H. R. 2471—996 
pursuant to section 104(a) of the Cyber Incident 
Reporting for Critical Infrastructure Act of 2022. 
‘‘(iii) RULES OF CONSTRUCTION.—Nothing in this 
paragraph shall be construed to— 
‘‘(I) exempt a covered entity from the reporting 
requirements under paragraph (3) unless the 
supplemental report also meets the requirements 
of clauses (i) and (ii) of this paragraph; 
‘‘(II) prevent the Agency from contacting an 
entity submitting information to another Federal 
agency that is provided to the Agency pursuant 
to section 104 of the Cyber Incident Reporting 
for Critical Infrastructure Act of 2022; or 
‘‘(III) prevent an entity from communicating 
with the Agency. 
‘‘(C) DOMAIN NAME SYSTEM.—The requirements under 
paragraphs (1), (2) and (3) shall not apply to a covered 
entity or the functions of a covered entity that the Director 
determines constitute critical infrastructure owned, oper-
ated, or governed by multi-stakeholder organizations that 
develop, implement, and enforce policies concerning the 
Domain Name System, such as the Internet Corporation 
for Assigned Names and Numbers or the Internet Assigned 
Numbers Authority. 
‘‘(6) MANNER, TIMING, AND
FORM
OF
REPORTS.—Reports 
made under paragraphs (1), (2), and (3) shall be made in 
the manner and form, and within the time period in the case 
of reports made under paragraph (3), prescribed in the final 
rule issued pursuant to subsection (b). 
‘‘(7) EFFECTIVE
DATE.—Paragraphs (1) through (4) shall 
take effect on the dates prescribed in the final rule issued 
pursuant to subsection (b). 
‘‘(b) RULEMAKING.— 
‘‘(1) NOTICE OF PROPOSED RULEMAKING.—Not later than 
24 months after the date of enactment of this section, the 
Director, in consultation with Sector Risk Management Agen-
cies, the Department of Justice, and other Federal agencies, 
shall publish in the Federal Register a notice of proposed rule-
making to implement subsection (a). 
‘‘(2) FINAL RULE.—Not later than 18 months after publica-
tion of the notice of proposed rulemaking under paragraph 
(1), the Director shall issue a final rule to implement subsection 
(a). 
‘‘(3) SUBSEQUENT RULEMAKINGS.— 
‘‘(A) IN GENERAL.—The Director is authorized to issue 
regulations to amend or revise the final rule issued pursu-
ant to paragraph (2). 
‘‘(B) PROCEDURES.—Any subsequent rules issued under 
subparagraph (A) shall comply with the requirements 
under chapter 5 of title 5, United States Code, including 
the issuance of a notice of proposed rulemaking under 
section 553 of such title. 
‘‘(c) ELEMENTS.—The final rule issued pursuant to subsection 
(b) shall be composed of the following elements: 
‘‘(1) A clear description of the types of entities that con-
stitute covered entities, based on—
H. R. 2471—997 
‘‘(A) the consequences that disruption to or compromise 
of such an entity could cause to national security, economic 
security, or public health and safety; 
‘‘(B) the likelihood that such an entity may be targeted 
by a malicious cyber actor, including a foreign country; 
and 
‘‘(C) the extent to which damage, disruption, or 
unauthorized access to such an entity, including the 
accessing of sensitive cybersecurity vulnerability informa-
tion or penetration testing tools or techniques, will likely 
enable the disruption of the reliable operation of critical 
infrastructure. 
‘‘(2) A clear description of the types of substantial cyber 
incidents that constitute covered cyber incidents, which shall— 
‘‘(A) at a minimum, require the occurrence of— 
‘‘(i) a cyber incident that leads to substantial loss 
of confidentiality, integrity, or availability of such 
information system or network, or a serious impact 
on the safety and resiliency of operational systems 
and processes; 
‘‘(ii) a disruption of business or industrial oper-
ations, including due to a denial of service attack, 
ransomware attack, or exploitation of a zero day 
vulnerability, against 
‘‘(I) an information system or network; or 
‘‘(II) an operational technology system or 
process; or 
‘‘(iii) unauthorized access or disruption of business 
or industrial operations due to loss of service facilitated 
through, or caused by, a compromise of a cloud service 
provider, managed service provider, or other third- 
party data hosting provider or by a supply chain com-
promise; 
‘‘(B) consider— 
‘‘(i) the sophistication or novelty of the tactics used 
to perpetrate such a cyber incident, as well as the 
type, volume, and sensitivity of the data at issue; 
‘‘(ii) the number of individuals directly or indirectly 
affected or potentially affected by such a cyber incident; 
and 
‘‘(iii) potential impacts on industrial control sys-
tems, such as supervisory control and data acquisition 
systems, distributed control systems, and program-
mable logic controllers; and 
‘‘(C) exclude— 
‘‘(i) any event where the cyber incident is per-
petrated in good faith by an entity in response to 
a specific request by the owner or operator of the 
information system; and 
‘‘(ii) the threat of disruption as extortion, as 
described in section 2240(14)(A). 
‘‘(3) A requirement that, if a covered cyber incident or 
a ransom payment occurs following an exempted threat 
described in paragraph (2)(C)(ii), the covered entity shall comply 
with the requirements in this subtitle in reporting the covered 
cyber incident or ransom payment.
H. R. 2471—998 
‘‘(4) A clear description of the specific required contents 
of a report pursuant to subsection (a)(1), which shall include 
the following information, to the extent applicable and avail-
able, with respect to a covered cyber incident: 
‘‘(A) A description of the covered cyber incident, 
including— 
‘‘(i) identification and a description of the function 
of the affected information systems, networks, or 
devices that were, or are reasonably believed to have 
been, affected by such cyber incident; 
‘‘(ii) a description of the unauthorized access with 
substantial loss of confidentiality, integrity, or avail-
ability of the affected information system or network 
or disruption of business or industrial operations; 
‘‘(iii) the estimated date range of such incident; 
and 
‘‘(iv) the impact to the operations of the covered 
entity. 
‘‘(B) 
Where 
applicable, 
a 
description 
of 
the 
vulnerabilities exploited and the security defenses that 
were in place, as well as the tactics, techniques, and proce-
dures used to perpetrate the covered cyber incident. 
‘‘(C) Where applicable, any identifying or contact 
information related to each actor reasonably believed to 
be responsible for such cyber incident. 
‘‘(D) Where applicable, identification of the category 
or categories of information that were, or are reasonably 
believed to have been, accessed or acquired by an unauthor-
ized person. 
‘‘(E) The name and other information that clearly 
identifies the covered entity impacted by the covered cyber 
incident, including, as applicable, the State of incorporation 
or formation of the covered entity, trade names, legal 
names, or other identifiers. 
‘‘(F) Contact information, such as telephone number 
or electronic mail address, that the Agency may use to 
contact the covered entity or an authorized agent of such 
covered entity, or, where applicable, the service provider 
of such covered entity acting with the express permission 
of, and at the direction of, the covered entity to assist 
with compliance with the requirements of this subtitle. 
‘‘(5) A clear description of the specific required contents 
of a report pursuant to subsection (a)(2), which shall be the 
following information, to the extent applicable and available, 
with respect to a ransom payment: 
‘‘(A) A description of the ransomware attack, including 
the estimated date range of the attack. 
‘‘(B) 
Where 
applicable, 
a 
description 
of 
the 
vulnerabilities, tactics, techniques, and procedures used 
to perpetrate the ransomware attack. 
‘‘(C) Where applicable, any identifying or contact 
information related to the actor or actors reasonably 
believed to be responsible for the ransomware attack. 
‘‘(D) The name and other information that clearly 
identifies the covered entity that made the ransom payment 
or on whose behalf the payment was made.
H. R. 2471—999 
‘‘(E) Contact information, such as telephone number 
or electronic mail address, that the Agency may use to 
contact the covered entity that made the ransom payment 
or an authorized agent of such covered entity, or, where 
applicable, the service provider of such covered entity 
acting with the express permission of, and at the direction 
of, that covered entity to assist with compliance with the 
requirements of this subtitle. 
‘‘(F) The date of the ransom payment. 
‘‘(G) The ransom payment demand, including the type 
of virtual currency or other commodity requested, if 
applicable. 
‘‘(H) The ransom payment instructions, including 
information regarding where to send the payment, such 
as the virtual currency address or physical address the 
funds were requested to be sent to, if applicable. 
‘‘(I) The amount of the ransom payment. 
‘‘(6) A clear description of the types of data required to 
be preserved pursuant to subsection (a)(4), the period of time 
for which the data is required to be preserved, and allowable 
uses, processes, and procedures. 
‘‘(7) Deadlines and criteria for submitting supplemental 
reports to the Agency required under subsection (a)(3), which 
shall— 
‘‘(A) be established by the Director in consultation with 
the Council; 
‘‘(B) consider any existing regulatory reporting require-
ments similar in scope, purpose, and timing to the reporting 
requirements to which such a covered entity may also 
be subject, and make efforts to harmonize the timing and 
contents of any such reports to the maximum extent prac-
ticable; 
‘‘(C) balance the need for situational awareness with 
the ability of the covered entity to conduct cyber incident 
response and investigations; and 
‘‘(D) provide a clear description of what constitutes 
substantial new or different information. 
‘‘(8) Procedures for— 
‘‘(A) entities, including third parties pursuant to sub-
section (d)(1), to submit reports required by paragraphs 
(1), (2), and (3) of subsection (a), including the manner 
and form thereof, which shall include, at a minimum, a 
concise, user-friendly web-based form; 
‘‘(B) the Agency to carry out— 
‘‘(i) the enforcement provisions of section 2244, 
including with respect to the issuance, service, with-
drawal, referral process, and enforcement of subpoenas, 
appeals and due process procedures; 
‘‘(ii) other available enforcement mechanisms 
including acquisition, suspension and debarment proce-
dures; and 
‘‘(iii) other aspects of noncompliance; 
‘‘(C) implementing the exceptions provided in sub-
section (a)(5); and 
‘‘(D) protecting privacy and civil liberties consistent 
with processes adopted pursuant to section 105(b) of the 
Cybersecurity Act of 2015 (6 U.S.C. 1504(b)) and
H. R. 2471—1000 
anonymizing and safeguarding, or no longer retaining, 
information received and disclosed through covered cyber 
incident reports and ransom payment reports that is known 
to be personal information of a specific individual or 
information that identifies a specific individual that is not 
directly related to a cybersecurity threat. 
‘‘(9) Other procedural measures directly necessary to imple-
ment subsection (a). 
‘‘(d) THIRD PARTY REPORT SUBMISSION AND RANSOM PAYMENT.— 
‘‘(1) REPORT SUBMISSION.—A covered entity that is required 
to submit a covered cyber incident report or a ransom payment 
report may use a third party, such as an incident response 
company, insurance provider, service provider, Information 
Sharing and Analysis Organization, or law firm, to submit 
the required report under subsection (a). 
‘‘(2) RANSOM PAYMENT.—If a covered entity impacted by 
a ransomware attack uses a third party to make a ransom 
payment, the third party shall not be required to submit a 
ransom payment report for itself under subsection (a)(2). 
‘‘(3) DUTY TO REPORT.—Third-party reporting under this 
subparagraph does not relieve a covered entity from the duty 
to comply with the requirements for covered cyber incident 
report or ransom payment report submission. 
‘‘(4) RESPONSIBILITY TO ADVISE.—Any third party used by 
a covered entity that knowingly makes a ransom payment 
on behalf of a covered entity impacted by a ransomware attack 
shall advise the impacted covered entity of the responsibilities 
of the impacted covered entity regarding reporting ransom pay-
ments under this section. 
‘‘(e) OUTREACH TO COVERED ENTITIES.— 
‘‘(1) IN GENERAL.—The Agency shall conduct an outreach 
and education campaign to inform likely covered entities, enti-
ties that offer or advertise as a service to customers to make 
or facilitate ransom payments on behalf of covered entities 
impacted by ransomware attacks and other appropriate entities 
of the requirements of paragraphs (1), (2), and (3) of subsection 
(a). 
‘‘(2) ELEMENTS.—The outreach and education campaign 
under paragraph (1) shall include the following: 
‘‘(A) An overview of the final rule issued pursuant 
to subsection (b). 
‘‘(B) An overview of mechanisms to submit to the 
Agency covered cyber incident reports, ransom payment 
reports, and information relating to the disclosure, reten-
tion, and use of covered cyber incident reports and ransom 
payment reports under this section. 
‘‘(C) An overview of the protections afforded to covered 
entities for complying with the requirements under para-
graphs (1), (2), and (3) of subsection (a). 
‘‘(D) An overview of the steps taken under section 
2244 when a covered entity is not in compliance with 
the reporting requirements under subsection (a). 
‘‘(E) Specific outreach to cybersecurity vendors, cyber 
incident response providers, cybersecurity insurance enti-
ties, and other entities that may support covered entities. 
‘‘(F) An overview of the privacy and civil liberties 
requirements in this subtitle.
H. R. 2471—1001 
‘‘(3) COORDINATION.—In conducting the outreach and edu-
cation campaign required under paragraph (1), the Agency 
may coordinate with— 
‘‘(A) the Critical Infrastructure Partnership Advisory 
Council established under section 871; 
‘‘(B) Information Sharing and Analysis Organizations; 
‘‘(C) trade associations; 
‘‘(D) information sharing and analysis centers; 
‘‘(E) sector coordinating councils; and 
‘‘(F) any other entity as determined appropriate by 
the Director. 
‘‘(f) EXEMPTION.—Sections 3506(c), 3507, 3508, and 3509 of 
title 44, United States Code, shall not apply to any action to 
carry out this section. 
‘‘(g) RULE OF CONSTRUCTION.—Nothing in this section shall 
affect the authorities of the Federal Government to implement 
the requirements of Executive Order 14028 (86 Fed. Reg. 26633; 
relating to improving the nation’s cybersecurity), including changes 
to the Federal Acquisition Regulations and remedies to include 
suspension and debarment. 
‘‘(h) SAVINGS PROVISION.—Nothing in this section shall be con-
strued to supersede or to abrogate, modify, or otherwise limit the 
authority that is vested in any officer or any agency of the United 
States Government to regulate or take action with respect to the 
cybersecurity of an entity. 
‘‘SEC. 2243. VOLUNTARY REPORTING OF OTHER CYBER INCIDENTS. 
‘‘(a) IN
GENERAL.—Entities may voluntarily report cyber 
incidents or ransom payments to the Agency that are not required 
under paragraph (1), (2), or (3) of section 2242(a), but may enhance 
the situational awareness of cyber threats. 
‘‘(b) VOLUNTARY PROVISION
OF ADDITIONAL INFORMATION
IN 
REQUIRED REPORTS.—Covered entities may voluntarily include in 
reports required under paragraph (1), (2), or (3) of section 2242(a) 
information that is not required to be included, but may enhance 
the situational awareness of cyber threats. 
‘‘(c) APPLICATION OF PROTECTIONS.—The protections under sec-
tion 2245 applicable to reports made under section 2242 shall 
apply in the same manner and to the same extent to reports 
and information submitted under subsections (a) and (b). 
‘‘SEC. 2244. NONCOMPLIANCE WITH REQUIRED REPORTING. 
‘‘(a) PURPOSE.—In the event that a covered entity that is 
required to submit a report under section 2242(a) fails to comply 
with the requirement to report, the Director may obtain information 
about the cyber incident or ransom payment by engaging the cov-
ered entity directly to request information about the cyber incident 
or ransom payment, and if the Director is unable to obtain informa-
tion through such engagement, by issuing a subpoena to the covered 
entity, pursuant to subsection (c), to gather information sufficient 
to determine whether a covered cyber incident or ransom payment 
has occurred. 
‘‘(b) INITIAL REQUEST FOR INFORMATION.— 
‘‘(1) IN GENERAL.—If the Director has reason to believe, 
whether through public reporting or other information in the 
possession of the Federal Government, including through anal-
ysis performed pursuant to paragraph (1) or (2) of section 
2241(a), that a covered entity has experienced a covered cyber
H. R. 2471—1002 
incident or made a ransom payment but failed to report such 
cyber incident or payment to the Agency in accordance with 
section 2242(a), the Director may request additional information 
from the covered entity to confirm whether or not a covered 
cyber incident or ransom payment has occurred. 
‘‘(2) TREATMENT.—Information provided to the Agency in 
response to a request under paragraph (1) shall be treated 
as if it was submitted through the reporting procedures estab-
lished in section 2242. 
‘‘(c) ENFORCEMENT.— 
‘‘(1) IN GENERAL.—If, after the date that is 72 hours from 
the date on which the Director made the request for information 
in subsection (b), the Director has received no response from 
the covered entity from which such information was requested, 
or received an inadequate response, the Director may issue 
to such covered entity a subpoena to compel disclosure of 
information the Director deems necessary to determine whether 
a covered cyber incident or ransom payment has occurred and 
obtain the information required to be reported pursuant to 
section 2242 and any implementing regulations, and assess 
potential impacts to national security, economic security, or 
public health and safety. 
‘‘(2) CIVIL ACTION.— 
‘‘(A) IN GENERAL.—If a covered entity fails to comply 
with a subpoena, the Director may refer the matter to 
the Attorney General to bring a civil action in a district 
court of the United States to enforce such subpoena. 
‘‘(B) VENUE.—An action under this paragraph may be 
brought in the judicial district in which the covered entity 
against which the action is brought resides, is found, or 
does business. 
‘‘(C) CONTEMPT
OF
COURT.—A court may punish a 
failure to comply with a subpoena issued under this sub-
section as contempt of court. 
‘‘(3) NON-DELEGATION.—The authority of the Director to 
issue a subpoena under this subsection may not be delegated. 
‘‘(4) AUTHENTICATION.— 
‘‘(A) IN GENERAL.—Any subpoena issued electronically 
pursuant to this subsection shall be authenticated with 
a cryptographic digital signature of an authorized rep-
resentative of the Agency, or other comparable successor 
technology, that allows the Agency to demonstrate that 
such subpoena was issued by the Agency and has not 
been altered or modified since such issuance. 
‘‘(B) INVALID IF NOT AUTHENTICATED.—Any subpoena 
issued electronically pursuant to this subsection that is 
not authenticated in accordance with subparagraph (A) 
shall not be considered to be valid by the recipient of 
such subpoena. 
‘‘(d) PROVISION OF CERTAIN INFORMATION TO ATTORNEY GEN-
ERAL.— 
‘‘(1) IN GENERAL.—Notwithstanding section 2245(a)(5) and 
paragraph (b)(2) of this section, if the Director determines, 
based on the information provided in response to a subpoena 
issued pursuant to subsection (c), that the facts relating to 
the cyber incident or ransom payment at issue may constitute 
grounds for a regulatory enforcement action or criminal
H. R. 2471—1003 
prosecution, the Director may provide such information to the 
Attorney General or the head of the appropriate Federal regu-
latory agency, who may use such information for a regulatory 
enforcement action or criminal prosecution. 
‘‘(2) CONSULTATION.—The Director may consult with the 
Attorney General or the head of the appropriate Federal regu-
latory agency when making the determination under paragraph 
(1). 
‘‘(e) CONSIDERATIONS.—When determining whether to exercise 
the authorities provided under this section, the Director shall take 
into consideration— 
‘‘(1) the complexity in determining if a covered cyber 
incident has occurred; and 
‘‘(2) prior interaction with the Agency or awareness of 
the covered entity of the policies and procedures of the Agency 
for reporting covered cyber incidents and ransom payments. 
‘‘(f) EXCLUSIONS.—This section shall not apply to a State, local, 
Tribal, or territorial government entity. 
‘‘(g) REPORT TO CONGRESS.—The Director shall submit to Con-
gress an annual report on the number of times the Director— 
‘‘(1) issued an initial request for information pursuant to 
subsection (b); 
‘‘(2) issued a subpoena pursuant to subsection (c); or 
‘‘(3) referred a matter to the Attorney General for a civil 
action pursuant to subsection (c)(2). 
‘‘(h) PUBLICATION OF THE ANNUAL REPORT.—The Director shall 
publish a version of the annual report required under subsection 
(g) on the website of the Agency, which shall include, at a minimum, 
the number of times the Director— 
‘‘(1) issued an initial request for information pursuant to 
subsection (b); or 
‘‘(2) issued a subpoena pursuant to subsection (c). 
‘‘(i) ANONYMIZATION OF REPORTS.—The Director shall ensure 
any victim information contained in a report required to be pub-
lished under subsection (h) be anonymized before the report is 
published. 
‘‘SEC. 2245. INFORMATION SHARED WITH OR PROVIDED TO THE FED-
ERAL GOVERNMENT. 
‘‘(a) DISCLOSURE, RETENTION, AND USE.— 
‘‘(1) AUTHORIZED ACTIVITIES.—Information provided to the 
Agency pursuant to section 2242 or 2243 may be disclosed 
to, retained by, and used by, consistent with otherwise 
applicable provisions of Federal law, any Federal agency or 
department, component, officer, employee, or agent of the Fed-
eral Government solely for— 
‘‘(A) a cybersecurity purpose; 
‘‘(B) the purpose of identifying— 
‘‘(i) a cyber threat, including the source of the 
cyber threat; or 
‘‘(ii) a security vulnerability; 
‘‘(C) the purpose of responding to, or otherwise pre-
venting or mitigating, a specific threat of death, a specific 
threat of serious bodily harm, or a specific threat of serious 
economic harm, including a terrorist act or use of a weapon 
of mass destruction;
H. R. 2471—1004 
‘‘(D) the purpose of responding to, investigating, pros-
ecuting, or otherwise preventing or mitigating, a serious 
threat to a minor, including sexual exploitation and threats 
to physical safety; or 
‘‘(E) the purpose of preventing, investigating, dis-
rupting, or prosecuting an offense arising out of a cyber 
incident reported pursuant to section 2242 or 2243 or any 
of the offenses listed in section 105(d)(5)(A)(v) of the Cyber-
security Act of 2015 (6 U.S.C. 1504(d)(5)(A)(v)). 
‘‘(2) AGENCY ACTIONS AFTER RECEIPT.— 
‘‘(A) RAPID, CONFIDENTIAL SHARING OF CYBER THREAT 
INDICATORS.—Upon receiving a covered cyber incident or 
ransom payment report submitted pursuant to this section, 
the Agency shall immediately review the report to deter-
mine whether the cyber incident that is the subject of 
the report is connected to an ongoing cyber threat or secu-
rity vulnerability and where applicable, use such report 
to identify, develop, and rapidly disseminate to appropriate 
stakeholders actionable, anonymized cyber threat indica-
tors and defensive measures. 
‘‘(B) 
PRINCIPLES
FOR
SHARING
SECURITY 
VULNERABILITIES.—With respect to information in a covered 
cyber incident or ransom payment report regarding a secu-
rity vulnerability referred to in paragraph (1)(B)(ii), the 
Director shall develop principles that govern the timing 
and manner in which information relating to security 
vulnerabilities may be shared, consistent with common 
industry best practices and United States and international 
standards. 
‘‘(3) PRIVACY AND CIVIL LIBERTIES.—Information contained 
in covered cyber incident and ransom payment reports sub-
mitted to the Agency pursuant to section 2242 shall be retained, 
used, and disseminated, where permissible and appropriate, 
by the Federal Government in accordance with processes to 
be developed for the protection of personal information con-
sistent with processes adopted pursuant to section 105 of the 
Cybersecurity Act of 2015 (6 U.S.C. 1504) and in a manner 
that protects personal information from unauthorized use or 
unauthorized disclosure. 
‘‘(4) DIGITAL
SECURITY.—The Agency shall ensure that 
reports submitted to the Agency pursuant to section 2242, 
and any information contained in those reports, are collected, 
stored, and protected at a minimum in accordance with the 
requirements for moderate impact Federal information systems, 
as described in Federal Information Processing Standards 
Publication 199, or any successor document. 
‘‘(5) PROHIBITION ON USE OF INFORMATION IN REGULATORY 
ACTIONS.— 
‘‘(A) IN GENERAL.—A Federal, State, local, or Tribal 
government shall not use information about a covered cyber 
incident or ransom payment obtained solely through 
reporting directly to the Agency in accordance with this 
subtitle to regulate, including through an enforcement 
action, the activities of the covered entity or entity that 
made a ransom payment, unless the government entity 
expressly allows entities to submit reports to the Agency 
to meet regulatory reporting obligations of the entity.