H. R. 2471—1005 
‘‘(B) CLARIFICATION.—A report submitted to the Agency 
pursuant to section 2242 or 2243 may, consistent with 
Federal or State regulatory authority specifically relating 
to the prevention and mitigation of cybersecurity threats 
to information systems, inform the development or 
implementation of regulations relating to such systems. 
‘‘(b) PROTECTIONS
FOR REPORTING ENTITIES
AND INFORMA-
TION.—Reports describing covered cyber incidents or ransom pay-
ments submitted to the Agency by entities in accordance with 
section 2242, as well as voluntarily-submitted cyber incident reports 
submitted to the Agency pursuant to section 2243, shall— 
‘‘(1) be considered the commercial, financial, and propri-
etary information of the covered entity when so designated 
by the covered entity; 
‘‘(2) be exempt from disclosure under section 552(b)(3) of 
title 5, United States Code (commonly known as the ‘Freedom 
of Information Act’), as well as any provision of State, Tribal, 
or local freedom of information law, open government law, 
open meetings law, open records law, sunshine law, or similar 
law requiring disclosure of information or records; 
‘‘(3) be considered not to constitute a waiver of any 
applicable privilege or protection provided by law, including 
trade secret protection; and 
‘‘(4) not be subject to a rule of any Federal agency or 
department or any judicial doctrine regarding ex parte commu-
nications with a decision-making official. 
‘‘(c) LIABILITY PROTECTIONS.— 
‘‘(1) IN GENERAL.—No cause of action shall lie or be main-
tained in any court by any person or entity and any such 
action shall be promptly dismissed for the submission of a 
report pursuant to section 2242(a) that is submitted in conform-
ance with this subtitle and the rule promulgated under section 
2242(b), except that this subsection shall not apply with regard 
to an action by the Federal Government pursuant to section 
2244(c)(2). 
‘‘(2) SCOPE.—The liability protections provided in this sub-
section shall only apply to or affect litigation that is solely 
based on the submission of a covered cyber incident report 
or ransom payment report to the Agency. 
‘‘(3) RESTRICTIONS.—Notwithstanding paragraph (2), no 
report submitted to the Agency pursuant to this subtitle or 
any communication, document, material, or other record, cre-
ated for the sole purpose of preparing, drafting, or submitting 
such report, may be received in evidence, subject to discovery, 
or otherwise used in any trial, hearing, or other proceeding 
in or before any court, regulatory body, or other authority 
of the United States, a State, or a political subdivision thereof, 
provided that nothing in this subtitle shall create a defense 
to discovery or otherwise affect the discovery of any communica-
tion, document, material, or other record not created for the 
sole purpose of preparing, drafting, or submitting such report. 
‘‘(d) SHARING WITH NON-FEDERAL ENTITIES.—The Agency shall 
anonymize the victim who reported the information when making 
information provided in reports received under section 2242 avail-
able to critical infrastructure owners and operators and the general 
public.
H. R. 2471—1006 
‘‘(e) STORED COMMUNICATIONS ACT.—Nothing in this subtitle 
shall be construed to permit or require disclosure by a provider 
of a remote computing service or a provider of an electronic commu-
nication service to the public of information not otherwise permitted 
or required to be disclosed under chapter 121 of title 18, United 
States Code (commonly known as the ‘Stored Communications Act’). 
‘‘SEC. 2246. CYBER INCIDENT REPORTING COUNCIL. 
‘‘(a) RESPONSIBILITY OF THE SECRETARY.—The Secretary shall 
lead an intergovernmental Cyber Incident Reporting Council, in 
consultation with the Director of the Office of Management and 
Budget, the Attorney General, the National Cyber Director, Sector 
Risk Management Agencies, and other appropriate Federal agen-
cies, to coordinate, deconflict, and harmonize Federal incident 
reporting requirements, including those issued through regulations. 
‘‘(b) RULE OF CONSTRUCTION.—Nothing in subsection (a) shall 
be construed to provide any additional regulatory authority to any 
Federal entity.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.—The table of 
contents in section 1(b) of the Homeland Security Act of 2002 
(Public Law 107–296; 116 Stat. 2135) is amended by inserting 
after the items relating to subtitle C of title XXII the following: 
‘‘Subtitle D—Cyber Incident Reporting 
‘‘Sec. 2240. Definitions. 
‘‘Sec. 2241. Cyber Incident Review. 
‘‘Sec. 2242. Required reporting of certain cyber incidents. 
‘‘Sec. 2243. Voluntary reporting of other cyber incidents. 
‘‘Sec. 2244. Noncompliance with required reporting. 
‘‘Sec. 2245. Information shared with or provided to the Federal Government. 
‘‘Sec. 2246. Cyber Incident Reporting Council.’’. 
SEC. 104. FEDERAL SHARING OF INCIDENT REPORTS. 
(a) CYBER INCIDENT REPORTING SHARING.— 
(1) IN GENERAL.—Notwithstanding any other provision of 
law or regulation, any Federal agency, including any inde-
pendent establishment (as defined in section 104 of title 5, 
United States Code), that receives a report from an entity 
of a cyber incident, including a ransomware attack, shall pro-
vide the report to the Agency as soon as possible, but not 
later than 24 hours after receiving the report, unless a shorter 
period is required by an agreement made between the Depart-
ment of Homeland Security (including the Cybersecurity and 
Infrastructure Security Agency) and the recipient Federal 
agency. The Director shall share and coordinate each report 
pursuant to section 2241(b) of the Homeland Security Act of 
2002, as added by section 103 of this division. 
(2) RULE OF CONSTRUCTION.—The requirements described 
in paragraph (1) and section 2245(d) of the Homeland Security 
Act of 2002, as added by section 103 of this division, may 
not be construed to be a violation of any provision of law 
or policy that would otherwise prohibit disclosure or provision 
of information within the executive branch. 
(3) PROTECTION
OF
INFORMATION.—The Director shall 
comply with any obligations of the recipient Federal agency 
described in paragraph (1) to protect information, including 
with respect to privacy, confidentiality, or information security, 
if those obligations would impose greater protection require-
ments than this division or the amendments made by this 
division.
H. R. 2471—1007 
(4) EFFECTIVE DATE.—This subsection shall take effect on 
the effective date of the final rule issued pursuant to section 
2242(b) of the Homeland Security Act of 2002, as added by 
section 103 of this division. 
(5) AGENCY AGREEMENTS.— 
(A) IN GENERAL.—The Agency and any Federal agency, 
including any independent establishment (as defined in 
section 104 of title 5, United States Code), that receives 
incident reports from entities, including due to ransomware 
attacks, shall, as appropriate, enter into a documented 
agreement to establish policies, processes, procedures, and 
mechanisms to ensure reports are shared with the Agency 
pursuant to paragraph (1). 
(B) AVAILABILITY.—To the maximum extent prac-
ticable, each documented agreement required under 
subparagraph (A) shall be made publicly available. 
(C) 
REQUIREMENT.—The 
documented 
agreements 
required by subparagraph (A) shall require reports be 
shared from Federal agencies with the Agency in such 
time as to meet the overall timeline for covered entity 
reporting of covered cyber incidents and ransom payments 
established in section 2242 of the Homeland Security Act 
of 2002, as added by section 103 of this division. 
(b) HARMONIZING REPORTING REQUIREMENTS.—The Secretary 
of Homeland Security, acting through the Director, shall, in con-
sultation with the Cyber Incident Reporting Council described in 
section 2246 of the Homeland Security Act of 2002, as added by 
section 103 of this division, to the maximum extent practicable— 
(1) periodically review existing regulatory requirements, 
including the information required in such reports, to report 
incidents and ensure that any such reporting requirements 
and procedures avoid conflicting, duplicative, or burdensome 
requirements; and 
(2) coordinate with appropriate Federal partners and regu-
latory authorities that receive reports relating to incidents to 
identify opportunities to streamline reporting processes, and 
where feasible, facilitate interagency agreements between such 
authorities to permit the sharing of such reports, consistent 
with applicable law and policy, without impacting the ability 
of the Agency to gain timely situational awareness of a covered 
cyber incident or ransom payment. 
SEC. 105. RANSOMWARE VULNERABILITY WARNING PILOT PROGRAM. 
(a) PROGRAM.—Not later than 1 year after the date of enactment 
of this Act, the Director shall establish a ransomware vulnerability 
warning pilot program to leverage existing authorities and tech-
nology to specifically develop processes and procedures for, and 
to dedicate resources to, identifying information systems that con-
tain security vulnerabilities associated with common ransomware 
attacks, and to notify the owners of those vulnerable systems of 
their security vulnerability. 
(b) IDENTIFICATION OF VULNERABLE SYSTEMS.—The pilot pro-
gram established under subsection (a) shall— 
(1) identify the most common security vulnerabilities uti-
lized in ransomware attacks and mitigation techniques; and
H. R. 2471—1008 
(2) utilize existing authorities to identify information sys-
tems that contain the security vulnerabilities identified in para-
graph (1). 
(c) ENTITY NOTIFICATION.— 
(1) IDENTIFICATION.—If the Director is able to identify the 
entity at risk that owns or operates a vulnerable information 
system identified in subsection (b), the Director may notify 
the owner of the information system. 
(2) NO IDENTIFICATION.—If the Director is not able to iden-
tify the entity at risk that owns or operates a vulnerable 
information system identified in subsection (b), the Director 
may utilize the subpoena authority pursuant to section 2209 
of the Homeland Security Act of 2002 (6 U.S.C. 659) to identify 
and notify the entity at risk pursuant to the procedures under 
that section. 
(3) REQUIRED
INFORMATION.—A notification made under 
paragraph (1) shall include information on the identified secu-
rity vulnerability and mitigation techniques. 
(d) PRIORITIZATION
OF NOTIFICATIONS.—To the extent prac-
ticable, the Director shall prioritize covered entities for identifica-
tion and notification activities under the pilot program established 
under this section. 
(e) LIMITATION ON PROCEDURES.—No procedure, notification, 
or other authorities utilized in the execution of the pilot program 
established under subsection (a) shall require an owner or operator 
of a vulnerable information system to take any action as a result 
of a notice of a security vulnerability made pursuant to subsection 
(c). 
(f) RULE OF CONSTRUCTION.—Nothing in this section shall be 
construed to provide additional authorities to the Director to identify 
vulnerabilities or vulnerable systems. 
(g) TERMINATION.—The pilot program established under sub-
section (a) shall terminate on the date that is 4 years after the 
date of enactment of this Act. 
SEC. 106. RANSOMWARE THREAT MITIGATION ACTIVITIES. 
(a) JOINT RANSOMWARE TASK FORCE.— 
(1) IN GENERAL.—Not later than 180 days after the date 
of enactment of this Act, the Director, in consultation with 
the National Cyber Director, the Attorney General, and the 
Director of the Federal Bureau of Investigation, shall establish 
and chair the Joint Ransomware Task Force to coordinate 
an ongoing nationwide campaign against ransomware attacks, 
and identify and pursue opportunities for international coopera-
tion. 
(2) COMPOSITION.—The Joint Ransomware Task Force shall 
consist of participants from Federal agencies, as determined 
appropriate by the National Cyber Director in consultation 
with the Secretary of Homeland Security. 
(3) RESPONSIBILITIES.—The Joint Ransomware Task Force, 
utilizing only existing authorities of each participating Federal 
agency, shall coordinate across the Federal Government the 
following activities: 
(A) Prioritization of intelligence-driven operations to 
disrupt specific ransomware actors.