‘‘(C) be used other than for the purpose of 
protecting information systems, or in further-
ance of an investigation or the prosecution of a 
criminal act; 
‘‘(5) does not constitute a waiver of any appli-
cable privilege or protection provided under law, 
such as information that is proprietary, business 
sensitive, relates specifically to the submitting per-
son or entity, or is otherwise not appropriately in 
the public domain; and 
‘‘(6) shall not be the basis for any civil or crimi-
nal right of action in Federal or State court for a 
failure to warn or disclose provided that the infor-
mation is shared with the Federal Government 
through the National Information Sharing Organiza-
tion in accordance with the procedures established 
under this section. 
‘‘(c) LIMITATION.—The Federal Advisory Committee 
Act (5 U.S.C. App.) shall not apply to any communication 
of information to a Federal agency made pursuant to this 
title. 
‘‘(d) PROCEDURES.— 
‘‘(1) IN
GENERAL.—Not later than 90 days 
after the date of the enactment of this subtitle, the 
board of directors of the National Information Shar-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
ing Organization shall establish uniform procedures 
for the receipt, care, and storage of information that 
is voluntarily submitted to the Federal Government 
through the National Information Sharing Organiza-
tion. 
‘‘(2) ELEMENTS.—The procedures established 
under paragraph (1) shall include procedures for— 
‘‘(A) the acknowledgment of receipt by the 
National Information Sharing Organization of 
cyber threat information that is voluntarily sub-
mitted to the National Information Sharing Or-
ganization; 
‘‘(B) the maintenance of the identification 
of such information; 
‘‘(C) the care and storage of such informa-
tion; 
‘‘(D) limiting subsequent dissemination of 
such information to ensure that such informa-
tion is not used for an unauthorized purpose; 
‘‘(E) the protection of the privacy rights 
and civil liberties of any individuals who are 
subjects of such information; and 
‘‘(F) the protection and maintenance of 
the confidentiality of such information so as to 
permit the sharing of such information within 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
the Federal Government and with State, tribal, 
and local governments, and the issuance of no-
tices and warnings related to the protection of 
information networks, in such manner as to 
protect from public disclosure the identity of 
the submitting person or entity, or information 
that is proprietary, business sensitive, relates 
specifically to the submitting person or entity, 
and is otherwise not appropriately in the public 
domain. 
‘‘(e) INDEPENDENTLY OBTAINED INFORMATION.— 
Nothing in this section shall be construed to limit or other-
wise affect the ability of a Federal agency, a State, tribal, 
or local government or government agency, or any third 
party— 
‘‘(1) to obtain or disseminate cyber threat infor-
mation in a manner other than through the National 
Information Sharing Organization; and 
‘‘(2) to use such information in any manner 
permitted by law. 
‘‘(f) DEFINITIONS.—In this section: 
‘‘(1) The term ‘cybersecurity provider’ means a 
non-governmental entity that provides goods or serv-
ices intended to be used for cybersecurity purposes. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(2) The term ‘cybersecurity purpose’ means 
the purpose of ensuring the integrity, confidentiality, 
or availability of, or safeguarding, a system or net-
work, including protecting a system or network 
from— 
‘‘(A) efforts to degrade, disrupt or destroy 
such system or network; or 
‘‘(B) theft or misappropriation of private 
or government information, intellectual prop-
erty, or personally identifiable information. 
‘‘(3) The term ‘cybersecurity system’ means a 
system designed or employed to ensure the integrity, 
confidentiality, or availability of, or safeguarding, a 
system or network, including protecting a system or 
network from— 
‘‘(A) efforts to degrade, disrupt or destroy 
such system or network; or 
‘‘(B) theft or misappropriation of private 
or government information, intellectual prop-
erty, or personally identifiable information. 
‘‘(4) The term ‘cyber threat information’ means 
information that is— 
‘‘(A) necessary to describe a method of de-
feating technical controls on a system or net-
work that corresponds to a cyber threat; and 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) omits all other information not nec-
essary to describe such threat. 
‘‘(5) The term ‘protected entity’ means an enti-
ty, other than an individual, that contracts with a 
cybersecurity provider for goods or services to be 
used for cybersecurity purposes. 
‘‘(6) The term ‘self-protected entity’ means an 
entity, other than an individual, that provides goods 
or services for cybersecurity purposes to itself. 
‘‘SEC. 249. ANNUAL INDEPENDENT AUDITS. 
‘‘The board of directors of the National Information 
Sharing Organization shall commission, on an annual 
basis, an audit by a qualified, independent auditing firm 
approved by the Secretary, to review the compliance of the 
National Information Sharing Organization and its mem-
bers with the information sharing rules set forth in section 
248 and the information sharing rules established by the 
board pursuant to the National Information Sharing Or-
ganization charter required under section 244. Such 
audit— 
‘‘(1) shall identify instances in which informa-
tion may have been shared in a manner inconsistent 
with procedures required under section 248 or with 
the information sharing rules established by the 
board pursuant to section 244, with the National In-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
formation Sharing Organization, with members of 
the National Information Sharing Organization, or 
by the National Information Sharing Organization 
with a National Information Sharing Organization 
member or other entity or individual; 
‘‘(2) shall be provided to the Secretary and to 
the Committee on Homeland Security of the House 
of Representatives and to the Homeland Security 
and Governmental Affairs Committee of the Senate; 
‘‘(3) shall be made public, with appropriate 
redactions to protect the identity of National Infor-
mation Sharing Organization members; and 
‘‘(4) may include a classified annex. 
‘‘SEC. 250. PENALTIES. 
‘‘(a) IN GENERAL.—It shall be unlawful for any offi-
cer, employee, representative, or agent of the United 
States or of any Federal agency, or any employee or offi-
cer of the National Information Sharing Organization, its 
member entities, and any representatives or agents of the 
National Information Sharing Organization or its member 
entities to knowingly publish, divulge, disclose, or make 
known in any manner or to any extent not authorized by 
law, any cyber threat information protected from disclo-
sure by this title coming to such officer or employee in 
the course of the employee’s employment or official duties 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS