of a security control; 
‘‘(B) such term does not include a measure that 
destroys, renders unusable, or substantially harms 
an information system or data on an information 
system not belonging to— 
‘‘(i) the non-Federal entity, not including a 
State, local, or tribal government, operating 
such measure; or 
‘‘(ii) another Federal entity or non-Federal 
entity that is authorized to provide consent and 
has provided such consent to the non-Federal 
entity referred to in clause (i); 
‘‘(8) the term ‘network awareness’ means to 
scan, identify, acquire, monitor, log, or analyze in-
formation that is stored on, processed by, or 
transiting an information system; 
‘‘(9)(A) the term ‘private entity’ means a non- 
Federal entity that is an individual or private group, 
organization, proprietorship, partnership, trust, co-
operative, corporation, or other commercial or non- 
profit entity, including an officer, employee, or agent 
thereof; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(B) such term includes a component of a 
State, local, or tribal government performing utility 
services or an entity performing utility services; 
‘‘(10) the term ‘security control’ means the 
management, operational, and technical controls 
used to protect against an unauthorized effort to ad-
versely affect the confidentially, integrity, or avail-
ability of an information system or information that 
is stored on, processed by, or transiting an informa-
tion system; and 
‘‘(11) the term ‘sharing’ (including all conjuga-
tions thereof) means providing, receiving, and dis-
seminating (including all conjugations of each of 
such terms).’’. 
(b) AMENDMENT.—Subparagraph (B) of subsection 
(d)(1) of such second section 226 of the Homeland Secu-
rity Act of 2002 is amended— 
(1) in clause (i), by striking ‘‘and local’’ and in-
serting ‘‘, local, and tribal’’; 
(2) in clause (ii)— 
(A) by inserting ‘‘, including information 
sharing and analysis centers’’ before the semi-
colon; and 
(B) by striking ‘‘and’’ at the end; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(3) in clause (iii), by inserting ‘‘and’’ after the 
semicolon at the end; and 
(4) by adding at the end the following new 
clause: 
‘‘(iv) private entities;’’. 
SEC. 203. INFORMATION SHARING STRUCTURE AND PROC-
ESSES. 
The second section 226 of the Homeland Security Act 
of 2002 (6 U.S.C. 148; relating to the National Cyberse-
curity and Communications Integration Center) is amend-
ed— 
(1) in subsection (c)— 
(A) in paragraph (1)— 
(i) by striking ‘‘a Federal civilian 
interface’’ and inserting ‘‘the lead Federal 
civilian interface’’; and 
(ii) by striking ‘‘cybersecurity risks,’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
(B) in paragraph (3), by striking ‘‘cyberse-
curity risks’’ and inserting ‘‘cyber threat indica-
tors, defensive measures, cybersecurity risks,’’; 
(C) in paragraph (5)(A), by striking ‘‘cy-
bersecurity risks’’ and inserting ‘‘cyber threat 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
indicators, defensive measures, cybersecurity 
risks,’’; 
(D) in paragraph (6)— 
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
and 
(ii) by striking ‘‘and’’ at the end; 
(E) in paragraph (7)— 
(i) in subparagraph (A), by striking 
‘‘and’’ at the end; 
(ii) in subparagraph (B), by striking 
the period at the end and inserting ‘‘; 
and’’; and 
(iii) by adding at the end the fol-
lowing new subparagraph: 
‘‘(C) sharing cyber threat indicators and 
defensive measures;’’; and 
(F) by adding at the end the following new 
paragraphs: 
‘‘(8) engaging with international partners, in 
consultation with other appropriate agencies, to— 
‘‘(A) collaborate on cyber threat indicators, 
defensive measures, and information related to 
cybersecurity risks and incidents; and 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(B) enhance the security and resilience of 
global cybersecurity; 
‘‘(9) sharing cyber threat indicators, defensive 
measures, and other information related to cyberse-
curity risks and incidents with Federal and non-Fed-
eral entities, including across sectors of critical in-
frastructure and with State and major urban area 
fusion centers, as appropriate; 
‘‘(10) promptly notifying the Secretary and the 
Committee on Homeland Security of the House of 
Representatives and the Committee on Homeland 
Security and Governmental Affairs of the Senate of 
any significant violations of the policies and proce-
dures specified in subsection (i)(6)(A); 
‘‘(11) promptly notifying non-Federal entities 
that have shared cyber threat indicators or defensive 
measures that are known or determined to be in 
error or in contravention of the requirements of this 
section; and 
‘‘(12) participating, as appropriate, in exercises 
run by the Department’s National Exercise Pro-
gram.’’; 
(2) in subsection (d)(1)— 
(A) in subparagraph (D), by striking 
‘‘and’’ at the end; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(B) by redesignating subparagraph (E) as 
subparagraph (J); and 
(C) by inserting after subparagraph (D) 
the following new subparagraphs: 
‘‘(E) an entity that collaborates with State 
and local governments on cybersecurity risks 
and incidents, and has entered into a voluntary 
information sharing relationship with the Cen-
ter; 
‘‘(F) a United States Computer Emer-
gency Readiness Team that coordinates infor-
mation related to cybersecurity risks and inci-
dents, proactively and collaboratively addresses 
cybersecurity risks and incidents to the United 
States, collaboratively responds to cybersecurity 
risks and incidents, provides technical assist-
ance, upon request, to information system own-
ers and operators, and shares cyber threat indi-
cators, defensive measures, analysis, or infor-
mation related to cybersecurity risks and inci-
dents in a timely manner; 
‘‘(G) the Industrial Control System Cyber 
Emergency Response Team that— 
‘‘(i) coordinates with industrial con-
trol systems owners and operators; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(ii) provides training, upon request, 
to Federal entities and non-Federal enti-
ties on industrial control systems cyberse-
curity; 
‘‘(iii) collaboratively addresses cyber-
security risks and incidents to industrial 
control systems; 
‘‘(iv) provides technical assistance, 
upon request, to Federal entities and non- 
Federal entities relating to industrial con-
trol systems cybersecurity; 
‘‘(v) shares cyber threat indicators, 
defensive measures, or information related 
to cybersecurity risks and incidents of in-
dustrial control systems in a timely fash-
ion; and 
‘‘(vi) remains current on industrial 
control system innovation; industry adop-
tion of new technologies, and industry best 
practices; 
‘‘(H) a National Coordinating Center for 
Communications that coordinates the protec-
tion, response, and recovery of emergency com-
munications; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
cidents with small and medium-sized busi-
nesses, as appropriate, and, to the extent prac-
ticable, make self-assessment tools available to 
such businesses to determine their levels of pre-
vention of cybersecurity risks; and 
‘‘(I) the Center designates an agency con-
tact for non-Federal entities;’’; 
(B) in paragraph (2)— 
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
and 
(ii) by inserting ‘‘or disclosure’’ before 
the semicolon at the end; and 
(C) in paragraph (3), by inserting before 
the period at the end the following: ‘‘, including 
by working with the Chief Privacy Officer ap-
pointed under section 222 to ensure that the 
Center follows the policies and procedures speci-
fied in subsection (i)(6)(A)’’; and 
(4) by adding at the end the following new sub-
sections: 
‘‘(g) RAPID AUTOMATED SHARING.— 
‘‘(1) IN GENERAL.—The Under Secretary for 
Cybersecurity and Infrastructure Protection, in co-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
ordination with industry and other stakeholders, 
shall develop capabilities making use of existing in-
formation technology industry standards and best 
practices, as appropriate, that support and rapidly 
advance the development, adoption, and implementa-
tion of automated mechanisms for the timely sharing 
of cyber threat indicators and defensive measures to 
and from the Center and with each Federal agency 
designated as the ‘Sector Specific Agency’ for each 
critical infrastructure sector in accordance with sub-
section (h). 
‘‘(2) BIANNUAL
REPORT.—The Under Sec-
retary for Cybersecurity and Infrastructure Protec-
tion shall submit to the Committee on Homeland Se-
curity of the House of Representatives and the Com-
mittee on Homeland Security and Governmental Af-
fairs of the Senate a biannual report on the status 
and progress of the development of the capability de-
scribed in paragraph (1). Such reports shall be re-
quired until such capability is fully implemented. 
‘‘(h) SECTOR SPECIFIC AGENCIES.—The Secretary, 
in collaboration with the relevant critical infrastructure 
sector and the heads of other appropriate Federal agen-
cies, shall recognize the Federal agency designated as of 
March 25, 2015, as the ‘Sector Specific Agency’ for each 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
critical infrastructure sector designated in the Depart-
ment’s National Infrastructure Protection Plan. If the 
designated Sector Specific Agency for a particular critical 
infrastructure sector is the Department, for purposes of 
this section, the Secretary is deemed to be the head of 
such Sector Specific Agency and shall carry out this sec-
tion. The Secretary, in coordination with the heads of each 
such Sector Specific Agency, shall— 
‘‘(1) support the security and resilience actives 
of the relevant critical infrastructure sector in ac-
cordance with this section; 
‘‘(2) provide institutional knowledge, specialized 
expertise, and technical assistance upon request to 
the relevant critical infrastructure sector; and 
‘‘(3) support the timely sharing of cyber threat 
indicators and defensive measures with the relevant 
critical infrastructure sector with the Center in ac-
cordance with this section. 
‘‘(i) VOLUNTARY INFORMATION SHARING PROCE-
DURES.— 
‘‘(1) PROCEDURES.— 
‘‘(A) IN GENERAL.—The Center may enter 
into a voluntary information sharing relation-
ship with any consenting non-Federal entity for 
the sharing of cyber threat indicators and de-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
fensive measures for cybersecurity purposes in 
accordance with this section. Nothing in this 
section may be construed to require any non- 
Federal entity to enter into any such informa-
tion sharing relationship with the Center or any 
other entity. The Center may terminate a vol-
untary information sharing relationship under 
this subsection, at the sole and unreviewable 
discretion of the Secretary, acting through the 
Under Secretary for Cybersecurity and Infra-
structure Protection, if the Center determines 
that the non-Federal entity with which the Cen-
ter has entered into such a relationship has, 
after repeated notice, repeatedly violated the 
terms of this subsection. 
‘‘(B) NATIONAL
SECURITY.—The Sec-
retary may decline to enter into a voluntary in-
formation sharing relationship under this sub-
section, at the sole and unreviewable discretion 
of the Secretary, acting through the Under Sec-
retary for Cybersecurity and Infrastructure 
Protection, if the Secretary determines that 
such is appropriate for national security. 
‘‘(2) VOLUNTARY INFORMATION SHARING RELA-
TIONSHIPS.—A voluntary information sharing rela-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
tionship under this subsection may be characterized 
as an agreement described in this paragraph. 
‘‘(A) STANDARD
AGREEMENT.—For the 
use of a non-Federal entity, the Center shall 
make available a standard agreement, con-
sistent with this section, on the Department’s 
website. 
‘‘(B) NEGOTIATED
AGREEMENT.—At the 
request of a non-Federal entity, and if deter-
mined appropriate by the Center, at the sole 
and unreviewable discretion of the Secretary, 
acting through the Under Secretary for Cyber-
security and Infrastructure Protection, the De-
partment shall negotiate a non-standard agree-
ment, consistent with this section. 
‘‘(C) EXISTING AGREEMENTS.—An agree-
ment between the Center and a non-Federal en-
tity that is entered into before the date of the 
enactment of this section, or such an agreement 
that is in effect before such date, shall be 
deemed in compliance with the requirements of 
this subsection, notwithstanding any other pro-
vision or requirement of this subsection. An 
agreement under this subsection shall include 
the relevant privacy protections as in effect 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
under the Cooperative Research and Develop-
ment Agreement for Cybersecurity Information 
Sharing and Collaboration, as of December 31, 
2014. Nothing in this subsection may be con-
strued to require a non-Federal entity to enter 
into either a standard or negotiated agreement 
to be in compliance with this subsection. 
‘‘(3) 
INFORMATION
SHARING
AUTHORIZA-
TION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B), and notwithstanding any 
other provision of law, a non-Federal entity 
may, for cybersecurity purposes, share cyber 
threat indicators or defensive measures ob-
tained on its own information system, or on an 
information system of another Federal entity or 
non-Federal entity, upon written consent of 
such other Federal entity or non-Federal entity 
or an authorized representative of such other 
Federal entity or non-Federal entity in accord-
ance with this section with— 
‘‘(i) another non-Federal entity; or 
‘‘(ii) the Center, as provided in this 
section. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(B) LAWFUL RESTRICTION.—A non-Fed-
eral entity receiving a cyber threat indicator or 
defensive measure from another Federal entity 
or non-Federal entity shall comply with other-
wise lawful restrictions placed on the sharing or 
use of such cyber threat indicator or defensive 
measure by the sharing Federal entity or non- 
Federal entity. 
‘‘(C) REMOVAL
OF
INFORMATION
UNRE-
LATED
TO
CYBERSECURITY
RISKS
OR
INCI-
DENTS.—Federal entities and non-Federal enti-
ties shall, prior to such sharing, take reasonable 
efforts to remove or exclude information that 
can be used to identify specific persons and is 
reasonably believed at the time of sharing to be 
unrelated to a cybersecurity risk or incident and 
to safeguard information that can be used to 
identify specific persons from unintended disclo-
sure or unauthorized access or acquisition. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) limit or modify an existing infor-
mation sharing relationship; 
‘‘(ii) prohibit a new information shar-
ing relationship; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(iii) require a new information shar-
ing relationship between any non-Federal 
entity and a Federal entity; 
‘‘(iv) limit otherwise lawful activity; or 
‘‘(v) in any manner impact or modify 
procedures in existence as of the date of 
the enactment of this section for reporting 
known or suspected criminal activity to ap-
propriate law enforcement authorities or 
for participating voluntarily or under legal 
requirement in an investigation. 
‘‘(E) COORDINATED VULNERABILITY DIS-
CLOSURE.—The Under Secretary for Cyberse-
curity and Infrastructure Protection, in coordi-
nation with industry and other stakeholders, 
shall develop, publish, and adhere to policies 
and procedures for coordinating vulnerability 
disclosures, to the extent practicable, consistent 
with international standards in the information 
technology industry. 
‘‘(4) NETWORK AWARENESS AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
may, for cybersecurity purposes, conduct net-
work awareness of— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity, upon written consent 
of such other non-Federal entity for con-
ducting such network awareness to protect 
the rights or property of such other non- 
Federal entity; 
‘‘(iii) an information system of a Fed-
eral entity, upon written consent of an au-
thorized representative of such Federal en-
tity for conducting such network awareness 
to protect the rights or property of such 
Federal entity; or 
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) authorize conducting network 
awareness of an information system, or the 
use of any information obtained through 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
such conducting of network awareness, 
other than as provided in this section; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(5) DEFENSIVE MEASURE AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B) and notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
may, for cybersecurity purposes, operate a de-
fensive measure that is applied to— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity upon written consent of 
such other non-Federal entity for operation 
of such defensive measure to protect the 
rights or property of such other non-Fed-
eral entity; 
‘‘(iii) an information system of a Fed-
eral entity upon written consent of an au-
thorized representative of such Federal en-
tity for operation of such defensive meas-
ure to protect the rights or property of 
such Federal entity; or 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) authorize the use of a defensive 
measure other than as provided in this sec-
tion; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(6) PRIVACY AND CIVIL LIBERTIES PROTEC-
TIONS.— 
‘‘(A) POLICIES AND PROCEDURES.— 
‘‘(i) IN GENERAL.—The Under Sec-
retary for Cybersecurity and Infrastructure 
Protection shall, in coordination with the 
Chief Privacy Officer and the Chief Civil 
Rights and Civil Liberties Officer of the 
Department, establish and annually review 
policies and procedures governing the re-
ceipt, retention, use, and disclosure of 
cyber threat indicators, defensive meas-
ures, and information related to cybersecu-
rity risks and incidents shared with the 
Center in accordance with this section. 
Such policies and procedures shall apply 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
only to the Department, consistent with 
the need to protect information systems 
from cybersecurity risks and incidents and 
mitigate cybersecurity risks and incidents 
in a timely manner, and shall— 
‘‘(I) be consistent with the De-
partment’s Fair Information Practice 
Principles developed pursuant to sec-
tion 552a of title 5, United States 
Code (commonly referred to as the 
‘Privacy Act of 1974’ or the ‘Privacy 
Act’), and subject to the Secretary’s 
authority under subsection (a)(2) of 
section 222 of this Act; 
‘‘(II) reasonably limit, to the 
greatest extent practicable, the re-
ceipt, retention, use, and disclosure of 
cyber threat indicators and defensive 
measures associated with specific per-
sons that is not necessary, for cyber-
security purposes, to protect a net-
work or information system from cy-
bersecurity risks or mitigate cyberse-
curity risks and incidents in a timely 
manner; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS