processed on, or transiting a system or 
network. 
‘‘(B) EXCLUSION.— Such term does not 
include the purpose of protecting a system or 
network from efforts to gain unauthorized ac-
cess to such system or network that solely in-
volve violations of consumer terms of service or 
consumer licensing agreements and do not oth-
erwise constitute unauthorized access. 
‘‘(9) CYBERSECURITY SYSTEM.— 
‘‘(A) IN GENERAL.—The term ‘cybersecu-
rity system’ means a system designed or em-
ployed to ensure the integrity, confidentiality, 
or availability of, or safeguard, a system or net-
work, including protecting a system or network 
from— 
‘‘(i) a vulnerability of a system or net-
work; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network or any information stored on, 
processed on, or transiting such a system 
or network;
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network, including to 
gain such unauthorized access for the pur-
pose of exfiltrating information stored on, 
processed on, or transiting a system or 
network. 
‘‘(B) EXCLUSION.— Such term does not 
include a system designed or employed to pro-
tect a system or network from efforts to gain 
unauthorized access to such system or network 
that solely involve violations of consumer terms 
of service or consumer licensing agreements and 
do not otherwise constitute unauthorized access. 
‘‘(10) INTEGRITY.—The term ‘integrity’ means 
guarding against improper information modification 
or destruction, including ensuring information non-
repudiation and authenticity. 
‘‘(11) PROTECTED
ENTITY.—The term ‘pro-
tected entity’ means an entity, other than an indi-
vidual, that contracts with a cybersecurity provider 
for goods or services to be used for cybersecurity 
purposes.
‘‘(12) SELF-PROTECTED
ENTITY.—The term 
‘self-protected entity’ means an entity, other than an 
individual, that provides goods or services for cyber-
security purposes to itself. 
‘‘(13) UTILITY.—The term ‘utility’ means an 
entity providing essential services (other than law 
enforcement or regulatory services), including elec-
tricity, natural gas, propane, telecommunications, 
transportation, water, or wastewater services.’’. 
(b) PROCEDURES AND GUIDELINES.—The Director 
of National Intelligence shall— 
(1) not later than 60 days after the date of the 
enactment of this Act, establish procedures under 
paragraph (1) of section 1104(a) of the National Se-
curity Act of 1947, as added by subsection (a) of 
this section, and issue guidelines under paragraph 
(3) of such section 1104(a); 
(2) in establishing such procedures and issuing 
such guidelines, consult with the Secretary of Home-
land Security to ensure that such procedures and 
such guidelines permit the owners and operators of 
critical infrastructure to receive all appropriate cyber 
threat intelligence (as defined in section 1104(h)(3) 
of such Act, as added by subsection (a)) in the pos-
session of the Federal Government; and
(3) following the establishment of such proce-
dures and the issuance of such guidelines, expedi-
tiously distribute such procedures and such guide-
lines to appropriate departments and agencies of the 
Federal Government, private-sector entities, and 
utilities (as defined in section 1104(h)(9) of such 
Act, as added by subsection (a)). 
(c) INITIAL REPORT.—The first report required to be 
submitted under subsection (e) of section 1104 of the Na-
tional Security Act of 1947, as added by subsection (a) 
of this section, shall be submitted not later than 1 year 
after the date of the enactment of this Act. 
(d) TABLE OF CONTENTS AMENDMENT.—The table 
of contents in the first section of the National Security 
Act of 1947 is amended by adding at the end the following 
new item: 
‘‘Sec. 1104. Cyber threat intelligence and information sharing.’’. 
SEC. 3. SUNSET. 
Effective on the date that is 5 years after the date 
of the enactment of this Act— 
(1) section 1104 of the National Security Act of 
1947, as added by section 2(a) of this Act, is re-
pealed; and 
(2) the table of contents in the first section of 
the National Security Act of 1947, as amended by 
section 2(d) of this Act, is amended by striking the
item relating to section 1104, as added by such sec-
tion 2(d). 
Passed the House of Representatives April 26, 2012. 
Attest: 
Clerk.
112TH CONGRESS 
2D SESSION 
H. R. 3523 
AN ACT 
To provide for the sharing of certain cyber threat 
intelligence and cyber threat information between 
the intelligence community and cybersecurity en-
tities, and for other purposes.