(III) in subparagraph (E)(ii), by 
striking ‘‘and’’ after the semicolon; 
(IV) in subparagraph (F), by 
striking the period and inserting ‘‘; 
and’’; and 
(V) by adding at the end the fol-
lowing new subparagraph: 
‘‘(G) pursuant to section 2212 of the 
Homeland Security Act of 2002 (6 U.S.C. 662), 
provide one-time read-ins, as appropriate, to se-
lect individuals identified by non-Federal enti-
ties that own or operate critical infrastruc-
ture;’’; and 
(ii) in paragraph (2)— 
(I) by inserting ‘‘and, as appro-
priate, updating,’’ after ‘‘developing’’; 
and 
(II) by inserting ‘‘and defensive 
measures’’ after ‘‘promote the sharing 
of cyber threat indicators’’; and 
(C) in subsection (c)— 
(i) by inserting ‘‘and not later than 60 
days after any update, as appropriate, of 
procedures required by subsection (a),’’ 
after ‘‘Act,’’; and 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
(ii) by inserting ‘‘(or update, as ap-
propriate)’’ after ‘‘procedures’’; 
(3) in section 104 (6 U.S.C. 1503; relating to 
authorizations for preventing, detecting, analyzing, 
and mitigating cybersecurity threats)— 
(A) in subsection (c)— 
(i) in paragraph (1), by inserting ‘‘, 
including Sector Risk Management Agen-
cies that are agencies and the majority of 
the systems of which are not covered under 
subsection (d) or (e) of section 3553 of 
title 44, United States Code,’’ after ‘‘Fed-
eral Government’’; 
(ii) in paragraph (3)— 
(I) in the matter preceding sub-
paragraph (A), by striking ‘‘shall be’’ 
and inserting ‘‘may be’’; 
(II) in subparagraph (A), by 
striking ‘‘or’’ after the semicolon; 
(III) in subparagraph (B), by 
striking the period and inserting ‘‘; 
or’’; and 
(IV) by adding at the end the fol-
lowing new subparagraph: 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(C) to preclude the use of artificial intel-
ligence that is developed or strictly deployed for 
cybersecurity purposes in carrying out the ac-
tivities authorized under paragraph (1).’’; and 
(iii) in subparagraph (B) of sub-
section (d)(2), by inserting ‘‘, which may 
utilize artificial intelligence that is devel-
oped or strictly deployed for cybersecurity 
purposes,’’ after ‘‘technical capability’’; 
(4) in section 105 (6 U.S.C. 1504); relating to 
sharing of cyber threat indicators and defensive 
measures with the Federal Government— 
(A) in subsection (a)— 
(i) in paragraph (2), by adding at the 
end the following new sentences: ‘‘As ap-
propriate, the Attorney General and the 
Secretary of Homeland Security shall, in 
consultation with the heads of the appro-
priate Federal entities, jointly update such 
policies and procedures, and issue and 
make publicly available such updated poli-
cies and procedures. Such updates shall 
prioritize rapid dissemination to State, 
local, Tribal, and territorial governments 
and owners and operators of non-Federal 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
critical infrastructure of relevant and ac-
tionable cyber threat indicators and defen-
sive measures.’’; 
(ii) in paragraph (3), in the matter 
preceding subparagraph (A), by striking 
‘‘developed or issued’’ and inserting ‘‘devel-
oped, issued, or, as appropriate, updated,’’; 
and 
(iii) in paragraph (4)— 
(I) in subparagraph (A), by add-
ing at the end the following new sen-
tence: ‘‘As appropriate, the Attorney 
General and the Secretary of Home-
land Security shall jointly update and 
make publicly available such guidance 
to so assist entities and promote such 
sharing of cyber threat indicators and 
defensive measures with such Federal 
entities under this title.’’; and 
(II) in subparagraph (B), in the 
matter preceding clause (i), by insert-
ing ‘‘and, as appropriate, updated,’’ 
after ‘‘developed’’; 
(B) in subsection (b)— 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
(i) in paragraph (2)(B), by inserting 
‘‘, and, as appropriate, update,’’ after ‘‘re-
view’’; and 
(ii) in paragraph (3), in the matter 
preceding subparagraph (A), by inserting 
‘‘and, as appropriate, updated,’’ after ‘‘re-
quired’’; 
(C) in subsection (c)— 
(i) in paragraph (1)(D), by inserting 
‘‘, including if such capability and process 
employs artificial intelligence’’ before the 
semicolon; 
(ii) in paragraph (2), by adding at the 
end the following new subparagraph: 
‘‘(C) OUTREACH.—Not later than 90 days 
after the date of the enactment of this subpara-
graph, the Secretary of Homeland Security 
shall develop and continuously implement an 
outreach plan, including targeted engagement, 
to ensure Federal and non-Federal entities, 
particularly small or rural owners or operators 
of critical infrastructure which often lack dedi-
cated cybersecurity staff but remain vital to na-
tional security— 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(i) are aware of the capability and 
process required by paragraph (1) to share 
cyber threat indicators and defensive meas-
ures, including the benefits real-time infor-
mation sharing provides; 
‘‘(ii) understand how to share cyber 
threat indicators and defensive measures; 
‘‘(iii) understand the obligation to re-
move certain personal information in ac-
cordance with section 104(d)(7) prior to 
sharing a cyber threat indicator; 
‘‘(iv) understand how cyber threat in-
dicators and defensive measures are re-
ceived, processed, used, and protected; 
‘‘(v) understand the protections they 
are afforded in sharing any cyber threat 
indicators and defensive measures; and 
‘‘(vi) can provide feedback to the Sec-
retary when policies, procedures, and 
guidelines that are unclear or unintention-
ally prohibitive to sharing cyber threat in-
dicators and defensive measures.’’; and 
(iii) by adding at the end the fol-
lowing new subparagraph: 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(D) BRIEFINGS
ON
OUTREACH.—The 
Secretary of Homeland Security shall annually 
provide to the Committee on Homeland Secu-
rity of the House of Representatives and the 
Committee on Homeland Security and Govern-
mental Affairs of the Senate a briefing on the 
implementation of outreach pursuant to sub-
paragraph (B).’’; and 
(D) in subsection (d)— 
(i) in paragraph (1), by inserting 
‘‘copyright or’’ before ‘‘trade secret protec-
tion’’; and 
(ii) in paragraph (5)(A), 
(I) in clause (iv), by striking 
‘‘or’’ after the semicolon; 
(II) in clause (v)(III), by striking 
the period and inserting ‘‘; or’’; and 
(III) by adding at the end the 
following new clause: 
‘‘(vi) the purpose of rapidly providing 
other Federal entities, including Sector 
Risk Management Agencies, awareness of 
a cybersecurity threat that may impact the 
information systems of such Agencies.’’; 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
(5) in section 108 (6 U.S.C. 1507; relating to 
construction and preemption)— 
(A) in subsection (c)— 
(i) in the matter preceding paragraph 
(1), by striking ‘‘shall be’’ and inserting 
‘‘may be’’; 
(ii) in paragraph (2), by striking ‘‘or’’ 
after the semicolon; 
(iii) in paragraph (3), by striking the 
period and inserting ‘‘; or’’; and 
(iv) by adding at the end the following 
new paragraph: 
‘‘(4) to preclude the use of artificial intelligence 
that is developed or strictly deployed for cybersecu-
rity purposes in carrying out activities authorized by 
this title.’’; and 
(B) in subsection (f)— 
(i) in paragraph (3)— 
(I) by inserting ‘‘to share cyber 
threat indicators or defensive meas-
ures’’ after ‘‘relationship’’; and 
(II) by striking ‘‘or’’ after the 
semicolon; 
(ii) in paragraph (4), by striking the 
period and inserting ‘‘; or’’; and 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
(iii) by adding at the end the fol-
lowing new paragraph: 
‘‘(5) to limit or modify, notwithstanding any 
other provision of law, the authorization to share 
pursuant to section 104(c)(1) with Sector Risk Man-
agement Agencies described in such section.’’; 
(6) in section 109 (6 U.S.C. 1508; relating to 
report on cybersecurity threats)— 
(A) in subsection (a)— 
(i) by inserting ‘‘and not later than 
September 30 of every two years there-
after,’’ after ‘‘Act,’’; 
(ii) by inserting ‘‘the Secretary of 
Homeland Security and’’ after ‘‘in coordi-
nation with’’; 
(iii) by inserting ‘‘and the Committee 
on Homeland Security and Governmental 
Affairs’’ before ‘‘of the Senate’’; 
(iv) by inserting ‘‘and the Committee 
on Homeland Security’’ before ‘‘of the 
House’’; and 
(v) by inserting ‘‘prepositioning activi-
ties, ransomware,’’ after ‘‘attacks,’’; and 
(B) in subsection (b)— 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
(i) in paragraph (1), by inserting 
‘‘prepositioning activities, ransomware,’’ 
after ‘‘attacks,’’; 
(i) in paragraph (2), by inserting 
‘‘prepositioning 
activity, 
ransomware,’’ 
after ‘‘attack,’’; 
(i) in paragraph (3), by inserting 
‘‘prepositioning activities, ransomware,’’ 
after ‘‘attacks,’’ each place it appears; and 
(i) in paragraph (4), by inserting 
‘‘prepositioning activities, ransomware,’’ 
after ‘‘attacks,’’; and 
(7) in section 111(a) (6 U.S.C. 1510(a), relat-
ing to effective period), by striking ‘‘2025’’ and in-
serting ‘‘2035’’. 
(b) CONFORMING AMENDMENTS.—Section 2200 of 
the Homeland Security Act of 2002 (6 U.S.C. 650; relat-
ing to definitions) is amended— 
(1) in paragraph (5)— 
(A) in subparagraph (B), by inserting ‘‘or 
compromising’’ after ‘‘defeating’’; 
(B) in subparagraph (C), by inserting ‘‘in-
cluding a security vulnerability affecting an in-
formation system or a technology included in 
the critical and emerging technologies list of the 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
Office of Science and Technology Policy or suc-
cessor list, such as artificial intelligence (as 
such term is defined in section 5002 of the Na-
tional Artificial Intelligence Initiative Act of 
2020 (15 U.S.C. 9401)), which may be in a 
Federal entity’s or non-Federal entity’s soft-
ware or hardware supply chain,’’ after ‘‘security 
vulnerability,’’; 
(C) in subparagraph (D), by inserting ‘‘or 
compromise’’ after ‘‘defeat’’; and 
(D) in subparagraph (F), by inserting ‘‘or 
compromised’’ after ‘‘exfiltrated’’; 
(2) in paragraph (14), by amending subpara-
graph (B) to read as follows: 
‘‘(B) includes, in accordance with section 
104(d)(2) of the Cybersecurity Sharing Act of 
2015 (6 U.S.C. 1503(d)(2))— 
‘‘(i) operational technology, including 
industrial control systems, such as super-
visory control and data acquisition sys-
tems, distributed control systems, and pro-
grammable logic controllers; 
‘‘(ii) edge devices; and 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(iii) internet of things devices, in-
cluding digital and physical infrastructure 
impacted by ransomware.’’; and 
(3) in paragraph (25), by inserting ‘‘or com-
promise’’ after ‘‘defeat’’. 
Æ 
VerDate Sep 11 2014 
01:35 Sep 03, 2025
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6301
E:\BILLS\H5079.IH
H5079
ssavage on LAPJG3WLY3PROD with BILLS