cidents with small and medium-sized busi-
nesses, as appropriate, and, to the extent prac-
ticable, make self-assessment tools available to 
such businesses to determine their levels of pre-
vention of cybersecurity risks; and 
‘‘(I) the Center designates an agency con-
tact for non-Federal entities;’’; 
(B) in paragraph (2)— 
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
and 
(ii) by inserting ‘‘or disclosure’’ before 
the semicolon at the end; and 
(C) in paragraph (3), by inserting before 
the period at the end the following: ‘‘, including 
by working with the Chief Privacy Officer ap-
pointed under section 222 to ensure that the 
Center follows the policies and procedures speci-
fied in subsection (i)(6)(A)’’; and 
(4) by adding at the end the following new sub-
sections: 
‘‘(g) RAPID AUTOMATED SHARING.— 
‘‘(1) IN GENERAL.—The Under Secretary for 
Cybersecurity and Infrastructure Protection, in co-
ordination with industry and other stakeholders, 
shall develop capabilities making use of existing in-
formation technology industry standards and best 
practices, as appropriate, that support and rapidly 
advance the development, adoption, and implementa-
tion of automated mechanisms for the timely sharing 
of cyber threat indicators and defensive measures to 
and from the Center and with each Federal agency 
designated as the ‘Sector Specific Agency’ for each 
critical infrastructure sector in accordance with sub-
section (h). 
‘‘(2) BIANNUAL
REPORT.—The Under Sec-
retary for Cybersecurity and Infrastructure Protec-
tion shall submit to the Committee on Homeland Se-
curity of the House of Representatives and the Com-
mittee on Homeland Security and Governmental Af-
fairs of the Senate a biannual report on the status 
and progress of the development of the capability de-
scribed in paragraph (1). Such reports shall be re-
quired until such capability is fully implemented. 
‘‘(h) SECTOR SPECIFIC AGENCIES.—The Secretary, 
in collaboration with the relevant critical infrastructure 
sector and the heads of other appropriate Federal agen-
cies, shall recognize the Federal agency designated as of 
March 25, 2015, as the ‘Sector Specific Agency’ for each
critical infrastructure sector designated in the Depart-
ment’s National Infrastructure Protection Plan. If the 
designated Sector Specific Agency for a particular critical 
infrastructure sector is the Department, for purposes of 
this section, the Secretary is deemed to be the head of 
such Sector Specific Agency and shall carry out this sec-
tion. The Secretary, in coordination with the heads of each 
such Sector Specific Agency, shall— 
‘‘(1) support the security and resilience actives 
of the relevant critical infrastructure sector in ac-
cordance with this section; 
‘‘(2) provide institutional knowledge, specialized 
expertise, and technical assistance upon request to 
the relevant critical infrastructure sector; and 
‘‘(3) support the timely sharing of cyber threat 
indicators and defensive measures with the relevant 
critical infrastructure sector with the Center in ac-
cordance with this section. 
‘‘(i) VOLUNTARY INFORMATION SHARING PROCE-
DURES.— 
‘‘(1) PROCEDURES.— 
‘‘(A) IN GENERAL.—The Center may enter 
into a voluntary information sharing relation-
ship with any consenting non-Federal entity for 
the sharing of cyber threat indicators and de-
fensive measures for cybersecurity purposes in 
accordance with this section. Nothing in this 
section may be construed to require any non- 
Federal entity to enter into any such informa-
tion sharing relationship with the Center or any 
other entity. The Center may terminate a vol-
untary information sharing relationship under 
this subsection, at the sole and unreviewable 
discretion of the Secretary, acting through the 
Under Secretary for Cybersecurity and Infra-
structure Protection, if the Center determines 
that the non-Federal entity with which the Cen-
ter has entered into such a relationship has, 
after repeated notice, repeatedly violated the 
terms of this subsection. 
‘‘(B) NATIONAL
SECURITY.—The Sec-
retary may decline to enter into a voluntary in-
formation sharing relationship under this sub-
section, at the sole and unreviewable discretion 
of the Secretary, acting through the Under Sec-
retary for Cybersecurity and Infrastructure 
Protection, if the Secretary determines that 
such is appropriate for national security. 
‘‘(2) VOLUNTARY INFORMATION SHARING RELA-
TIONSHIPS.—A voluntary information sharing rela-
tionship under this subsection may be characterized 
as an agreement described in this paragraph. 
‘‘(A) STANDARD
AGREEMENT.—For the 
use of a non-Federal entity, the Center shall 
make available a standard agreement, con-
sistent with this section, on the Department’s 
website. 
‘‘(B) NEGOTIATED
AGREEMENT.—At the 
request of a non-Federal entity, and if deter-
mined appropriate by the Center, at the sole 
and unreviewable discretion of the Secretary, 
acting through the Under Secretary for Cyber-
security and Infrastructure Protection, the De-
partment shall negotiate a non-standard agree-
ment, consistent with this section. 
‘‘(C) EXISTING AGREEMENTS.—An agree-
ment between the Center and a non-Federal en-
tity that is entered into before the date of the 
enactment of this section, or such an agreement 
that is in effect before such date, shall be 
deemed in compliance with the requirements of 
this subsection, notwithstanding any other pro-
vision or requirement of this subsection. An 
agreement under this subsection shall include 
the relevant privacy protections as in effect
under the Cooperative Research and Develop-
ment Agreement for Cybersecurity Information 
Sharing and Collaboration, as of December 31, 
2014. Nothing in this subsection may be con-
strued to require a non-Federal entity to enter 
into either a standard or negotiated agreement 
to be in compliance with this subsection. 
‘‘(3) 
INFORMATION
SHARING
AUTHORIZA-
TION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B), and notwithstanding any 
other provision of law, a non-Federal entity 
may, for cybersecurity purposes, share cyber 
threat indicators or defensive measures ob-
tained on its own information system, or on an 
information system of another Federal entity or 
non-Federal entity, upon written consent of 
such other Federal entity or non-Federal entity 
or an authorized representative of such other 
Federal entity or non-Federal entity in accord-
ance with this section with— 
‘‘(i) another non-Federal entity; or 
‘‘(ii) the Center, as provided in this 
section.
‘‘(B) LAWFUL RESTRICTION.—A non-Fed-
eral entity receiving a cyber threat indicator or 
defensive measure from another Federal entity 
or non-Federal entity shall comply with other-
wise lawful restrictions placed on the sharing or 
use of such cyber threat indicator or defensive 
measure by the sharing Federal entity or non- 
Federal entity. 
‘‘(C) REMOVAL
OF
INFORMATION
UNRE-
LATED
TO
CYBERSECURITY
RISKS
OR
INCI-
DENTS.—Federal entities and non-Federal enti-
ties shall, prior to such sharing, take reasonable 
efforts to remove or exclude information that 
can be used to identify specific persons and is 
reasonably believed at the time of sharing to be 
unrelated to a cybersecurity risk or incident and 
to safeguard information that can be used to 
identify specific persons from unintended disclo-
sure or unauthorized access or acquisition. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) limit or modify an existing infor-
mation sharing relationship; 
‘‘(ii) prohibit a new information shar-
ing relationship;
‘‘(iii) require a new information shar-
ing relationship between any non-Federal 
entity and a Federal entity; 
‘‘(iv) limit otherwise lawful activity; or 
‘‘(v) in any manner impact or modify 
procedures in existence as of the date of 
the enactment of this section for reporting 
known or suspected criminal activity to ap-
propriate law enforcement authorities or 
for participating voluntarily or under legal 
requirement in an investigation. 
‘‘(E) COORDINATED VULNERABILITY DIS-
CLOSURE.—The Under Secretary for Cyberse-
curity and Infrastructure Protection, in coordi-
nation with industry and other stakeholders, 
shall develop, publish, and adhere to policies 
and procedures for coordinating vulnerability 
disclosures, to the extent practicable, consistent 
with international standards in the information 
technology industry. 
‘‘(4) NETWORK AWARENESS AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government,
may, for cybersecurity purposes, conduct net-
work awareness of— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity, upon written consent 
of such other non-Federal entity for con-
ducting such network awareness to protect 
the rights or property of such other non- 
Federal entity; 
‘‘(iii) an information system of a Fed-
eral entity, upon written consent of an au-
thorized representative of such Federal en-
tity for conducting such network awareness 
to protect the rights or property of such 
Federal entity; or 
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) authorize conducting network 
awareness of an information system, or the 
use of any information obtained through
such conducting of network awareness, 
other than as provided in this section; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(5) DEFENSIVE MEASURE AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B) and notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
may, for cybersecurity purposes, operate a de-
fensive measure that is applied to— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity upon written consent of 
such other non-Federal entity for operation 
of such defensive measure to protect the 
rights or property of such other non-Fed-
eral entity; 
‘‘(iii) an information system of a Fed-
eral entity upon written consent of an au-
thorized representative of such Federal en-
tity for operation of such defensive meas-
ure to protect the rights or property of 
such Federal entity; or
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) authorize the use of a defensive 
measure other than as provided in this sec-
tion; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(6) PRIVACY AND CIVIL LIBERTIES PROTEC-
TIONS.— 
‘‘(A) POLICIES AND PROCEDURES.— 
‘‘(i) IN GENERAL.—The Under Sec-
retary for Cybersecurity and Infrastructure 
Protection shall, in coordination with the 
Chief Privacy Officer and the Chief Civil 
Rights and Civil Liberties Officer of the 
Department, establish and annually review 
policies and procedures governing the re-
ceipt, retention, use, and disclosure of 
cyber threat indicators, defensive meas-
ures, and information related to cybersecu-
rity risks and incidents shared with the 
Center in accordance with this section. 
Such policies and procedures shall apply
only to the Department, consistent with 
the need to protect information systems 
from cybersecurity risks and incidents and 
mitigate cybersecurity risks and incidents 
in a timely manner, and shall— 
‘‘(I) be consistent with the De-
partment’s Fair Information Practice 
Principles developed pursuant to sec-
tion 552a of title 5, United States 
Code (commonly referred to as the 
‘Privacy Act of 1974’ or the ‘Privacy 
Act’), and subject to the Secretary’s 
authority under subsection (a)(2) of 
section 222 of this Act; 
‘‘(II) reasonably limit, to the 
greatest extent practicable, the re-
ceipt, retention, use, and disclosure of 
cyber threat indicators and defensive 
measures associated with specific per-
sons that is not necessary, for cyber-
security purposes, to protect a net-
work or information system from cy-
bersecurity risks or mitigate cyberse-
curity risks and incidents in a timely 
manner;
‘‘(III) minimize any impact on 
privacy and civil liberties; 
‘‘(IV) 
provide 
data 
integrity 
through the prompt removal and de-
struction of obsolete or erroneous 
names and personal information that 
is unrelated to the cybersecurity risk 
or incident information shared and re-
tained by the Center in accordance 
with this section; 
‘‘(V) include requirements to 
safeguard cyber threat indicators and 
defensive measures retained by the 
Center, including information that is 
proprietary or business-sensitive, or 
that may be used to identify specific 
persons from unauthorized access or 
acquisition; 
‘‘(VI) protect the confidentiality 
of cyber threat indicators and defen-
sive measures associated with specific 
persons to the greatest extent prac-
ticable; and
‘‘(VII) ensure all relevant con-
stitutional, legal, and privacy protec-
tions are observed. 
‘‘(ii) SUBMISSION
TO
CONGRESS.— 
Not later than 180 days after the date of 
the enactment of this section and annually 
thereafter, the Chief Privacy Officer and 
the Officer for Civil Rights and Civil Lib-
erties of the Department, in consultation 
with the Privacy and Civil Liberties Over-
sight Board (established pursuant to sec-
tion 1061 of the Intelligence Reform and 
Terrorism Prevention Act of 2004 (42 
U.S.C. 2000ee)), shall submit to the Com-
mittee on Homeland Security of the House 
of Representatives and the Committee on 
Homeland Security and Governmental Af-
fairs of the Senate the policies and proce-
dures governing the sharing of cyber threat 
indicators, defensive measures, and infor-
mation related to cybersecurity risks and 
incidents described in clause (i) of sub-
paragraph (A). 
‘‘(iii) PUBLIC NOTICE AND ACCESS.— 
The Under Secretary for Cybersecurity
and Infrastructure Protection, in consulta-
tion with the Chief Privacy Officer and the 
Chief Civil Rights and Civil Liberties Offi-
cer of the Department, and the Privacy 
and Civil Liberties Oversight Board (estab-
lished pursuant to section 1061 of the In-
telligence Reform and Terrorism Preven-
tion Act of 2004 (42 U.S.C. 2000ee)), 
shall ensure there is public notice of, and 
access to, the policies and procedures gov-
erning the sharing of cyber threat indica-
tors, defensive measures, and information 
related to cybersecurity risks and inci-
dents. 
‘‘(iv) 
CONSULTATION.—The 
Under 
Secretary for Cybersecurity and Infrastruc-
ture Protection when establishing policies 
and procedures to support privacy and civil 
liberties may consult with the National In-
stitute of Standards and Technology. 
‘‘(B) IMPLEMENTATION.—The Chief Pri-
vacy Officer of the Department, on an ongoing 
basis, shall— 
‘‘(i) monitor the implementation of 
the policies and procedures governing the
sharing of cyber threat indicators and de-
fensive measures established pursuant to 
clause (i) of subparagraph (A); 
‘‘(ii) regularly review and update pri-
vacy impact assessments, as appropriate, 
to ensure all relevant constitutional, legal, 
and privacy protections are being followed; 
‘‘(iii) work with the Under Secretary 
for Cybersecurity and Infrastructure Pro-
tection to carry out paragraphs (10) and 
(11) of subsection (c); 
‘‘(iv) annually submit to the Com-
mittee on Homeland Security of the House 
of Representatives and the Committee on 
Homeland Security and Governmental Af-
fairs of the Senate a report that contains 
a review of the effectiveness of such poli-
cies and procedures to protect privacy and 
civil liberties; and 
‘‘(v) ensure there are appropriate 
sanctions in place for officers, employees, 
or agents of the Department who inten-
tionally or willfully conduct activities under 
this section in an unauthorized manner.
‘‘(C) INSPECTOR GENERAL REPORT.—The 
Inspector General of the Department, in con-
sultation with the Privacy and Civil Liberties 
Oversight Board and the Inspector General of 
each Federal agency that receives cyber threat 
indicators or defensive measures shared with 
the Center under this section, shall, not later 
than two years after the date of the enactment 
of this subsection and periodically thereafter 
submit to the Committee on Homeland Security 
of the House of Representatives and the Com-
mittee on Homeland Security and Govern-
mental Affairs of the Senate a report con-
taining a review of the use of cybersecurity risk 
information shared with the Center, including 
the following: 
‘‘(i) A report on the receipt, use, and 
dissemination of cyber threat indicators 
and defensive measures that have been 
shared with Federal entities under this 
section. 
‘‘(ii) Information on the use by the 
Center of such information for a purpose 
other than a cybersecurity purpose.
‘‘(iii) A review of the type of informa-
tion shared with the Center under this sec-
tion. 
‘‘(iv) A review of the actions taken by 
the Center based on such information. 
‘‘(v) The appropriate metrics that 
exist to determine the impact, if any, on 
privacy and civil liberties as a result of the 
sharing of such information with the Cen-
ter. 
‘‘(vi) A list of other Federal agencies 
receiving such information. 
‘‘(vii) A review of the sharing of such 
information within the Federal Govern-
ment to identify inappropriate stove piping 
of such information. 
‘‘(viii) Any recommendations of the 
Inspector General of the Department for 
improvements or modifications to informa-
tion sharing under this section. 
‘‘(D) PRIVACY AND CIVIL LIBERTIES OFFI-
CERS REPORT.—The Chief Privacy Officer and 
the Chief Civil Rights and Civil Liberties Offi-
cer of the Department, in consultation with the 
Privacy and Civil Liberties Oversight Board,
the Inspector General of the Department, and 
the senior privacy and civil liberties officer of 
each Federal agency that receives cyber threat 
indicators and defensive measures shared with 
the Center under this section, shall biennially 
submit to the appropriate congressional com-
mittees a report assessing the privacy and civil 
liberties impact of the activities under this 
paragraph. Each such report shall include any 
recommendations the Chief Privacy Officer and 
the Chief Civil Rights and Civil Liberties Offi-
cer of the Department consider appropriate to 
minimize or mitigate the privacy and civil lib-
erties impact of the sharing of cyber threat in-
dicators and defensive measures under this sec-
tion. 
‘‘(E) FORM.—Each report required under 
subparagraphs (C) and (D) shall be submitted 
in unclassified form, but may include a classi-
fied annex. 
‘‘(7) USES
AND
PROTECTION
OF
INFORMA-
TION.— 
‘‘(A) NON-FEDERAL
ENTITIES.—A non- 
Federal entity, not including a State, local, or 
tribal government, that shares cyber threat in-
dicators or defensive measures through the Cen-
ter or otherwise under this section— 
‘‘(i) may use, retain, or further dis-
close such cyber threat indicators or defen-
sive measures solely for cybersecurity pur-
poses; 
‘‘(ii) shall, prior to such sharing, take 
reasonable efforts to remove or exclude in-
formation that can be used to identify spe-
cific persons and is reasonably believed at 
the time of sharing to be unrelated to a cy-
bersecurity risk or incident, and to safe-
guard information that can be used to 
identify specific persons from unintended 
disclosure or unauthorized access or acqui-
sition; 
‘‘(iii) shall comply with appropriate 
restrictions that a Federal entity or non- 
Federal entity places on the subsequent 
disclosure or retention of cyber threat indi-
cators and defensive measures that it dis-
closes to other Federal entities or non-Fed-
eral entities;
‘‘(iv) shall be deemed to have volun-
tarily shared such cyber threat indicators 
or defensive measures; 
‘‘(v) shall implement and utilize a se-
curity control to protect against unauthor-
ized access to or acquisition of such cyber 
threat indicators or defensive measures; 
and 
‘‘(vi) may not use such information to 
gain an unfair competitive advantage to 
the detriment of any non-Federal entity. 
‘‘(B) FEDERAL ENTITIES.— 
‘‘(i) USES OF INFORMATION.—A Fed-
eral entity that receives cyber threat indi-
cators 
or 
defensive 
measures 
shared 
through the Center or otherwise under this 
section from another Federal entity or a 
non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators 
or defensive measures solely for cyber-
security purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove or 
exclude information that can be used
to identify specific persons and is rea-
sonably believed at the time of sharing 
to be unrelated to a cybersecurity risk 
or incident, and to safeguard informa-
tion that can be used to identify spe-
cific persons from unintended disclo-
sure or unauthorized access or acqui-
sition; 
‘‘(III) shall be deemed to have 
voluntarily shared such cyber threat 
indicators or defensive measures; 
‘‘(IV) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition 
of such cyber threat indicators or de-
fensive measures; and 
‘‘(V) may not use such cyber 
threat indicators or defensive meas-
ures to engage in surveillance or other 
collection activities for the purpose of 
tracking an individual’s personally 
identifiable information, except for 
purposes authorized in this section.
‘‘(ii) PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) are exempt from disclosure 
under section 552 of title 5, United 
States Code, and withheld, without 
discretion, from the public under sub-
section (b)(3)(B) of such section; 
‘‘(II) may not be used by the 
Federal Government for regulatory 
purposes; 
‘‘(III) may not constitute a waiv-
er of any applicable privilege or pro-
tection provided by law, including 
trade secret protection; 
‘‘(IV) shall be considered the 
commercial, financial, and proprietary 
information of the non-Federal entity 
referred to in clause (i) when so des-
ignated by such non-Federal entity; 
and 
‘‘(V) may not be subject to a rule 
of any Federal entity or any judicial 
doctrine regarding ex parte commu-
‘‘(III) shall consider such infor-
mation the commercial, financial, and 
proprietary information of such Fed-
eral entity or non-Federal entity if so 
designated by such Federal entity or 
non-Federal entity; 
‘‘(IV) shall be deemed to have 
voluntarily shared such cyber threat 
indicators or defensive measures; and 
‘‘(V) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition 
of such cyber threat indicators or de-
fensive measures. 
‘‘(ii) PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) shall be exempt from disclo-
sure under any State, local, or tribal 
law or regulation that requires public 
disclosure of information or records 
by a public or quasi-public entity; and 
‘‘(II) may not be used by any 
State, local, or tribal government to
regulate a lawful activity of a non- 
Federal entity. 
‘‘(8) LIABILITY EXEMPTIONS.— 
‘‘(A) NETWORK AWARENESS.—No cause of 
action shall lie or be maintained in any court, 
and such action shall be promptly dismissed, 
against any non-Federal entity that, for cyber-
security purposes, conducts network awareness 
under paragraph (4), if such network awareness 
is conducted in accordance with such paragraph 
and this section. 
‘‘(B) INFORMATION
SHARING.—No cause 
of action shall lie or be maintained in any 
court, and such action shall be promptly dis-
missed, against any non-Federal entity that, for 
cybersecurity purposes, shares cyber threat in-
dicators or defensive measures under paragraph 
(3), or in good faith fails to act based on such 
sharing, if such sharing is conducted in accord-
ance with such paragraph and this section. 
‘‘(C) WILLFUL MISCONDUCT.— 
‘‘(i) RULE OF CONSTRUCTION.—Noth-
ing in this section may be construed to— 
‘‘(I) require dismissal of a cause 
of action against a non-Federal entity
that has engaged in willful misconduct 
in the course of conducting activities 
authorized by this section; or 
‘‘(II) undermine or limit the 
availability of otherwise applicable 
common law or statutory defenses. 
‘‘(ii) 
PROOF
OF
WILLFUL
MIS-
CONDUCT.—In any action claiming that 
subparagraph (A) or (B) does not apply 
due to willful misconduct described in 
clause (i), the plaintiff shall have the bur-
den of proving by clear and convincing evi-
dence the willful misconduct by each non- 
Federal entity subject to such claim and 
that such willful misconduct proximately 
caused injury to the plaintiff. 
‘‘(iii) 
WILLFUL
MISCONDUCT
DE-
FINED.—In this subsection, the term ‘will-
ful misconduct’ means an act or omission 
that is taken— 
‘‘(I) intentionally to achieve a 
wrongful purpose; 
‘‘(II) knowingly without legal or 
factual justification; and
‘‘(III) in disregard of a known or 
obvious risk that is so great as to 
make it highly probable that the harm 
will outweigh the benefit. 
‘‘(D) EXCLUSION.—The term ‘non-Federal 
entity’ as used in this paragraph shall not in-
clude a State, local, or tribal government. 
‘‘(9) FEDERAL
GOVERNMENT
LIABILITY
FOR 
VIOLATIONS
OF
RESTRICTIONS
ON
THE
USE
AND 
PROTECTION
OF
VOLUNTARILY
SHARED
INFORMA-
TION.— 
‘‘(A) IN
GENERAL.—If a department or 
agency of the Federal Government intentionally 
or willfully violates the restrictions specified in 
paragraph (3), (6), or (7)(B) on the use and 
protection of voluntarily shared cyber threat in-
dicators or defensive measures, or any other 
provision of this section, the Federal Govern-
ment shall be liable to a person injured by such 
violation in an amount equal to the sum of— 
‘‘(i) the actual damages sustained by 
such person as a result of such violation or 
$1,000, whichever is greater; and 
‘‘(ii) reasonable attorney fees as deter-
mined by the court and other litigation
costs reasonably occurred in any case 
under this subsection in which the com-
plainant has substantially prevailed. 
‘‘(B) VENUE.—An action to enforce liabil-
ity under this subsection may be brought in the 
district court of the United States in— 
‘‘(i) the district in which the com-
plainant resides; 
‘‘(ii) the district in which the principal 
place of business of the complainant is lo-
cated; 
‘‘(iii) the district in which the depart-
ment or agency of the Federal Government 
that disclosed the information is located; or 
‘‘(iv) the District of Columbia. 
‘‘(C) STATUTE OF LIMITATIONS.—No ac-
tion shall lie under this subsection unless such 
action is commenced not later than two years 
after the date on which the cause of action 
arises. 
‘‘(D) EXCLUSIVE
CAUSE
OF
ACTION.—A 
cause of action under this subsection shall be 
the exclusive means available to a complainant 
seeking a remedy for a violation of any restric-
tion specified in paragraph (3), (6), or 7(B) or 
any other provision of this section. 
‘‘(10) ANTI-TRUST EXEMPTION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (C), it shall not be considered a 
violation of any provision of antitrust laws for 
two or more non-Federal entities to share a 
cyber threat indicator or defensive measure, or 
assistance relating to the prevention, investiga-
tion, or mitigation of a cybersecurity risk or in-
cident, for cybersecurity purposes under this 
Act. 
‘‘(B) APPLICABILITY.—Subparagraph (A) 
shall apply only to information that is shared or 
assistance that is provided in order to assist 
with— 
‘‘(i) facilitating the prevention, inves-
tigation, or mitigation of a cybersecurity 
risk or incident to an information system 
or information that is stored on, processed 
by, or transiting an information system; or 
‘‘(ii) communicating or disclosing a 
cyber threat indicator or defensive measure 
to help prevent, investigate, or mitigate the 
effect of a cybersecurity risk or incident to
an information system or information that 
is stored on, processed by, or transiting an 
information system. 
‘‘(11) CONSTRUCTION AND PREEMPTION.— 
‘‘(A) 
OTHERWISE
LAWFUL
DISCLO-
SURES.—Nothing in this section may be con-
strued to limit or prohibit otherwise lawful dis-
closures of communications, records, or other 
information, including reporting of known or 
suspected criminal activity or participating vol-
untarily or under legal requirement in an inves-
tigation, by a non-Federal to any other non- 
Federal entity or Federal entity under this sec-
tion. 
‘‘(B) WHISTLE BLOWER PROTECTIONS.— 
Nothing in this section may be construed to 
prohibit or limit the disclosure of information 
protected under section 2302(b)(8) of title 5, 
United States Code (governing disclosures of il-
legality, waste, fraud, abuse, or public health or 
safety threats), section 7211 of title 5, United 
States Code (governing disclosures to Con-
gress), section 1034 of title 10, United States 
Code (governing disclosure to Congress by 
members of the military), section 1104 of the
National Security Act of 1947 (50 U.S.C. 
3234) (governing disclosure by employees of 
elements of the intelligence community), or any 
similar provision of Federal or State law. 
‘‘(C) RELATIONSHIP
TO
OTHER
LAWS.— 
Nothing in this section may be construed to af-
fect any requirement under any other provision 
of law for a non-Federal entity to provide infor-
mation to a Federal entity. 
‘‘(D) PRESERVATION
OF
CONTRACTUAL 
OBLIGATIONS
AND
RIGHTS.—Nothing in this 
section may be construed to— 
‘‘(i) amend, repeal, or supersede any 
current or future contractual agreement, 
terms of service agreement, or other con-
tractual relationship between any non-Fed-
eral entities, or between any non-Federal 
entity and a Federal entity; or 
‘‘(ii) abrogate trade secret or intellec-
tual property rights of any non-Federal en-
tity or Federal entity. 
‘‘(E) ANTI-TASKING RESTRICTION.—Noth-
ing in this section may be construed to permit 
a Federal entity to—
‘‘(i) require a non-Federal entity to 
provide information to a Federal entity; 
‘‘(ii) condition the sharing of cyber 
threat indicators or defensive measures 
with a non-Federal entity on such non- 
Federal entity’s provision of cyber threat 
indicators or defensive measures to a Fed-
eral entity; or 
‘‘(iii) condition the award of any Fed-
eral grant, contract, or purchase on the 
sharing of cyber threat indicators or defen-
sive measures with a Federal entity. 
‘‘(F) NO LIABILITY FOR NON-PARTICIPA-
TION.—Nothing in this section may be con-
strued to subject any non-Federal entity to li-
ability for choosing to not engage in the vol-
untary activities authorized under this section. 
‘‘(G) USE AND RETENTION OF INFORMA-
TION.—Nothing in this section may be con-
strued to authorize, or to modify any existing 
authority of, a department or agency of the 
Federal Government to retain or use any infor-
mation shared under this section for any use 
other than permitted in this section.
100 
‘‘(H) VOLUNTARY
SHARING.—Nothing in 
this section may be construed to restrict or con-
dition a non-Federal entity from sharing, for 
cybersecurity purposes, cyber threat indicators, 
defensive measures, or information related to 
cybersecurity risks or incidents with any other 
non-Federal entity, and nothing in this section 
may be construed as requiring any non-Federal 
entity to share cyber threat indicators, defen-
sive measures, or information related to cyber-
security risks or incidents with the Center. 
‘‘(I) PROHIBITED CONDUCT.—Nothing in 
this section may be construed to permit price- 
fixing, allocating a market between competitors, 
monopolizing or attempting to monopolize a 
market, or exchanges of price or cost informa-
tion, customer lists, or information regarding 
future competitive planning. 
‘‘(J) FEDERAL
PREEMPTION.—This sec-
tion supersedes any statute or other provision 
of law of a State or political subdivision of a 
State that restricts or otherwise expressly regu-
lates an activity authorized under this section. 
‘‘(j) DIRECT REPORTING.—The Secretary shall de-
velop policies and procedures for direct reporting to the
101 
Secretary by the Director of the Center regarding signifi-
cant cybersecurity risks and incidents. 
‘‘(k) ADDITIONAL
RESPONSIBILITIES.—The Sec-
retary shall build upon existing mechanisms to promote 
a national awareness effort to educate the general public 
on the importance of securing information systems. 
‘‘(l) REPORTS ON INTERNATIONAL COOPERATION.— 
Not later than 180 days after the date of the enactment 
of this subsection and periodically thereafter, the Sec-
retary of Homeland Security shall submit to the Com-
mittee on Homeland Security of the House of Representa-
tives and the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate a report on the range of 
efforts underway to bolster cybersecurity collaboration 
with relevant international partners in accordance with 
subsection (c)(8). 
‘‘(m) OUTREACH.—Not later than 60 days after the 
date of the enactment of this subsection, the Secretary, 
acting through the Under Secretary for Cybersecurity and 
Infrastructure Protection, shall— 
‘‘(1) disseminate to the public information 
about how to voluntarily share cyber threat indica-
tors and defensive measures with the Center; and 
‘‘(2) enhance outreach to critical infrastructure 
owners and operators for purposes of such sharing.’’.
102 
SEC. 204. INFORMATION SHARING AND ANALYSIS ORGANI-
ZATIONS. 
Section 212 of the Homeland Security Act of 2002 
(6 U.S.C. 131) is amended— 
(1) in paragraph (5)— 
(A) in subparagraph (A)— 
(i) by inserting ‘‘and information re-
lated to cybersecurity risks and incidents 
and’’ after ‘‘critical infrastructure informa-
tion’’; and 
(ii) by striking ‘‘related to critical in-
frastructure’’ and inserting ‘‘related to cy-
bersecurity risks, incidents, critical infra-
structure, and’’; 
(B) in subparagraph (B)— 
(i) by striking ‘‘disclosing critical in-
frastructure information’’ and inserting 
‘‘disclosing cybersecurity risks, incidents, 
and critical infrastructure information’’; 
and 
(ii) by striking ‘‘related to critical in-
frastructure or’’ and inserting ‘‘related to 
cybersecurity risks, incidents, critical infra-
structure, or’’ and 
(C) in subparagraph (C), by striking ‘‘dis-
seminating critical infrastructure information’’
103 
and 
inserting 
‘‘disseminating 
cybersecurity 
risks, incidents, and critical infrastructure in-
formation’’; and 
(2) by adding at the end the following new 
paragraph: 
‘‘(8) CYBERSECURITY
RISK; INCIDENT.—The 
terms ‘cybersecurity risk’ and ‘incident’ have the 
meanings given such terms in the second section 226 
(relating to the National Cybersecurity and Commu-
nications Integration Center).’’. 
SEC. 205. STREAMLINING OF DEPARTMENT OF HOMELAND 
SECURITY 
CYBERSECURITY 
AND 
INFRA-
STRUCTURE PROTECTION ORGANIZATION. 
(a) CYBERSECURITY
AND INFRASTRUCTURE PRO-
TECTION.—The National Protection and Programs Direc-
torate of the Department of Homeland Security shall, 
after the date of the enactment of this title, be known and 
designated as the ‘‘Cybersecurity and Infrastructure Pro-
tection’’. Any reference to the National Protection and 
Programs Directorate of the Department in any law, regu-
lation, map, document, record, or other paper of the 
United States shall be deemed to be a reference to the 
Cybersecurity and Infrastructure Protection of the De-
partment.
104 
(b) SENIOR LEADERSHIP OF CYBERSECURITY AND 
INFRASTRUCTURE PROTECTION.— 
(1) IN
GENERAL.—Subsection (a) of section 
103 of the Homeland Security Act of 2002 (6 
U.S.C. 113) is amended— 
(A) in paragraph (1)— 
(i) by amending subparagraph (H) to 
read as follows: 
‘‘(H) An Under Secretary for Cyber-
security and Infrastructure Protection.’’; 
and 
(ii) by adding at the end the following 
new subparagraphs: 
‘‘(K) A Deputy Under Secretary for 
Cybersecurity. 
‘‘(L) A Deputy Under Secretary for 
Infrastructure Protection.’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(3) DEPUTY UNDER SECRETARIES.—The Dep-
uty Under Secretaries referred to in subparagraphs 
(K) and (L) of paragraph (1) shall be appointed by 
the President without the advice and consent of the 
Senate.’’.
105 
(2) CONTINUATION
IN
OFFICE.—The individ-
uals who hold the positions referred in subpara-
graphs (H), (K), and (L) of paragraph (1) of section 
103(a) the Homeland Security Act of 2002 (as 
amended and added by paragraph (1) of this sub-
section) as of the date of the enactment of this title 
may continue to hold such positions. 
(c) REPORT.—Not later than 90 days after the date 
of the enactment of this title, the Under Secretary for Cy-
bersecurity and Infrastructure Protection of the Depart-
ment of Homeland Security shall submit to the Committee 
on Homeland Security of the House of Representatives 
and the Committee on Homeland Security and Govern-
mental Affairs of the Senate a report on the feasibility 
of becoming an operational component, including an anal-
ysis of alternatives, and if a determination is rendered that 
becoming an operational component is the best option for 
achieving the mission of Cybersecurity and Infrastructure 
Protection, a legislative proposal and implementation plan 
for becoming such an operational component. Such report 
shall also include plans to more effectively carry out the 
cybersecurity mission of Cybersecurity and Infrastructure 
Protection, including expediting information sharing 
agreements.
106 
SEC. 206. CYBER INCIDENT RESPONSE PLANS. 
(a) IN GENERAL.—Section 227 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 149) is amended— 
(1) in the heading, by striking ‘‘PLAN’’ and in-
serting ‘‘PLANS’’; 
(2) by striking ‘‘The Under Secretary appointed 
under section 103(a)(1)(H) shall’’ and inserting the 
following: 
‘‘(a) IN GENERAL.—The Under Secretary for Cyber-
security and Infrastructure Protection shall’’; and 
(3) by adding at the end the following new sub-
section: 
‘‘(b) UPDATES TO THE CYBER INCIDENT ANNEX TO 
THE NATIONAL RESPONSE FRAMEWORK.—The Secretary, 
in coordination with the heads of other appropriate Fed-
eral departments and agencies, and in accordance with the 
National Cybersecurity Incident Response Plan required 
under subsection (a), shall regularly update, maintain, and 
exercise the Cyber Incident Annex to the National Re-
sponse Framework of the Department.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of the Homeland Security Act of 2002 is amended by 
amending the item relating to section 227 to read as fol-
lows: 
‘‘Sec. 227. Cyber incident response plans.’’.
107 
SEC. 207. SECURITY AND RESILIENCY OF PUBLIC SAFETY 
COMMUNICATIONS; CYBERSECURITY AWARE-
NESS CAMPAIGN. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by adding at the end the following new sections: 
‘‘SEC. 230. SECURITY AND RESILIENCY OF PUBLIC SAFETY 
COMMUNICATIONS. 
‘‘The National Cybersecurity and Communications 
Integration Center, in coordination with the Office of 
Emergency Communications of the Department, shall as-
sess and evaluate consequence, vulnerability, and threat 
information regarding cyber incidents to public safety 
communications to help facilitate continuous improve-
ments to the security and resiliency of such communica-
tions. 
‘‘SEC. 231. CYBERSECURITY AWARENESS CAMPAIGN. 
‘‘(a) IN GENERAL.—The Under Secretary for Cyber-
security and Infrastructure Protection shall develop and 
implement an ongoing and comprehensive cybersecurity 
awareness campaign regarding cybersecurity risks and vol-
untary best practices for mitigating and responding to 
such risks. Such campaign shall, at a minimum, publish 
and disseminate, on an ongoing basis, the following: 
‘‘(1) Public service announcements targeted at 
improving awareness among State, local, and tribal
108 
governments, the private sector, academia, and 
stakeholders in specific audiences, including the el-
derly, students, small businesses, members of the 
Armed Forces, and veterans. 
‘‘(2) Vendor and technology-neutral voluntary 
best practices information. 
‘‘(b) CONSULTATION.—The Under Secretary for Cy-
bersecurity and Infrastructure Protection shall consult 
with a wide range of stakeholders in government, industry, 
academia, and the non-profit community in carrying out 
this section. 
‘‘SEC. 232. NATIONAL CYBERSECURITY PREPAREDNESS 
CONSORTIUM. 
‘‘(a) IN GENERAL.—The Secretary may establish a 
consortium to be known as the ‘National Cybersecurity 
Preparedness Consortium’ (in this section referred to as 
the ‘Consortium’). 
‘‘(b) FUNCTIONS.—The Consortium may— 
‘‘(1) provide training to State and local first re-
sponders and officials specifically for preparing and 
responding to cyber attacks; 
‘‘(2) develop and update a curriculum utilizing 
the National Protection and Programs Directorate 
of the Department sponsored Community Cyber Se-
109 
curity Maturity Model (CCSMM) for State and local 
first responders and officials; 
‘‘(3) provide technical assistance services to 
build and sustain capabilities in support of cyberse-
curity preparedness and response; 
‘‘(4) conduct cybersecurity training and simula-
tion exercises to defend from and respond to cyber- 
attacks; 
‘‘(5) coordinate with the National Cybersecurity 
and Communications Integration Center to help 
States and communities develop cybersecurity infor-
mation sharing programs; and 
‘‘(6) coordinate with the National Domestic 
Preparedness Consortium to incorporate cybersecu-
rity emergency responses into existing State and 
local emergency management functions. 
‘‘(c) MEMBERS.—The Consortium shall consist of 
academic, nonprofit, and government partners that de-
velop, update, and deliver cybersecurity training in sup-
port of homeland security. Members shall have prior expe-
rience conducting cybersecurity training and exercises for 
State and local entities.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of the Homeland Security Act of 2002 is amended by in-
serting after the item relating to section 226 (relating to
110 
cybersecurity recruitment and retention) the following new 
items: 
‘‘Sec. 230. Security and resiliency of public safety communications. 
‘‘Sec. 231. Cybersecurity awareness campaign. 
‘‘Sec. 232. National Cybersecurity Preparedness Consortium.’’. 
SEC. 208. CRITICAL INFRASTRUCTURE PROTECTION RE-
SEARCH AND DEVELOPMENT. 
(a) STRATEGIC PLAN; PUBLIC-PRIVATE CONSOR-
TIUMS.—Title III of the Homeland Security Act of 2002 
(6 U.S.C. 181 et seq.) is amended by adding at the end 
the following new section: 
‘‘SEC. 318. RESEARCH AND DEVELOPMENT STRATEGY FOR 
CRITICAL INFRASTRUCTURE PROTECTION. 
‘‘(a) IN GENERAL.—Not later than 180 days after 
the date of enactment of this section, the Secretary, acting 
through the Under Secretary for Science and Technology, 
shall submit to Congress a strategic plan to guide the 
overall direction of Federal physical security and cyberse-
curity technology research and development efforts for 
protecting critical infrastructure, including against all 
threats. Such plan shall be updated and submitted to Con-
gress every two years. 
‘‘(b) CONTENTS OF PLAN.—The strategic plan, in-
cluding biennial updates, required under subsection (a) 
shall include the following:
111 
‘‘(1) An identification of critical infrastructure 
security risks and any associated security technology 
gaps, that are developed following: 
‘‘(A) Consultation with stakeholders, in-
cluding critical infrastructure Sector Coordi-
nating Councils. 
‘‘(B) Performance by the Department of a 
risk and gap analysis that considers informa-
tion received in such consultations. 
‘‘(2) A set of critical infrastructure security 
technology needs that— 
‘‘(A) is prioritized based on the risks and 
gaps identified under paragraph (1); 
‘‘(B) emphasizes research and development 
of technologies that need to be accelerated due 
to rapidly evolving threats or rapidly advancing 
infrastructure technology; and 
‘‘(C) includes research, development, and 
acquisition roadmaps with clearly defined objec-
tives, goals, and measures. 
‘‘(3) An identification of laboratories, facilities, 
modeling, and simulation capabilities that will be re-
quired to support the research, development, dem-
onstration, testing, evaluation, and acquisition of the 
security technologies described in paragraph (2).
112 
‘‘(4) An identification of current and planned 
programmatic initiatives for fostering the rapid ad-
vancement and deployment of security technologies 
for critical infrastructure protection, including a 
consideration of opportunities for public-private 
partnerships, intragovernment collaboration, univer-
sity centers of excellence, and national laboratory 
technology transfer. 
‘‘(5) A description of progress made with re-
spect to each critical infrastructure security risk, as-
sociated security technology gap, and critical infra-
structure technology need identified in the preceding 
strategic plan required under subsection (a). 
‘‘(c) COORDINATION.—In carrying out this section, 
the Under Secretary for Science and Technology shall co-
ordinate with the Under Secretary for the National Pro-
tection and Programs Directorate. 
‘‘(d) CONSULTATION.—In carrying out this section, 
the Under Secretary for Science and Technology shall con-
sult with— 
‘‘(1) critical infrastructure Sector Coordinating 
Councils; 
‘‘(2) to the extent practicable, subject matter 
experts on critical infrastructure protection from
113 
universities, colleges, national laboratories, and pri-
vate industry; 
‘‘(3) the heads of other relevant Federal depart-
ments and agencies that conduct research and devel-
opment relating to critical infrastructure protection; 
and 
‘‘(4) State, local, and tribal governments, as ap-
propriate.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of the Homeland Security Act of 2002 is amended by in-
serting after the item relating to section 317 the following 
new item: 
‘‘Sec. 318. Research and development strategy for critical infrastructure protec-
tion.’’. 
SEC. 209. REPORT ON REDUCING CYBERSECURITY RISKS IN 
DHS DATA CENTERS. 
Not later than 1 year after the date of the enactment 
of this title, the Secretary of Homeland Security shall sub-
mit to the Committee on Homeland Security of the House 
of Representatives and the Committee on Homeland Secu-
rity and Governmental Affairs of the Senate a report on 
the feasibility of the Department of Homeland Security 
creating an environment for the reduction in cybersecurity 
risks in Department data centers, including by increasing 
compartmentalization between systems, and providing a 
mix of security controls between such compartments.
114 
SEC. 210. ASSESSMENT. 
Not later than 2 years after the date of the enact-
ment of this title, the Comptroller General of the United 
States shall submit to the Committee on Homeland Secu-
rity of the House of Representatives and the Committee 
on Homeland Security and Governmental Affairs of the 
Senate a report that contains an assessment of the imple-
mentation by the Secretary of Homeland Security of this 
title and the amendments made by this title and, to the 
extent practicable, findings regarding increases in the 
sharing of cyber threat indicators, defensive measures, 
and information relating to cybersecurity risks and inci-
dents at the National Cybersecurity and Communications 
Integration Center and throughout the United States. 
SEC. 211. CONSULTATION. 
The Under Secretary for Cybersecurity and Infra-
structure Protection shall produce a report on the feasi-
bility of creating a risk-informed prioritization plan should 
multiple critical infrastructures experience cyber incidents 
simultaneously. 
SEC. 212. TECHNICAL ASSISTANCE. 
The Inspector General of the Department of Home-
land Security shall review the operations of the United 
States Computer Emergency Readiness Team (US– 
CERT) and the Industrial Control Systems Cyber Emer-
gency Response Team (ICS–CERT) to assess the capacity
115 
to provide technical assistance to non-Federal entities and 
to adequately respond to potential increases in requests 
for technical assistance. 
SEC. 213. PROHIBITION ON NEW REGULATORY AUTHORITY. 
Nothing in this title or the amendments made by this 
title may be construed to grant the Secretary of Homeland 
Security any authority to promulgate regulations or set 
standards relating to the cybersecurity of non-Federal en-
tities, not including State, local, and tribal governments, 
that was not in effect on the day before the date of the 
enactment of this title. 
SEC. 214. SUNSET. 
Any requirements for reports required by this title 
or the amendments made by this title shall terminate on 
the date that is 7 years after the date of the entitlement 
of this title. 
SEC. 215. PROHIBITION ON NEW FUNDING. 
No funds are authorized to be appropriated to carry 
out this title and the amendments made by this title. This 
title and such amendments shall be carried out using 
amounts appropriated or otherwise made available for 
such purposes.
116 
SEC. 216. PROTECTION OF FEDERAL INFORMATION SYS-
TEMS. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by adding at the end the following new section: 
‘‘SEC. 233. AVAILABLE PROTECTION OF FEDERAL INFORMA-
TION SYSTEMS. 
‘‘(a) IN GENERAL.—The Secretary shall deploy and 
operate, to make available for use by any Federal agency, 
with or without reimbursement, capabilities to protect 
Federal agency information and information systems, in-
cluding technologies to continuously diagnose, detect, pre-
vent, and mitigate against cybersecurity risks (as such 
term is defined in the second section 226) involving Fed-
eral agency information or information systems. 
‘‘(b) ACTIVITIES.—In carrying out this section, the 
Secretary may— 
‘‘(1) access, and Federal agency heads may dis-
close to the Secretary or a private entity providing 
assistance to the Secretary under paragraph (2), in-
formation traveling to or from or stored on a Fed-
eral agency information system, regardless of from 
where the Secretary or a private entity providing as-
sistance to the Secretary under paragraph (2) ac-
cesses such information, notwithstanding any other 
provision of law that would otherwise restrict or pre-
117 
vent Federal agency heads from disclosing such in-
formation to the Secretary or a private entity pro-
viding assistance to the Secretary under paragraph 
(2); 
‘‘(2) enter into contracts or other agreements, 
or otherwise request and obtain the assistance of, 
private entities to deploy and operate technologies in 
accordance with subsection (a); and 
‘‘(3) retain, use, and disclose information ob-
tained through the conduct of activities authorized 
under this section only to protect Federal agency in-
formation and information systems from cybersecu-
rity risks, or, with the approval of the Attorney Gen-
eral and if disclosure of such information is not oth-
erwise prohibited by law, to law enforcement only to 
investigate, prosecute, disrupt, or otherwise respond 
to— 
‘‘(A) a violation of section 1030 of title 18, 
United States Code; 
‘‘(B) an imminent threat of death or seri-
ous bodily harm; 
‘‘(C) a serious threat to a minor, including 
sexual exploitation or threats to physical safety; 
or
118 
‘‘(D) an attempt, or conspiracy, to commit 
an offense described in any of subparagraphs 
(A) through (C). 
‘‘(c) CONDITIONS.—Contracts or other agreements 
under subsection (b)(2) shall include appropriate provi-
sions barring— 
‘‘(1) the disclosure of information to any entity 
other than the Department or the Federal agency 
disclosing information in accordance with subsection 
(b)(1) that can be used to identify specific persons 
and is reasonably believed to be unrelated to a cy-
bersecurity risk; and 
‘‘(2) the use of any information to which such 
private entity gains access in accordance with this 
section for any purpose other than to protect Fed-
eral agency information and information systems 
against cybersecurity risks or to administer any such 
contract or other agreement. 
‘‘(d) LIMITATION.—No cause of action shall lie 
against a private entity for assistance provided to the Sec-
retary in accordance with this section and a contract or 
agreement under subsection (b)(2).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of the Homeland Security Act of 2002 is amended by in-
serting after the item relating to section 226 (relating to
119 
cybersecurity recruitment and retention) the following new 
item: 
‘‘Sec. 233. Available protection of Federal information systems.’’. 
SEC. 217. SUNSET. 
This title and the amendments made by this title 
shall terminate on the date that is 7 years after the date 
of the enactment of this title. 
SEC. 218. REPORT ON CYBERSECURITY VULNERABILITIES 
OF UNITED STATES PORTS. 
Not later than 180 days after the date of the enact-
ment of this title, the Secretary of Homeland Security 
shall submit to the Committee on Homeland Security and 
the Committee on Transportation and Infrastructure of 
the House of Representatives and the Committee on 
Homeland Security and Governmental Affairs and the 
Committee on Commerce, Science and Transportation of 
the Senate a report on cybersecurity vulnerabilities for the 
ten United States ports that the Secretary determines are 
at greatest risk of a cybersecurity incident and provide 
recommendations to mitigate such vulnerabilities. 
SEC. 219. REPORT ON CYBERSECURITY AND CRITICAL IN-
FRASTRUCTURE. 
The Secretary of Homeland Security may consult 
with sector specific agencies, businesses, and stakeholders 
to produce and submit to the Committee on Homeland Se-
curity of the House of Representatives and the Committee
120 
on Homeland Security and Governmental Affairs of the 
Senate a report on how best to align federally funded cy-
bersecurity research and development activities with pri-
vate sector efforts to protect privacy and civil liberties 
while assuring security and resilience of the Nation’s crit-
ical infrastructure, including— 
(1) promoting research and development to en-
able the secure and resilient design and construction 
of critical infrastructure and more secure accom-
panying cyber technology; 
(2) enhancing modeling capabilities to deter-
mine potential impacts on critical infrastructure of 
incidents or threat scenarios, and cascading effects 
on other sectors; and 
(3) facilitating initiatives to incentivize cyberse-
curity investments and the adoption of critical infra-
structure design features that strengthen cybersecu-
rity and resilience. 
SEC. 220. GAO REPORT ON IMPACT PRIVACY AND CIVIL LIB-
ERTIES. 
Not later than 60 months after the date of the enact-
ment of this title, the Comptroller General of the United 
States shall submit to the Committee on Homeland Secu-
rity of the House of Representatives and the Committee 
on Homeland Security and Governmental Affairs of the
121 
Senate an assessment on the impact on privacy and civil 
liberties limited to the work of the National Cybersecurity 
and Communications Integration Center. 
Passed the House of Representatives April 22, 2015. 
Attest: 
Clerk.