I 
118TH CONGRESS 
2D SESSION 
H. R. 9315 
To direct the Secretary of the Treasury to submit a report on coordination 
in the public and private sectors in responding to ransomware attacks 
on financial institutions, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
AUGUST 6, 2024 
Mr. NUNN of Iowa (for himself and Mr. GOTTHEIMER) introduced the 
following bill; which was referred to the Committee on Financial Services 
A BILL 
To direct the Secretary of the Treasury to submit a report 
on coordination in the public and private sectors in re-
sponding to ransomware attacks on financial institutions, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Public and Private 
Sector Ransomware Response Coordination Act of 2024’’. 
VerDate Sep 11 2014 
03:34 Sep 07, 2024
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H9315.IH
H9315
kjohnson on DSK7ZCZBW3PROD with $$_JOB
SEC. 2. REPORT ON COORDINATION IN THE PUBLIC AND 
PRIVATE 
SECTORS 
IN 
RESPONDING 
TO 
RANSOMWARE ATTACKS ON FINANCIAL IN-
STITUTIONS. 
(a) IN GENERAL.—Not later than one year after the 
date of the enactment of this section, the Secretary of the 
Treasury shall submit to the appropriate congressional 
committees a report that describes the following: 
(1) The current level of coordination and col-
laboration between the public and private sectors, in-
cluding entities in the public and private sectors that 
manage cybersecurity, in response to, and for the 
prevention of, a ransomware attack on a financial 
institution. 
(2) The coordination among relevant govern-
mental agencies in response to, and for the preven-
tion of, a ransomware attack on a financial institu-
tion. 
(3) Whether relevant governmental agencies 
have timely access to relevant information reported 
by a financial institution following a ransomware at-
tack on the financial institution. 
(4) The utility of such information to any rel-
evant governmental agency in the prevention or in-
vestigation of a ransomware attack on a financial in-
VerDate Sep 11 2014 
03:34 Sep 07, 2024
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H9315.IH
H9315
kjohnson on DSK7ZCZBW3PROD with $$_JOB
stitution, or the prosecution of a person responsible 
for such attack. 
(5) An analysis of reporting requirements appli-
cable to a financial institution with respect to a 
ransomware attack in relation to the utility to any 
relevant governmental agency of the reported infor-
mation in the prevention or investigation of a 
ransomware attack on a financial institution, or the 
prosecution of a person responsible for such attack. 
(6) Whether further legislation is required to 
increase the utility and timely access of such infor-
mation to any relevant governmental agency fol-
lowing a ransomware attack on a financial institu-
tion. 
(7) Any recommended policy initiatives to bol-
ster public-private partnerships, increase incident re-
port sharing, and decrease incident response time. 
(8) The extent to which, and reasons that, fi-
nancial institutions withhold or delay reporting to 
relevant governmental agencies information about a 
ransomware attack. 
(9) Any feedback on the contents of the report 
received from cybersecurity and ransomware re-
sponse entities that provide services to financial in-
stitutions. 
VerDate Sep 11 2014 
03:34 Sep 07, 2024
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H9315.IH
H9315
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(b) FORM OF REPORT.—The report described in sub-
section (a) shall be submitted in unclassified form, but 
may include a classified annex. 
(c) BRIEFING.—Not later than 15 months after the 
date of the enactment of this section, the Secretary of the 
Treasury shall brief the appropriate congressional commit-
tees on the findings of the report described in subsection 
(a). 
(d) DEFINITIONS.—In this section: 
(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the Committee on Financial Services 
of the House of Representatives; 
(B) the Permanent Select Committee on 
Intelligence of the House of Representatives; 
(C) the Committee on Banking, Housing, 
and Urban Affairs of the Senate; and 
(D) the Select Committee on Intelligence 
of the Senate. 
(2) CYBERSECURITY AND RANSOMWARE INCI-
DENT RESPONSE ENTITY.—The term ‘‘cybersecurity 
and ransomware incident response entity’’ means an 
entity that provides incident responses, managed 
services, or advisory services that— 
VerDate Sep 11 2014 
03:34 Sep 07, 2024
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H9315.IH
H9315
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(A) supports investigation and risk man-
agement related to ransomware attacks in the 
public and private sectors; 
(B) strengthens cybersecurity technology 
in the financial sector; and 
(C) reduces overall cyber risk in the finan-
cial sector by assessing the security posture of 
a financial institution, assisting a financial in-
stitution with regulatory compliance, and pro-
viding recommendations to a financial institu-
tion for recovery after a ransomware attack and 
prevention of any future attacks. 
(3) FINANCIAL
INSTITUTION.—The term ‘‘fi-
nancial institution’’ has the meaning given that term 
under section 5312(a) of title 31, United States 
Code. 
Æ 
VerDate Sep 11 2014 
03:34 Sep 07, 2024
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H9315.IH
H9315
kjohnson on DSK7ZCZBW3PROD with $$_JOB