ernmental or private entity pursuant to this section shall 
not create a right or benefit, substantive or procedural, 
to similar assistance or information for any other govern-
mental or private entity. 
‘‘(f) SAVINGS CLAUSE.—Nothing in this subtitle shall 
be interpreted to alter or amend the law enforcement or 
intelligence authorities of any agency. 
‘‘(g) DEFINITIONS.—In this section: 
‘‘(1) The term ‘Federal systems’ means all in-
formation systems owned, operated, leased, or other-
wise controlled by an agency, or on behalf of an 
agency, except for national security systems or those 
information systems under the control of the De-
partment of Defense. 
‘‘(2) The term ‘critical infrastructure informa-
tion systems’ means any physical or virtual informa-
tion system that controls, processes, transmits, re-
ceives, or stores electronic information in any form, 
including data, voice, or video, that is— 
‘‘(A) vital to the functioning of critical in-
frastructure as defined in section 5195c(e) of 
title 42; or 
‘‘(B) owned or operated by or on behalf of 
a State or local government entity that is nec-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
essary to ensure essential government oper-
ations continue. 
‘‘SEC. 227. IDENTIFICATION OF SECTOR SPECIFIC CYBER-
SECURITY RISKS. 
‘‘(a) IN GENERAL.—The Secretary shall, on a contin-
uous and sector-by-sector basis, identify and evaluate cy-
bersecurity risks to critical infrastructure. In carrying out 
this subsection, the Secretary shall coordinate, as appro-
priate, with the following: 
‘‘(1) The head of the sector specific agency with 
responsibility for critical infrastructure. 
‘‘(2) The head of any agency with responsibil-
ities for regulating the critical infrastructure. 
‘‘(3) The owners and operators of critical infra-
structure and any private sector entity determined 
appropriate by the Secretary. 
‘‘(b) EVALUATION OF RISKS.—The Secretary, in co-
ordination with the individuals and entities referred to in 
subsection (a), shall evaluate the cybersecurity risks iden-
tified under subsection (a) by taking into account each of 
the following: 
‘‘(1) The actual or assessed threat, including a 
consideration of adversary capabilities and intent, 
preparedness, target attractiveness, and deterrence 
capabilities. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(2) The extent and likelihood of death, injury, 
or serious adverse effects to human health and safe-
ty caused by a disruption, destruction, or unauthor-
ized use of critical infrastructure. 
‘‘(3) The threat to national security caused by 
the disruption, destruction or unauthorized use of 
critical infrastructure. 
‘‘(4) The harm to the economy that would re-
sult from the disruption, destruction, or unauthor-
ized use of critical infrastructure. 
‘‘(5) Other risk-based security factors that the 
Secretary, in consultation with the head of the sec-
tor specific agency with responsibility for critical in-
frastructure and the head of any Federal agency 
that is not a sector specific agency with responsibil-
ities for regulating critical infrastructure, and in 
consultation with any private sector entity deter-
mined appropriate by the Secretary to protect public 
health and safety, critical infrastructure, or national 
and economic security. 
‘‘(c) AVAILABILITY OF IDENTIFIED RISKS.—The Sec-
retary shall ensure that the risks identified and evaluated 
under this section for each sector and subsector are made 
available to the owners and operators of critical infrastruc-
ture within each sector and subsector. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(d) COLLECTION OF RISK-BASED PERFORMANCE 
STANDARDS.— 
‘‘(1) REVIEW AND ESTABLISHMENT.—The Sec-
retary, in coordination with the heads of other ap-
propriate agencies, shall review existing internation-
ally recognized consensus-developed risk-based per-
formance standards, including such standards devel-
oped by the National Institute of Standards and 
Technology, for inclusion in a common collection. 
Such collection shall include, for each such risk- 
based performance standard, an analysis of each of 
the following: 
‘‘(A) How well the performance standard 
addresses the identified risks. 
‘‘(B) How cost-effective the standard im-
plementation of the performance standard can 
be. 
‘‘(2) USE OF COLLECTION.—The Secretary, in 
conjunction with the heads of other appropriate 
agencies, shall develop market-based incentives de-
signed to encourage the use of the collection estab-
lished under paragraph (1). 
‘‘(3) INCLUSION IN REGULATORY REGIMES.— 
The heads of sector specific agencies with responsi-
bility for covered critical infrastructure and the head 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
of any Federal agency that is not a sector specific 
agency with responsibilities for regulating covered 
critical infrastructure, in consultation with the Sec-
retary and with any private sector entity determined 
appropriate by the Secretary, shall propose through 
notice and comment rulemaking to include the most 
effective and cost-efficient risk-based performance 
standards identified in the collection established 
under paragraph (1) in the regulatory regimes appli-
cable to covered critical infrastructure. 
‘‘(e) MITIGATION OF RISKS.—If the Secretary deter-
mines that no existing internationally-recognized risk- 
based performance standard mitigates a risk identified 
under subsection (a), the Secretary shall— 
‘‘(1) work with owners and operators of critical 
infrastructure and suppliers of technology to appro-
priately mitigate the identified risk, including deter-
mining appropriate market-based incentives for de-
velopment and implementation of the identified miti-
gation; and 
‘‘(2) engage with the National Institute of 
Standards and Technology and appropriate inter-
national consensus bodies that develop and strength-
en standards and practices to address the identified 
risk. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(f) COVERED
CRITICAL
INFRASTRUCTURE
DE-
FINED.—In this section, the term ‘covered critical infra-
structure’ means any facility or function that, by way of 
cyber vulnerability, the destruction or disruption of or un-
authorized access to could result in— 
‘‘(1) a significant loss of life; 
‘‘(2) a major economic disruption, including— 
‘‘(A) the immediate failure of, or loss of 
confidence in, a major financial market; or 
‘‘(B) the sustained disruption of financial 
systems that would lead to long term cata-
strophic economic damage to the United States; 
‘‘(3) mass evacuations of a major population 
center for an extended length of time; or 
‘‘(4) severe degradation of national security or 
national security capabilities, including intelligence 
and defense functions, but excluding military facili-
ties. 
‘‘(g) REDRESS.— 
‘‘(1) IN GENERAL.—Subject to paragraphs (2) 
and (3), the Secretary shall develop a mechanism, 
consistent with subchapter II of chapter 5 of title 5, 
United States Code, for an owner or operator noti-
fied under subsection (f) to appeal the identification 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
of a facility or function as covered critical infrastruc-
ture under this section. 
‘‘(2) APPEAL TO FEDERAL COURT.—A civil ac-
tion seeking judicial review of a final agency action 
taken under the mechanism developed under para-
graph (1) shall be filed in the United States District 
Court for the District of Columbia. 
‘‘(3) COMPLIANCE.—The owner or operator of a 
facility or function identified as covered critical in-
frastructure shall comply with any requirement of 
this subtitle relating to covered critical infrastruc-
ture until such time as the facility or function is no 
longer identified as covered critical infrastructure, 
based on— 
‘‘(A) an appeal under paragraph (1); 
‘‘(B) a determination of the Secretary un-
related to an appeal; or 
‘‘(C) a final judgment entered in a civil ac-
tion seeking judicial review brought in accord-
ance with paragraph (2). 
‘‘SEC. 228. INFORMATION SHARING. 
‘‘(a) CYBERSECURITY INFORMATION.—The Secretary 
shall be responsible for making all cyber threat informa-
tion, provided pursuant to section 202 of this title, avail-
able to appropriate owners and operators of critical infra-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
structure on a timely basis consistent with the responsibil-
ities of the Secretary to provide information related to 
threats to critical infrastructures to the organization des-
ignated under section 241. 
‘‘(b) INFORMATION SHARING.—The Secretary shall, 
to the maximum extent possible, consistent with rules for 
the handling of classified and sensitive but unclassified in-
formation, share relevant information regarding cyberse-
curity threats and vulnerabilities, and any proposed ac-
tions to mitigate them, with all Federal agencies, appro-
priate State or local government representatives, and ap-
propriate critical infrastructure information systems own-
ers and operators, including by expediting necessary secu-
rity clearances for designated points of contact for critical 
infrastructure information systems. 
‘‘(c) PROTECTION OF INFORMATION.—The Secretary 
shall designate, as appropriate, information received from 
Federal agencies and from critical infrastructure informa-
tion systems owners and operators and information pro-
vided to Federal agencies or critical infrastructure infor-
mation systems owners and operators pursuant to this sec-
tion as sensitive security information and shall require and 
enforce sensitive security information requirements for 
handling, storage, and dissemination of any such informa-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
tion, including proper protections for personally identifi-
able information. 
‘‘SEC. 229. CYBERSECURITY RESEARCH AND DEVELOP-
MENT. 
‘‘(a) IN GENERAL.—The Under Secretary for Science 
and Technology shall support research, development, test-
ing, evaluation, and transition of cybersecurity technology, 
including fundamental, long-term research to improve the 
ability of the United States to prevent, protect against, 
detect, respond to, and recover from acts of terrorism and 
cyber attacks, with an emphasis on research and develop-
ment relevant to attacks that would cause a debilitating 
impact on national security, national economic security, 
or national public health and safety. 
‘‘(b) ACTIVITIES.—The research and development 
testing, evaluation, and transition supported under sub-
section (a) shall include work to— 
‘‘(1) advance the development and accelerate 
the deployment of more secure versions of funda-
mental Internet protocols and architectures, includ-
ing for the domain name system and routing proto-
cols; 
‘‘(2) improve, create, and advance the research 
and development of techniques and technologies for 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
proactive detection and identification of threats, at-
tacks, and acts of terrorism before they occur; 
‘‘(3) advance technologies for detecting attacks 
or intrusions, including real-time monitoring and 
real-time analytic technologies; 
‘‘(4) improve and create mitigation and recov-
ery methodologies, including techniques and policies 
for real-time containment of attacks and develop-
ment of resilient networks and systems; 
‘‘(5) develop and support infrastructure and 
tools to support cybersecurity research and develop-
ment efforts, including modeling, test beds, and data 
sets for assessment of new cybersecurity tech-
nologies; 
‘‘(6) assist in the development and support of 
technologies to reduce vulnerabilities in process con-
trol systems; 
‘‘(7) develop and support cyber forensics and 
attack attribution; 
‘‘(8) test, evaluate, and facilitate the transfer of 
technologies associated with the engineering of less 
vulnerable software and securing the information 
technology software development lifecycle; and 
‘‘(9) ensure new cybersecurity technologies are 
scientifically and operationally validated. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(c) COORDINATION.—In carrying out this section, 
the Under Secretary shall coordinate activities with— 
‘‘(1) the Under Secretary for National Protec-
tion and Programs Directorate; and 
‘‘(2) the heads of other relevant Federal depart-
ments and agencies, including the National Science 
Foundation, 
the 
Defense 
Advanced 
Research 
Projects Agency, the Information Assurance Direc-
torate of the National Security Agency, the National 
Institute of Standards and Technology, the Depart-
ment of Commerce, academic institutions, and other 
appropriate working groups established by the Presi-
dent to identify unmet needs and cooperatively sup-
port activities, as appropriate. 
‘‘SEC. 230. PERSONNEL AUTHORITIES RELATED TO THE OF-
FICE OF CYBERSECURITY AND COMMUNICA-
TIONS. 
‘‘(a) IN GENERAL.—In order to assure that the De-
partment has the necessary resources to carry out the mis-
sion of securing Federal systems and critical infrastruc-
ture information systems, the Secretary may, as nec-
essary, convert competitive service positions, and the in-
cumbents of such positions, within the Office of Cyberse-
curity and Communications to excepted service, or may 
establish new positions within the Office of Cybersecurity 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
and Communications in the excepted service, to the extent 
that the Secretary determines such positions are necessary 
to carry out the cybersecurity functions of the Depart-
ment. 
‘‘(b) COMPENSATION.—The Secretary may— 
‘‘(1) fix the compensation of individuals who 
serve in positions referred to in subsection (a) in re-
lation to the rates of pay provided for comparable 
positions in the Department and subject to the same 
limitations on maximum rates of pay established for 
employees of the Department by law or regulations; 
and 
‘‘(2) provide additional forms of compensation, 
including benefits, incentives, and allowances, that 
are consistent with and not in excess of the level au-
thorized for comparable positions authorized under 
title 5, United States Code. 
‘‘(c) RETENTION BONUSES.—Notwithstanding any 
other provision of law, the Secretary may pay a retention 
bonus to any employee appointed under this section, if the 
Secretary determines that the bonus is needed to retain 
essential personnel. Before announcing the payment of a 
bonus under this subsection, the Secretary shall submit 
a written explanation of such determination to the Com-
mittee on Homeland Security of the House of Representa-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
tives and the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate. 
‘‘(d) ANNUAL REPORT.—Not later than one year 
after the date of the enactment of this section, and annu-
ally thereafter, the Secretary shall submit to the Com-
mittee on Homeland Security of the House of Representa-
tives and the Committee on Homeland Security and Gov-
ernment Affairs of the Senate a detailed report that in-
cludes, for the period covered by the report— 
‘‘(1) a discussion the Secretary’s use of the 
flexible authority authorized under this section to re-
cruit and retain qualified employees; 
‘‘(2) metrics on relevant personnel actions, in-
cluding— 
‘‘(A) the number of qualified employees 
hired by occupation and grade, level, or pay 
band; 
‘‘(B) the total number of veterans hired; 
‘‘(C) the number of separations of qualified 
employees; 
‘‘(D) the number of retirements of quali-
fied employees; and 
‘‘(E) the number and amounts of recruit-
ment, relocation, and retention incentives paid 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
to qualified employees by occupation and grade, 
level, or pay band; and 
‘‘(3) long-term and short-term strategic goals to 
address critical skills deficiencies, including an anal-
ysis of the numbers of and reasons for attrition of 
employees and barriers to recruiting and hiring indi-
viduals qualified in cybersecurity.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 2(b) of such Act is amended by inserting after 
the item relating to section 225 the following new items: 
‘‘Sec. 226. National cybersecurity authority. 
‘‘Sec. 227. Identification of sector specific cybersecurity risks. 
‘‘Sec. 228. Information sharing. 
‘‘Sec. 229. Cybersecurity research and development. 
‘‘Sec. 230. Personnel authorities related to the Office of Cybersecurity and 
Communications.’’. 
(c) PLAN FOR EXECUTION OF AUTHORITIES.—Not 
later than 120 days after the date of the enactment of 
this Act, the Secretary of Homeland Security shall submit 
to the Committee on Homeland Security of the House of 
Representatives and the Committee on Homeland Security 
and Governmental Affairs of the Senate a report con-
taining a plan for the execution of the authorities con-
tained in the amendment made by subsection (a). 
SEC. 3. NATIONAL INFORMATION SHARING ORGANIZATION. 
(a) NATIONAL INFORMATION SHARING ORGANIZA-
TION.— 
VerDate Mar 15 2010 
23:33 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
(1) IN GENERAL.—Title II of the Homeland Se-
curity Act of 2002, as amended by section 2, is fur-
ther amended by adding at the end the following: 
‘‘Subtitle E—National Information 
Sharing Organization 
‘‘SEC. 241. ESTABLISHMENT OF NATIONAL INFORMATION 
SHARING ORGANIZATION. 
‘‘(a) ESTABLISHMENT.—There is established a not- 
for-profit organization for sharing cyber threat informa-
tion and exchanging technical assistance, advice, and sup-
port and developing and disseminating necessary informa-
tion security technology. Such organization shall be des-
ignated as the ‘National Information Sharing Organiza-
tion’. 
‘‘(b) PURPOSE.—The National Information Sharing 
Organization shall serve as a national clearinghouse for 
the exchange of cyber threat information so that the own-
ers and operators of networks or systems in the private 
sector, educational institutions, State, tribal, and local 
governments, entities operating critical infrastructure, and 
the Federal Government have access to timely and action-
able information in order to protect their networks or sys-
tems as effectively as possible. 
‘‘(c) DESIGNATION.—Not later than 120 days after 
the date of the enactment of this subtitle, the board of 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
directors established in section 243 shall designate the ap-
propriate organization or organizations as the National 
Information Sharing Organization. 
‘‘(d) CRITERIA FOR DESIGNATION.—The board of di-
rectors shall select the organization or organizations to 
function as the National Information Sharing Organiza-
tion by taking into consideration the following criteria and 
other criteria found appropriate by the board: 
‘‘(1) Whether the organization or organizations 
have received recognition from the Secretary of 
Homeland Security for its cyber capabilities. 
‘‘(2) Whether the organization or organizations 
have demonstrated the ability to address cyber-re-
lated issues in a trusted and cooperative environ-
ment maximizing public-private partnerships. 
‘‘(3) Whether the organization or organizations 
have demonstrated the capability to deploy cyberse-
curity services for the detection, prevention, and 
mitigation of cyber-related issues. 
‘‘(4) Whether the organization or organizations 
have an operational center that is open 24 hours a 
day, seven days a week, and is capable of deter-
mining, analyzing, and responding to cyber events. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(5) Whether the organization or organizations 
have a proven relationship with the private sector 
critical infrastructure sectors. 
‘‘(6) Whether the organization or organizations 
have experience implementing privacy protections to 
safeguard, sensitive information, including person-
ally identifiable information, in transit and at rest. 
‘‘SEC. 242. MISSION AND ACTIVITIES. 
‘‘The National Information Sharing Organization 
shall— 
‘‘(1) facilitate the exchange of information, best 
practices, technical assistance, and support related 
to the security of public, private, and critical infra-
structure information networks, including by— 
‘‘(A) ensuring that the information ex-
changed shall be stripped of all information 
identifying the submitter and of any unneces-
sary personally identifiable information and 
shall be available to members of the National 
Information Sharing Organization, including 
Federal, State, and local government agencies; 
and 
‘‘(B) sharing timely and actionable threat 
and 
vulnerability 
information 
originating 
through intelligence collection with appro-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(C) Defense industrial base. 
‘‘(D) Energy, electricity subsector. 
‘‘(E) Energy, oil, and natural gas sub-
sector. 
‘‘(F) Heath care and public health. 
‘‘(G) Information technology. 
‘‘(4) Two representatives from the privacy and 
civil liberties community. 
‘‘(5) The Chair of the National Council of In-
formation Sharing and Analysis Centers. 
‘‘(c) INITIAL APPOINTMENT.—Not later than 30 days 
after the date of the enactment of this subtitle, the Sec-
retary of Homeland Security, in consultation with the 
heads of the sector specific agencies of the sectors and 
subsectors referred to in subsection (b)(3), shall appoint 
the members of the board described under subsection 
(b)(3) from individuals identified by the sector coordi-
nating councils of sectors and subsectors referred to in 
subsection (b)(3). 
‘‘(d) TERMS.— 
‘‘(1) REPRESENTATIVES OF CERTAIN FEDERAL 
AGENCIES.—Each member of the board described in 
subsection (b)(1) and (b)(2) shall be appointed for 
a term that is not less than one year and not longer 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
than three years from the date of the member’s ap-
pointment. 
‘‘(2) OTHER REPRESENTATIVES.—The original 
private sector members of the board described sub-
section (b) shall serve an initial term of one year 
from the date of appointment under subsection (c), 
at which time the members of the National Informa-
tion Sharing Organization shall conduct elections in 
accordance with the procedures established under 
subsection (e). 
‘‘(e) RULES AND PROCEDURES.—Not later than 90 
days after the date of the enactment of this Act, the board 
shall establish rules and procedures for the election and 
service of members of the board described in paragraphs 
(3) and (4) of subsection (b). 
‘‘(f) LEADERSHIP.—The board shall elect from 
among its members a chair and vice-chair of the board, 
who shall serve under such terms and conditions as the 
board may establish. The chair of the board may not be 
a Federal employee. 
‘‘(g) SUB-BOARDS.—The board shall have the au-
thority to constitute such sub-boards, or other advisory 
groups or panels, as may be necessary to assist the board 
in carrying out its functions under this section. The board 
shall establish an advisory group made up of the members 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
determined appropriate to participate in the common oper-
ation picture described in section 242(2) and to determine 
information sets, sharing procedures, and operational pro-
tocols in creating the common operating picture. 
‘‘SEC. 244. CHARTER. 
‘‘The board shall develop a charter to govern the op-
erations and administration of the National Information 
Sharing Organization. The charter shall cover each of the 
following: 
‘‘(1) The organizational structure of the Na-
tional Information Sharing Organization. 
‘‘(2) The governance of the National Informa-
tion Sharing Organization. 
‘‘(3) A mission statement of the National Infor-
mation Sharing Organization. 
‘‘(4) Criteria for membership of the National 
Information Sharing Organization and for termi-
nation of such membership. 
‘‘(5) A funding model of the National Informa-
tion Sharing Organization, including costs, if any, 
for membership. 
‘‘(6) Rules for sharing information with mem-
bers of the National Information Sharing Organiza-
tion, including the treatment and ownership of intel-
lectual property provided by or to the National In-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
formation Sharing Organization, limitations on li-
ability, and consideration of any necessary measures 
to mitigate anti-trust concerns. 
‘‘(7) Technical requirements for participation in 
the common operating picture and a technical archi-
tecture that enables an automated, real-time sharing 
among members and Federal Government agencies. 
‘‘(8) Rules for participating in collaborative re-
search and development projects. 
‘‘(9) Protections of privacy and civil liberties to 
be used by the National Information Sharing Orga-
nization and its members, including appropriate 
measures for public transparency and oversight. 
‘‘(10) Security requirements and member obli-
gations for the protection of information from other 
sources, including private and governmental. 
‘‘(11) Procedures for making anonymized cyber 
incident information available to outside groups for 
academic research and insurance actuarial purposes. 
‘‘SEC. 245. MEMBERSHIP. 
‘‘Not later than 90 days after the date of the enact-
ment of this subtitle, the board of directors of the National 
Information Sharing Organization shall establish criteria 
procedures for the voluntary membership by State and 
local government departments, agencies, and entities, pri-
VerDate Mar 15 2010 
23:33 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
vate sector businesses and organizations, and academic in-
stitutions in the National Information Sharing Organiza-
tion. 
‘‘SEC. 246. FUNDING. 
‘‘Annual administrative and operational expenses for 
the National Information Sharing Organization shall be 
paid by the members of such Organization, as determined 
by the board of directors of the Organization. 
‘‘SEC. 247. CLASSIFIED INFORMATION. 
‘‘Consistent with the protection of sensitive intel-
ligence sources and methods, the Secretary, in conjunction 
with the Director of National Intelligence, shall facili-
tate— 
‘‘(1) the sharing of classified information in the 
possession of a Federal agency related to threats to 
information networks with cleared members of the 
National Information Sharing Organization, includ-
ing representatives of the private sector and of pub-
lic and private sector entities operating critical infra-
structure; and 
‘‘(2) the declassification and sharing of infor-
mation in the possession of a Federal agency related 
to threats to information networks with members of 
the National Information Sharing Organization. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘SEC. 248. VOLUNTARY INFORMATION SHARING. 
‘‘(a) IN GENERAL.— 
‘‘(1) CYBERSECURITY
PROVIDERS.—Notwith-
standing any other provision of law, a cybersecurity 
provider may, with the express consent of a pro-
tected entity for which such cybersecurity provider is 
providing goods or services for cybersecurity pur-
poses, use cybersecurity systems to identify and ob-
tain cyber threat information to protect the rights 
and property of such protected entity. 
‘‘(2) PROTECTED
ENTITIES.—Notwithstanding 
any other provision of law, a protected entity may, 
for cybersecurity purposes— 
‘‘(A) share cyber threat information with 
the National Information Sharing Organization 
and its membership, including the Federal Gov-
ernment; or 
‘‘(B) authorize their cybersecurity provider 
to share on their behalf with the National In-
formation Sharing Organization and its mem-
bership, including the Federal Government. 
‘‘(3) SELF-PROTECTED
ENTITIES.—Notwith-
standing any other provision of law, a self-protected 
entity may, for cybersecurity purposes— 
‘‘(A) use cybersecurity systems to identify 
and obtain cyber threat information to protect 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
purpose of facilitating the missions of such Organi-
zation, as articulated in the mission statement re-
quired under section 244; 
‘‘(3) shall not, without the written consent of 
the person or entity submitting such information, be 
used or disclosed by any officer or employee of the 
United States for purposes other than the purposes 
of this title, including any regulatory purpose, ex-
cept— 
‘‘(A) to further an investigation or the 
prosecution of a cybersecurity related criminal 
act; or 
‘‘(B) to disclose the information to the ap-
propriate congressional committee; 
‘‘(4) shall not, if subsequently provided to a 
State or local government or government agency— 
‘‘(A) be made available pursuant to any 
State or local law requiring disclosure of infor-
mation or records; 
‘‘(B) otherwise be disclosed or distributed 
to any party by such State or local government 
or government agency without the written con-
sent of the person or entity submitting such in-
formation; or 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS