148 
(m) AUTHORITY OF SECRETARY OF DEFENSE TO RESPOND TO MALI-
CIOUS CYBER ACTIVITY CARRIED OUT BY FOREIGN POWERS.—Nothing in 
this part shall be construed to limit the authority of the Secretary of De-
fense under section 130g of title 10. 
(n) DISCLOSURE IN CRIMINAL PROSECUTION.—Nothing in this part shall 
be construed to prevent the disclosure of a cyber threat indicator or defen-
sive measure shared under this part in a criminal prosecution when an ap-
plicable provision of Federal, State, tribal, or local law requires disclosure 
in the case. 
§ 10570. Effective period 
(a) IN GENERAL.—Except as provided in subsection (b), this part and 
the amendments made by the Cybersecurity Information Sharing Act of 
2015 (Public Law 114–113, div. N, title I, 129 Stat. 2936) are effective 
during the period ending on September 30, 2025. 
(b) EXCEPTION.—With respect to any action authorized by this part or 
information obtained pursuant to an action authorized by this part that oc-
curs before the date on which the provisions referred to in subsection (a) 
cease to have effect, the provisions of this part shall continue in effect. 
Part C—Federal Cybersecurity 
Enhancement 
§ 10581. Definitions 
In this part: 
(1) AGENCY.—The term ‘‘agency’’ has the meaning given the term 
in section 3502 of title 44. 
(2) AGENCY INFORMATION SYSTEM.–The term ‘‘agency information 
system’’ has the meaning given the term in section 10546 of this title. 
(3) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term ‘‘appro-
priate congressional committees’’ means— 
(A) the Committee on Homeland Security and Governmental 
Affairs of the Senate; and 
(B) the Committee on Homeland Security of the House of Rep-
resentatives. 
(4) CYBERSECURITY RISK.—The term ‘‘cybersecurity risk’’ has the 
meaning given the term in section 10545 of this title. 
(5) DIRECTOR.—The term ‘‘Director’’ means the Director of the Of-
fice of Management and Budget. 
(6) INFORMATION SYSTEM.—The term ‘‘information system’’ has the 
meaning given the term in section 10545 of this title. 
(7) INTELLIGENCE
COMMUNITY.—The term ‘‘intelligence commu-
nity’’ has the meaning given the term in section 3 of the National Se-
curity Act of 1947 (50 U.S.C. 3003). 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00148
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
149 
(8) NATIONAL SECURITY SYSTEM.—The term ‘‘national security sys-
tem’’ has the meaning given the term in section 11103 of title 40. 
§ 10582. Advanced internal defenses 
(a) ADVANCED NETWORK SECURITY TOOLS.— 
(1) IN GENERAL.—The Secretary shall include, in the efforts of the 
Department to continuously diagnose and mitigate cybersecurity risks, 
advanced network security tools to improve visibility of network activ-
ity, including through the use of commercial and free or open source 
tools, and to detect and mitigate intrusions and anomalous activity. 
(2) DEVELOPMENT OF PLAN.—The Director shall develop, and the 
Secretary shall implement, a plan to ensure that each agency utilizes 
advanced network security tools, including those described in paragraph 
(1), to detect and mitigate intrusions and anomalous activity. 
(b) PRIORITIZING ADVANCED SECURITY TOOLS.—The Director and the 
Secretary, in consultation with appropriate agencies, shall— 
(1) review and update Government-wide policies and programs to en-
sure appropriate prioritization and use of network security monitoring 
tools in agency networks; and 
(2) brief appropriate congressional committees on the prioritization 
and use. 
(c) IMPROVED METRICS.—The Secretary, in collaboration with the Direc-
tor, shall review and update the metrics used to measure security under sec-
tion 3554 of title 44 to include measures of intrusion and incident detection 
and response times. 
(d) TRANSPARENCY AND ACCOUNTABILITY.—The Director, in consulta-
tion with the Secretary, shall increase transparency to the public on agency 
cybersecurity posture, including by increasing the number of metrics avail-
able on Federal Government performance websites and, to the greatest ex-
tent practicable, displaying metrics for department components, small agen-
cies, and micro-agencies. 
(e) EXCEPTION.—The requirements under this section shall not apply to 
the Department of Defense, a national security system, or an element of 
the intelligence community. 
§ 10583. Federal cybersecurity requirements 
(a) IMPLEMENTATION OF FEDERAL CYBERSECURITY STANDARDS.—Con-
sistent with section 3553 of title 44, the Secretary, in consultation with the 
Director, shall exercise the authority to issue binding operational directives 
to assist the Director in ensuring timely agency adoption of, and compliance 
with, policies and standards promulgated under section 11331 of title 40 
for securing agency information systems. 
(b) CYBERSECURITY REQUIREMENTS AT AGENCIES.— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00149
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
150 
(1) IN GENERAL.—Consistent with policies, standards, guidelines, 
and directives on information security under subchapter II of chapter 
35 of title 44 and the standards and guidelines promulgated under sec-
tion 11331 of title 40 and except as provided in paragraph (2), not 
later than December 18, 2016, the head of each agency shall— 
(A) identify sensitive and mission critical data stored by the 
agency consistent with the inventory required under the first sub-
section (c) (relating to the inventory of major information sys-
tems) and the second subsection (c) (relating to the inventory of 
information systems) of section 3505 of title 44; 
(B) assess access controls to the data described in subparagraph 
(A), the need for readily accessible storage of the data, and indi-
viduals’ need to access the data; 
(C) encrypt or otherwise render indecipherable to unauthorized 
users the data described in subparagraph (A) that is stored on or 
transiting agency information systems; 
(D) implement a single sign-on trusted identity platform for in-
dividuals accessing each public website of the agency that requires 
user authentication, as developed by the Administrator of General 
Services in collaboration with the Secretary; and 
(E) implement identity management consistent with section 504 
of the Cybersecurity Enhancement Act of 2014 (15 U.S.C. 7464), 
including multi-factor authentication, for— 
(i) remote access to an agency information system; and 
(ii) each user account with elevated privileges on an agency 
information system. 
(2) EXCEPTION.—The requirements under paragraph (1) shall not 
apply to an agency information system for which— 
(A) the head of the agency has personally certified to the Direc-
tor with particularity that— 
(i) operational requirements articulated in the certification 
and related to the agency information system would make it 
excessively burdensome to implement the cybersecurity re-
quirement; 
(ii) the cybersecurity requirement is not necessary to secure 
the agency information system or agency information stored 
on or transiting it; and 
(iii) the agency has taken all necessary steps to secure the 
agency information system and agency information stored on 
or transiting it; and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00150
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
151 
(B) the head of the agency or the designee of the head of the 
agency has submitted the certification described in subparagraph 
(A) to the appropriate congressional committees and the agency’s 
authorizing committees. 
(3) CONSTRUCTION.— 
(A) AUTHORITY OF OFFICIALS NOT ALTERED.—Nothing in this 
section shall be construed to alter the authority of the Secretary, 
the Director, or the Director of the National Institute of Stand-
ards and Technology in implementing subchapter II of chapter 35 
of title 44. 
(B) DEVELOPMENT OF TECHNOLOGY, STANDARDS, POLICIES, 
AND GUIDELINES NOT AFFECTED.—Nothing in this section shall 
be construed to affect the National Institute of Standards and 
Technology standards process or the requirement under section 
3553(a)(4) of title 44 or to discourage continued improvements 
and advancements in the technology, standards, policies, and 
guidelines used to promote Federal information security. 
(c) EXCEPTION.—The requirements under this section do not apply to the 
Department of Defense, a national security system, or an element of the 
intelligence community. 
§ 10584. Assessment; reports 
(a) DEFINITIONS.—In this section: 
(1) AGENCY INFORMATION.—The term ‘‘agency information’’ has the 
meaning given the term in section 10549 of this title. 
(2) CYBER THREAT INDICATOR; DEFENSIVE MEASURE.—The terms 
‘‘cyber threat indicator’’ and ‘‘defensive measure’’ have the meanings 
given the terms in section 10561 of this title. 
(3) INTRUSION ASSESSMENTS.—The term ‘‘intrusion assessments’’ 
means actions taken under the intrusion assessment plan to identify 
and remove intruders in agency information systems. 
(4) INTRUSION ASSESSMENT PLAN.—The term ‘‘intrusion assess-
ment plan’’ means the plan required under section 10546(b) of this 
title. 
(5) INTRUSION DETECTION AND PREVENTION CAPABILITIES.—The 
term ‘‘intrusion detection and prevention capabilities’’ means the capa-
bilities required under section 10549(b) of this title. 
(b) THIRD-PARTY ASSESSMENT.—Not later than December 18, 2018, the 
Comptroller General shall conduct a study and publish a report on the effec-
tiveness of the approach and strategy of the Federal Government to secur-
ing agency information systems, including the intrusion detection and pre-
vention capabilities and the intrusion assessment plan. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00151
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
152 
(c) REPORTS TO CONGRESS.— 
(1) INTRUSION DETECTION AND PREVENTION CAPABILITIES.— 
(A) SECRETARY.—The Secretary not later than June 18 each 
year shall submit to the appropriate congressional committees a 
report on the status of the implementation of the intrusion detec-
tion and prevention capabilities, including— 
(i) a description of privacy controls; 
(ii) a description of the technologies and capabilities uti-
lized to detect cybersecurity risks in network traffic, including 
the extent to which those technologies and capabilities include 
existing commercial and noncommercial technologies; 
(iii) a description of the technologies and capabilities uti-
lized to prevent network traffic associated with cybersecurity 
risks from transiting or traveling to or from agency informa-
tion systems, including the extent to which those technologies 
and capabilities include existing commercial and noncommer-
cial technologies; 
(iv) a list of the types of indicators or other identifiers or 
techniques used to detect cybersecurity risks in network traf-
fic transiting or traveling to or from agency information sys-
tems on each iteration of the intrusion detection and preven-
tion capabilities, and the number of each type of indicator, 
identifier, and technique; 
(v) the number of instances in which the intrusion detec-
tion and prevention capabilities detected a cybersecurity risk 
in network traffic transiting or traveling to or from agency 
information systems and the number of times the intrusion 
detection and prevention capabilities blocked network traffic 
associated with cybersecurity risk; and 
(vi) a description of the pilot established under section 
10549(c)(5) of this title, including the number of new tech-
nologies tested and the number of participating agencies. 
(B) DIRECTOR.—Not later than June 18, 2017, and annually 
thereafter, the Director shall submit to Congress, as part of the 
report required under section 3553(c) of title 44, an analysis of 
agency application of the intrusion detection and prevention capa-
bilities, including— 
(i) a list of each agency and the degree to which each agen-
cy has applied the intrusion detection and prevention capabili-
ties to an agency information system; and 
(ii) a list by agency of— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00152
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
153 
(I) the number of instances in which the intrusion de-
tection and prevention capabilities detected a cybersecu-
rity risk in network traffic transiting or traveling to or 
from an agency information system and the types of in-
dicators, identifiers, and techniques used to detect the 
cybersecurity risks; and 
(II) the number of instances in which the intrusion de-
tection and prevention capabilities prevented network 
traffic associated with a cybersecurity risk from 
transiting or traveling to or from an agency information 
system and the types of indicators, identifiers, and tech-
niques used to detect the agency information systems. 
(C) CHIEF INFORMATION OFFICER.—Not earlier than June 18, 
2017, and not later than December 18, 2017, the Federal Chief 
Information Officer shall review and submit to the appropriate 
congressional committees a report assessing the intrusion detection 
and intrusion prevention capabilities, including— 
(i) the effectiveness of the system in detecting, disrupting, 
and preventing cyber-threat actors, including advanced per-
sistent threats, from accessing agency information and agency 
information systems; 
(ii) whether the intrusion detection and prevention capabili-
ties, continuous diagnostics and mitigation, and other systems 
deployed under subtitle C of title II of the Homeland Security 
Act of 2002 (Public Law 107–296, 116 Stat. 2155) are effec-
tive in securing Federal information systems; 
(iii) the costs and benefits of the intrusion detection and 
prevention capabilities, including as compared to commercial 
technologies and tools and including the value of classified 
cyber threat indicators; and 
(iv) the capability of agencies to protect sensitive cyber 
threat indicators and defensive measures if they were shared 
through unclassified mechanisms for use in commercial tech-
nologies and tools. 
(2) DEVELOPMENT AND IMPLEMENTATION OF INTRUSION ASSESS-
MENT PLAN, ADVANCED INTERNAL DEFENSES, AND FEDERAL CYBER-
SECURITY REQUIREMENTS.—The Director— 
(A) 30 days after any update to the intrusion assessment plan, 
shall submit the intrusion assessment plan to the appropriate con-
gressional committees; 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00153
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
154 
(B) not later than December 18, 2016, and annually thereafter, 
shall submit to Congress, as part of the report required under sec-
tion 3553(c) of title 44— 
(i) a description of the implementation of the intrusion as-
sessment plan; 
(ii) the findings of the intrusion assessments conducted 
pursuant to the intrusion assessment plan; 
(iii) a description of the advanced network security tools in-
cluded in the efforts to continuously diagnose and mitigate 
cybersecurity risks pursuant to section 10582(a)(1) of this 
title; and 
(iv) a list by agency of compliance with the requirements 
of section 10583(b) of this title; and 
(C) not later than December 18, 2016, submit to the appro-
priate congressional committees— 
(i) a copy of the plan developed pursuant to section 
10582(a)(2) of this title; and 
(ii) the improved metrics developed pursuant to section 
10582(c) of this title. 
(3) TERMINATION.—The requirements under this subsection termi-
nate on December 18, 2022. 
(d) FORM.—Each report required under this section shall be submitted 
in unclassified form, but may include a classified annex. 
Part D—Other Cyber Matters 
§ 10591. Apprehension and prosecution of international 
cyber criminals 
(a) DEFINITION OF INTERNATIONAL CYBER CRIMINAL.—In this section, 
the term ‘‘international cyber criminal’’ means an individual— 
(1) who is believed to have committed a cybercrime or intellectual 
property crime against the interests of the United States or the citizens 
of the United States; and 
(2) for whom— 
(A) an arrest warrant has been issued by a judge in the United 
States; or 
(B) an international wanted notice (commonly referred to as a 
‘‘Red Notice’’) has been circulated by Interpol. 
(b) CONSULTATIONS FOR NONCOOPERATION.—The Secretary of State 
shall consult with the appropriate government official of each country from 
which extradition is not likely due to the lack of an extradition treaty with 
the United States or other reasons, in which 1 or more international cyber 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00154
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
155 
criminals are physically present, to determine what actions the government 
of the country has taken— 
(1) to apprehend and prosecute the criminals; and 
(2) to prevent the criminals from carrying out cybercrimes or intel-
lectual property crimes against the interests of the United States or its 
citizens. 
(c) ANNUAL REPORT.— 
(1) DEFINITION OF APPROPRIATE CONGRESSIONAL COMMITTEES.— 
For purposes of this subsection, the term ‘‘appropriate congressional 
committees’’ means— 
(A) the Committee on Foreign Relations, the Committee on Ap-
propriations, the Committee on Homeland Security and Govern-
mental Affairs, the Committee on Banking, Housing, and Urban 
Affairs, the Select Committee on Intelligence, and the Committee 
on the Judiciary of the Senate; and 
(B) the Committee on Foreign Affairs, the Committee on Ap-
propriations, the Committee on Homeland Security, the Com-
mittee on Financial Services, the Permanent Select Committee on 
Intelligence, and the Committee on the Judiciary of the House of 
Representatives. 
(2) CONTENTS.—The Secretary of State shall submit to the appro-
priate congressional committees an annual report that includes— 
(A) the number of international cyber criminals located in other 
countries, disaggregated by country, and indicating from which 
countries extradition is not likely due to the lack of an extradition 
treaty with the United States or other reasons; 
(B) the nature and number of significant discussions by an offi-
cial of the Department of State on ways to thwart or prosecute 
international cyber criminals with an official of another country, 
including the name of each country; and 
(C) for each international cyber criminal who was extradited to 
the United States during the most recently completed calendar 
year— 
(i) his or her name; 
(ii) the crimes for which he or she was charged; 
(iii) his or her previous country of residence; and 
(iv) the country from which he or she was extradited to the 
United States. 
(3) FORM.—The report shall be in unclassified form to the maximum 
extent possible, but may include a classified annex. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00155
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
156 
§ 10592. Enhancement of emergency services 
(a) COLLECTION OF DATA.—The Secretary, acting through the National 
Cybersecurity and Communications Integration Center, in coordination with 
appropriate Federal entities and the Director for Emergency Communica-
tions, shall establish a process by which a Statewide Interoperability Coordi-
nator may report data on any cybersecurity risk or incident involving any 
information system or network used by emergency response providers in 
that State. 
(b) ANALYSIS OF DATA.—Not later than December 18, 2016, the Sec-
retary, acting through the Director of the National Cybersecurity and Com-
munications Integration Center, in coordination with appropriate entities 
and the Director for Emergency Communications, and in consultation with 
the Secretary of Commerce, acting through the Director of the National In-
stitute of Standards and Technology, shall conduct integration and analysis 
of the data reported under subsection (a) to develop information and rec-
ommendations on security and resilience measures for any information sys-
tem or network used by State emergency response providers. 
(c) BEST PRACTICES.— 
(1) IN GENERAL.—Using the results of the integration and analysis 
conducted under subsection (b), and any other relevant information, 
the Director of the National Institute of Standards and Technology 
shall, on an ongoing basis, facilitate and support the development of 
methods for reducing cybersecurity risks to emergency response pro-
viders using the process described in section 2(e) of the National Insti-
tute of Standards and Technology Act (15 U.S.C. 272(e)). 
(2) REPORT.—The Director of the National Institute of Standards 
and Technology shall submit to Congress a report on the result of the 
activities of the Director under paragraph (1), including any methods 
developed by the Director under paragraph (1), and shall make the re-
port publicly available on the website of the National Institute of 
Standards and Technology. 
(d) RULE OF CONSTRUCTION.—Nothing in this section shall be construed 
to— 
(1) require a State to report data under subsection (a); or 
(2) require a non-Federal entity (as defined in section 10561 of this 
title) to— 
(A) adopt a recommended measure developed under subsection 
(b); or 
(B) follow the result of the activities carried out under sub-
section (c), including any methods developed under subsection (c). 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00156
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS