Cybersecurity and Information Sharing: Comparison of H.R. 1560 (PCNA and NCPAA) and S. 754 (CISA)
Released: 2015-11-06T00:00:00

Summary:
Effective sharing of information in cybersecurity is generally considered an important tool for protecting information systems from unauthorized access. Five bills on such sharing have been introduced in the 114th Congress—H.R. 234, H.R. 1560, H.R. 1731, S. 456, and S. 754, and relevant provisions have appeared in other bills. The White House has also submitted a legislative proposal and issued an executive order on the topic.
H.R. 1560, the Protecting Cyber Networks Act (PCNA), and H.R. 1731, the National Cybersecurity Protection Advancement Act of 2015 (NCPAA), passed the House the week of April 20. The bills were then combined as separate titles in H.R. 1560.
In the Senate, S. 754, the Cybersecurity Information Sharing Act of 2015 (CISA), was reported in March and was proposed to be considered as an amendment to H.R. 1735, the National Defense Authorization Act (NDAA). More than 70 amendments to CISA were submitted, a managers amendment was circulated, and a cloture motion was filed on August 3. On August 5, a unanimous consent agreement was reached permitting consideration, and the Senate began debate on a manager's amendment on October 20. The substitute included several of the filed amendments. Several additional amendments were considered, but most did not succeed. The Senate passed CISA, as amended, on October 27. Presumably, any inconsistencies between CISA and the two titles of H.R. 1560 could be reconciled during the process for resolving differences between the House and Senate bills.
PCNA, NCPAA, and CISA have many similarities but also significant differences. All focus on information sharing among private entities and between them and the federal government. NCPAA would explicitly amend portions of the Homeland Security Act of 2002, and PCNA would amend parts of the National Security Act of 1947. CISA addresses the roles of the Department of Homeland Security and the intelligence community but does not explicitly amend either act. NCPAA and CISA also contain provisions relating to cybersecurity of federal agencies and their information systems and of critical infrastructure sectors. CISA also has provisions on international cybersecurity policy and cybercrime. The bills differ in how they define some terms in common, the roles they provide for federal agencies, processes for nonfederal entities to share information with the federal government, processes for protecting privacy and civil liberties, uses permitted for shared information, and reporting requirements.
All the bills would address concerns about barriers to sharing information about cybersecurity within and across sectors. Such barriers are considered by many to hinder protection of information systems. Private-sector entities often express reluctance to share such information because of concerns about legal liability, antitrust violations, regulatory requirements, and protection of intellectual property and other proprietary business information. Institutional and cultural factors have also been cited—traditional approaches to security tend to emphasize secrecy and confidentiality, which would necessarily impede sharing of information.
All the bills have provisions aimed at facilitating information sharing among private-sector entities and providing protections from liability. While reduction or removal of such barriers may provide benefits, concerns have been raised about potential adverse impacts, especially on privacy and civil liberties, and potential misuse of shared information. The bills address many of those concerns. In general, they limit the use of shared information to purposes of cybersecurity and law enforcement, and they limit government use, especially for regulatory purposes. All include provisions to shield information shared with the federal government from public disclosure and to protect privacy and civil liberties with respect to shared information that is not needed for cybersecurity purposes. All require reports to Congress on impacts of their provisions.
Most observers appear to believe that legislation on information sharing is either necessary or at least potentially beneficial—provided that appropriate protections are included—but additional factors may be worthy of consideration as the legislative proposals are debated. In particular, resistance to information sharing among private-sector entities might not be substantially reduced by the actions contemplated in the legislation; and information sharing is only one of many facets of cybersecurity that organizations need to address to secure their information systems.

paragraphs: T his report compares two House bills and one Senate bill that address information sharing and related activities in cybersecurity. It also discusses some of the issues that those and other legislative proposals address. The three bills compared are
the Protecting Cyber Networks Act (PCNA, H.R. 1560 as passed by the House), the National Cybersecurity Protection Advancement Act of 2015 (NCPAA, H.R. 1731 as passed by the House), and the Cybersecurity Information Sharing Act of 2015 (CISA, S. 754 , as passed in the Senate).
All three bills focus on information sharing among private entities and between them and the federal government. They address the structure of the information-sharing process, issues associated with privacy and civil liberties, and liability risks for private-sector sharing, and they also address some other topics in common. In addition to other provisions, NCPAA would explicitly amend portions of the Homeland Security Act of 2002 (6 U.S.C. §101 et seq.), and PCNA would amend parts of the National Security Act of 1947 (50 U.S.C. §3021 et seq.). CISA has many similarities to a bill with a similar name introduced in the 113 th Congress and shares many provisions with PCNA, although there are also significant differences between them.
This report consists of an overview of the three bills, other legislative proposals, and an executive order on information sharing, along with selected associated issues, followed by a side-by-side analysis of NCPAA, PCNA, and CISA. For information on economic aspects of information sharing, see CRS Report R43821, Legislation to Facilitate Cybersecurity Information Sharing: Economic Analysis , by [author name scrubbed]. For discussion of legal issues, see CRS Report R43941, Cybersecurity and Information Sharing: Legal Challenges and Solutions , by [author name scrubbed]. For an overview of cybersecurity issues, see CRS Report R43831, Cybersecurity Issues and Challenges: In Brief , by [author name scrubbed]
Note: Revisions in this update focus on changes to CISA resulting from Senate floor consideration of the bill. Future updates will include further analysis. 
subsections: section_title: Background
paragraphs: Barriers to the sharing of information on threats, attacks, vulnerabilities, and other aspects of cybersecurity—both within and across sectors—have long been considered by many to be a significant hindrance to effective cybersecurity, especially with respect to critical infrastructure, such as the financial system and the electric grid. Private-sector entities often claim that they are reluctant to share such information among themselves because of concerns about legal liability, antitrust violations, and potential misuse, especially of intellectual property, including trade secrets and other proprietary business information. 
Perceived barriers to sharing with government agencies include concerns about risks of disclosure and the ways governments might use the information provided. In addition, some private-sector entities complain that the federal government does not share its information—especially classified information—effectively with the private sector, and that there is little reciprocity or other incentives for such entities to share information with the government. 
Institutional and cultural factors have also been cited—traditional approaches to security tend to emphasize secrecy and confidentiality, which would necessarily impede sharing of information. While reduction or removal of such barriers may provide cybersecurity benefits, concerns have also been raised about potential adverse impacts, especially with respect to privacy and civil liberties.
A few sectors are subject to federal notification requirements, but most such information sharing is voluntary, often through sector-specific Information Sharing and Analysis Centers (ISACs) or programs under the auspices of the Department of Homeland Security (DHS), sector-specific agencies, or private-sector organizations. In 2009, the Obama Administration established the National Cybersecurity and Communications Integration Center (NCCIC) "to bolster information sharing and incident response" with respect to critical infrastructure in particular. 
Legislation focusing specifically on alleviating obstacles to information sharing in cybersecurity were first considered in the 112 th Congress. The Cyber Intelligence Sharing and Protection Act (CISPA, H.R. 3523 ) passed the House in the second session but received no action in the Senate. The Cybersecurity Information Sharing Act (CISA, S. 2102 ) of 2012 was largely incorporated into the Cybersecurity Act of 2012 ( S. 3414 ), which was debated in the Senate but failed two attempts at cloture. The Obama Administration also proposed legislation during the 112 th Congress that included provisions on information sharing. 
CISPA was reintroduced with little change in the 113 th Congress as H.R. 624 . An amended version passed the House but once again received no action in the Senate. A substantially amended version of CISA was reintroduced and reported in the Senate ( S. 2588 ) but also received no further action. However, a bill authorizing NCCIC was enacted ( S. 2519 , P.L. 113-282 ), along with four other cybersecurity bills with provisions on the protection of critical infrastructure and federal information systems, research and development, and the cybersecurity workforce.
section_title: Current Legislative Proposals
subsections: section_title: House Consideration of NCPAA and PCNA
paragraphs: PCNA ( H.R. 1560 ) was introduced March 24, 2015, and reported by the House Intelligence Committee on April 13 ( H.Rept. 114-63 ). NCPAA ( H.R. 1731 ) was introduced April 13 and reported by the House Homeland Security Committee on April 17 ( H.Rept. 114-83 ). The House Committee on Rules held a hearing on proposed amendments to both bills on April 21. More than 30 amendments were submitted for NCPAA and more than 20 for PCNA. The committee reported H.Res. 212 ( H.Rept. 114-88 ) on the two bills on April 21, with a structured rule allowing consideration of five amendments to PCNA and 11 for NCPAA. For each bill, a manager's amendment would serve as the base bill for floor consideration, with debate on PCNA held on April 22 and on NCPAA on April 23. The rule further stated that upon passage of both bills, the text of H.R. 1731 would be appended to H.R. 1560 , and H.R. 1731 would be tabled. 
On April 22, all five amendments to H.R. 1560 were adopted and the bill passed the House by a vote of 307 to 116. The amendments were all agreed to by voice vote except a sunset amendment terminating the bill's provisions seven years after enactment, which passed by recorded vote of 313 to 110. Similarly, on April 23, the 11 amendments to H.R. 1731 were all adopted and the bill was passed by a vote of 355 to 63. A sunset amendment similar to that approved for H.R. 1560 and all but one other amendment were adopted by voice vote. The exception, requiring a GAO study on privacy and civil liberties impacts, was agreed to by recorded vote, 405 to 8. The engrossed version of H.R. 1560 combined the bills by making PCNA Title I and NCPAA Title II. 
section_title: Senate Consideration of CISA
paragraphs: CISA was introduced and reported by the Senate Intelligence Committee on March 17, 2015, with a written report filed April 15 ( S.Rept. 114-32 ). The bill was offered as an amendment to H.R. 1735 , the National Defense Authorization Act for 2016 (NDAA), but a cloture vote on the amendment failed on June 11. A motion to proceed on CISA was filed on August 3, along with a cloture motion. More than 70 amendments to the bill were filed. The cloture motion was withdrawn on August 5 after a unanimous consent agreement was reached permitting consideration, and the Senate began debate on a manager's amendment on October 20. The substitute included several of the filed amendments. Several additional amendments were considered, but most did not succeed. The Senate passed CISA, as amended, on October 27. 
section_title: Other Legislative Proposals in the 114th Congress
paragraphs: Two other bills on information sharing have been introduced in the 114 th Congress, one in the House and one in the Senate. The White House has also submitted a legislative proposal (WHP) and issued an executive order on the topic. The other bills are 
the Cyber Intelligence Sharing and Protection Act (CISPA), which passed the House in the 113 th Congress and was reintroduced unamended as H.R. 234 ; and the Cyber Threat Sharing Act of 2015, S. 456 , which is similar to the WHP. 
section_title: Overview of the Legislative Proposals
paragraphs: All the bills would address common concerns about barriers to sharing of information on threats, attacks, vulnerabilities, and other aspects of cybersecurity—both within and across sectors—but they vary somewhat in emphasis and method. NCPAA focuses on the role of the Department of Homeland Security (DHS), and in particular the National Cybersecurity and Communications Integration Center (NCCIC), the role of which is also addressed in S. 456 and the WHP. 
PCNA, in contrast, focuses more on the role of the intelligence community (IC), including explicit authorization of the Cyber Threat Intelligence Integration Center (CTIIC), the establishment of which was announced by the Obama Administration in February 2015. Similar authorizing language was included in H.R. 2596 , the Intelligence Authorization Act for Fiscal Year 2016, which passed the House June 16. The White House announced opposition to the provisions in the bill on CTIIC's mission and personnel, arguing that they would interfere with the functions of the center as envisioned by the Administration. Both CISPA and CISA address roles of DHS and the IC but do not specifically reference the NCCIC or CTIIC.
All five bills and the WHP have provisions aimed at facilitating sharing of information among private-sector entities and providing protections from liability that might arise from such sharing. They vary somewhat in the kinds of private-sector entities and information covered. In general, the proposals limit the use of shared information to purposes of cybersecurity and specified aspects of law enforcement, and they limit government use for regulatory purposes.
NCPAA, PCNA, and CISA would explicitly authorize private-sector entities to monitor and use defensive measures to protect their own systems and those of other consenting entities. CISPA does not directly authorize those actions, but its provisions appear to cover monitoring. S. 456 and the WHP do not cover monitoring or defense.
All address concerns about privacy and civil liberties, although the mechanisms proposed vary to some extent, in particular the roles played by the Attorney General, the Secretary of Homeland Security, Chief Privacy Officers, the Privacy and Civil Liberties Oversight Board (PCLOB), and the Inspectors General of DHS and other agencies. All the proposals require reports to Congress on impacts of their provisions. All also include provisions to shield information shared with the federal government from public disclosure, including exemption from disclosure under the Freedom of Information Act (FOIA).
In addition, NCPAA, S. 456 , and the WHP address and modify the roles of information sharing and analysis organizations (ISAOs). ISAOs were defined in the Homeland Security Act (HSA, 6 U.S.C. §131(5)) as entities that gather and analyze information relating to the security of critical infrastructure, communicate such information to help with defense against and recovery from incidents, and disseminate such information to any entities that might assist in carrying out those goals. Information Sharing and Analysis Centers (ISACs) are more familiar to most observers. They may arguably be ISAOs under the definition in HSA but have a different origin, having been formed pursuant to a 1998 presidential directive.
Executive Order 13691, issued soon after the WHP, also addresses the role of ISAOs. It requires the Secretary of Homeland Security to encourage and facilitate the formation of ISAOs, and to choose and work with a nongovernmental standards organization to identify standards and guidelines for them. It also requires the NCCIC to coordinate with ISAOs on information sharing, and includes some provisions to facilitate sharing of classified cybersecurity information with appropriate entities. 
NCPAA and CISA also contain provisions relating to cybersecurity of federal agencies and their information systems and of critical infrastructure sectors. CISA also has provisions on international cybersecurity policy and cybercrime. 
On April 21, the White House announced support for passage of both NCPAA and PCNA by the House, while calling for a narrowing of sweep for the liability protections and additional safeguards relating to use of defensive measures in both bills. It also called for clarifying provisions in NCPAA on use of shared information in federal law enforcement and ensuring that provisions in PCNA do not interfere with privacy and civil liberties protections. As described above, the White House has also expressed opposition to the provisions on the mission and personnel of CTIIC in PCNA. The Department of Homeland Security raised concerns about some of the provisions in the reported version of CISA in July 2015. On October 22, the White House announced support for passage by the Senate of CISA as amended, while expressing some concerns, in particular about provisions on the use of defensive measures. 
section_title: Selected Issues
paragraphs: Several issues appear to be particularly relevant to the debate over information-sharing legislation. Among them are the following:
Kinds of Information. What are the kinds of information for which barriers to sharing exist that make effective cybersecurity more difficult, and what are those barriers? Information-Sharing Process. How should the gathering and sharing of information be structured in the public and private sectors to ensure that it is efficient, effective, and appropriate? Uses of Information. What limitations should be placed on how shared information is used? Standards and Practices. What improvements to current standards and practices are needed to ensure that information sharing is useful and efficient for protecting information systems, networks, and their contents? Privacy and Civil Liberties. What are the risks to privacy rights and civil liberties of individual citizens associated with sharing different kinds of cybersecurity information, and how can those rights and liberties best be protected? Liability Protections. What, if any, statutory protections against liability are needed to reduce disincentives for private-sector entities to share cybersecurity information with each other and with government agencies, and how can the need to reduce such barriers best be balanced against any risks to well-established protections?
An in-depth discussion of these issues is beyond the scope of this report. However, the points described below may be relevant for congressional debate. For discussion of legal issues associated with privacy, civil liberties, and liability protections, see CRS Report R43941, Cybersecurity and Information Sharing: Legal Challenges and Solutions , by [author name scrubbed].
Information that may be usefully shared can be complex in type and purpose, which may complicate determining the best methods and criteria for sharing. Information sharing can involve a broad variety of material communicated on a wide range of timescales, from broad cybersecurity policies and principles to best practices to information on threat intelligence, vulnerabilities, and defenses to computer-generated data transmitted directly from one information system to another electronically. The level of sensitivity of information can also vary—for example, it may be classified, proprietary, or personal. Information of any class will also vary in its value for cybersecurity and the degree to which it needs human processing to be useful. 
Shared information can be used for a variety of purposes relating to cybersecurity. A widely recognized objective is to inform situational awareness—an understanding of the components, operational roles, and current and projected states of systems and networks being protected; events occurring within and across them; and threats, vulnerabilities, and other elements of risk, all in the context of the larger cyberspace environment. Shared information may also be used for identifying specific defensive actions or measures, and for planning and capacity-building, among other objectives. In addition, the same information may have different utility for different users—for example, threat signatures relating to attacks on one critical infrastructure sector may be of marginal concern for another, and best practices may be much more useful for small businesses than signatures associated with advanced targeted threats. Also, shared information may prove of little use if it is delayed, provided without relevant contextual detail, or provided in a form that requires substantial additional processing to determine its applicability. If recipients find that the information they are provided is of little use to them, they may be less likely to participate in or continue with information-sharing initiatives.
The timescale during which shared information will be most useful varies with the kind of information shared and its purpose. To the extent that the goal of information sharing is to defend systems and networks against cyberattacks, there appears to be a consensus that shared information needs to be actionable—that is, it should identify or evoke a specific response aimed at mitigating cybersecurity risks. To be meaningfully actionable, information may often need to be shared very quickly or even in an automated fashion. Such rapid communication, for example by machine-to-machine transmission and processing, is sometimes called "real-time" or "near real-time" sharing. The relevance of timing for shared information may be measured in seconds or even milliseconds in many cases. There may be little or no time for human operators to examine a specific parcel of data to determine whether sharing it could raise privacy, liability, or other concerns. Therefore, the way that such sharing is implemented may affect not only operational effectiveness, but also other interests and goals such as privacy. 
A large increase in information sharing could potentially lead to information overload, reducing the effectiveness of the sharing in reducing cybersecurity risks. The relationship between the volume of information shared and improved cybersecurity is not straightforward. Given the broad classes of information that might be candidates for sharing, and the sheer volume of available data, an entity could receive much more information than it can reasonably process with available resources. Both providers and recipients—whether they are businesses, ISACs, ISAOs, or government agencies—will incur various costs, including developing, assessing, processing, sharing, and applying the information. For sharing to be effective, information from the provider must be relevant to recipients' needs and in forms that can be readily applied in their information technology and security environments. Recipients must also have the capacity and willingness to assess and use the information received in a timely fashion. A large increase in the amount of information received may be counterproductive, especially if much of the information proves to be of little use to the recipient. That could include not only information of uncertain quality and use, but also similar or redundant information from a variety of sources, which could lead to misdirection and waste of resources and could result in important information being overlooked. However, determining a priori what information is useful to share may be difficult. 
The current structure for information sharing is fairly complex but arguably limited in scope . Several federal entities in addition to NCCIC and CTIIC are involved. For example, the National Cyber Investigative Joint Task Force (NCIJTF), which is operated by the Federal Bureau of Investigation (FBI), shares information on investigations related to domestic cyberthreats with national security and criminal law-enforcement programs. Other entities with broader missions may also be involved in cybersecurity information sharing—for example, the federal Information Sharing Environment, and state and local fusion centers. There are also many private-sector entities with information-sharing missions, most notably the ISACs, of which 19 are members of the national council. 
Currently, there appear to be two general models for information sharing—a decentralized, "peer-to-peer," often informal approach between entities with complementary needs, and a more centralized "hub-and-spoke" model such as the ISACs. Organizations such as ISACs are generally sector-specific. Not all sectors have such organizations, and affiliations other than sector may also be important for some kinds of information sharing. Filling such gaps appears to be part of the rationale behind the Administration's ISAO proposal to broaden the scope of ISAOs beyond that described in the Homeland Security Act. On the one hand, the absence of an appropriate mechanism can be a barrier to information sharing for an entity. On the other hand, a proliferation of mechanisms, such as some observers fear the Administration's ISAO model might result in, could also serve as a barrier if it makes information sharing inefficient or confusing for possible participants. 
A proliferation of sharing mechanisms could improve coverage for information sharing among sectors but might also lead to duplication or overspecialization . Those could lead to a reduction in effective sharing across sectors, for example, and lack of clarity with respect to responsibilities. It also creates the possibility that entities could receive conflicting information or even incompatible recommendations from different sharing organizations. However, the potential for duplication creates the potential for market competition, and such market forces would ideally yield more innovation and more rapid improvement in information sharing than would a more restricted approach. Market forces might also lead to lower costs, and cost can be an impediment to improved information sharing, especially for small businesses. Yet market forces might also lead to higher costs, and a proliferation of sharing mechanisms might also make decisions about which one or ones to join more difficult for potential participants. In contrast, a narrow, tightly defined structure for information sharing could lead to logjams or impede innovation in response to the continuing evolution of cyberspace. 
Development of consensus standards and best practices may improve the effectiveness and efficiency of information sharing. The adoption of standards for information sharing is one way to help address concerns about reliability and utility of information received. Such an effort may be especially useful if the number and scope of ISAOs grows significantly, as may be the case under the Obama Administration proposal and EO 13691. Dozens of standards currently exist relating to information sharing. The Department of Homeland Security has been developing a single set applicable to sharing of threat intelligence. However, the large variation in sharing requirements and benefits among different entities and sectors may pose a significant challenge to the development of a useful common set of standards and practices. Nevertheless, experience with the development of the NIST cybersecurity framework suggests that it may be possible to create a sufficiently flexible structure that entities can use to identify and develop appropriate standards and practices.
Protection of confidentiality, privacy, and civil liberties in information sharing remains an area of controversy . Concerns relating to privacy and civil liberties, especially the protection of personal and proprietary information and uses of shared information, have been a subject of considerable debate in the development of legislation on information sharing. The bills contain provisions aimed at reducing risks of inappropriate sharing and use of such information. Observers vary significantly in assessments about the adequacy of those safeguards, both in general and with respect to the House and Senate bills. Some observers argue that shared cybersecurity information seldom needs to include privacy-related information, which suggests that privacy concerns may be limited and comparatively easy to address. However, the issue is complicated by various factors, including potential impacts of advances in data analytic capabilities, often referred to as "big data." According to a presidential advisory panel, "By data mining and other kinds of analytics, nonobvious and sometimes private information can be derived from data that, at the time of their collection, seemed to raise no, or only manageable, privacy issues." There are many potential sources, unrelated to the information-sharing activities addressed in the bills, from which an individual's personal information in cyberspace can be identified and acquired by various entities. The impacts of data mining and analytics do not appear to have generally been analyzed with respect to the potential risks to confidentiality and privacy of private- and public-sector information-sharing activities in comparison to risks from other kinds of activities. 
Sharing of information among private-sector entities might not be substantially increased by the actions contemplated in the legislation. Most observers appear to believe that legislation on information sharing is either necessary or at least potentially beneficial—provided that appropriate protections are included. Some observers have noted that the benefits of receiving cybersecurity information tend to outweigh the benefits of providing such information for many organizations. This may be especially true for information shared with the federal government. Timely and actionable information that an entity receives can help it prevent or mitigate an attack. In the absence of incentives for reciprocity, however, it is hard to see what benefit an organization would gain from providing information, unless it is a government entity whose mission is to provide such data or a provider of cybersecurity services. More indirect benefits might occur, for example, if a pattern of reciprocity develops among sharing entities, such as through ISACs or ISAOs. However, information sharing by itself is not sufficient to improve cybersecurity. Not only must the information be actionable, but the recipient must also have processes, including equipment and software, in place to use the information effectively. If such processes are not in place and utilized properly, the net effect may be the same as if the information were not shared at all.
In addition to issues such as legal concerns that may be associated with providing information, businesses may be concerned about reputation costs, if they provide information showing that they have been victims of cyberattacks. Government measures such as requirements for data-breach notification, as enacted in most states, can provide incentives for organizations to share information that may be useful in attempts to prevent future attacks on other entities or to capture and prosecute cybercriminals. While the legislative proposals on information sharing may reduce the risks to private-sector entities associated with providing information, none include explicit incentives to stimulate such provision. In the absence of mechanisms to balance the asymmetry between incentives for receiving and providing information, the degree to which information sharing would increase under the provisions of the various legislative proposals may be uncertain.
Information sharing is only one facet of cybersecurity. Information sharing is only one of many cybersecurity tools, and some observers have expressed concern about risks associated with an overemphasis on its role in cybersecurity. Sharing may be relatively unimportant for many organizations, especially in comparison with other cybersecurity needs. Entities must also have the resources and processes in place that are necessary for effective cybersecurity risk management. For example, in the data breaches of information on federal employees revealed in June by the Office of Personnel Management (OPM), it is not clear that specific information about the threat or even defensive measures would have resulted in effective defense against the attacks, given OPM's reported shortcomings in implementation of requirements in the Federal Information Security Management Act (FISMA). 
In addition, information sharing tends to focus on immediate concerns such as cyberattacks and imminent threats. While those must be addressed, that does not diminish the importance of other issues in cybersecurity such as education and training, workforce, acquisition, or cybercrime law, or major long-term challenges such as building security into the design of hardware and software, changing the incentive structure for cybersecurity, developing a broad consensus about cybersecurity needs and requirements, and adapting to the rapid evolution of cyberspace. 
section_title: Side-by-Side Comparison of NCPAA, PCNA, and CISA
paragraphs: The remainder of the report consists of four tables comparing provisions in NCPAA and PCNA as passed by the House and CISA as passed by the Senate:
 Table 1 provides a side-by-side comparison of sections with corresponding provisions in the three bills and includes all the provisions specifically related to information sharing. The other three tables provide summaries of sections in NCPAA and CISA for which CRS did not identify any corresponding provisions in either of the other bills: 
 Table 2 , on cybersecurity of federal agencies and systems, Table 3 , on critical infrastructure cybersecurity, and Table 4 , on other cybersecurity matters. 
However, some sections in those tables are related to sections in Table 1 . For example, Sec. 203 of CISA is included in Table 1 rather than Table 2 because some of its provisions correspond to provisions in Sec. 216 of NCPAA, on the protection of federal information systems. However, Sec. 204 of CISA, on advanced cybersecurity defenses for federal agencies, is in Table 2 , even though it relates to cybersecurity for federal systems, because there are no comparable provisions in either NCPAA or PCNA. In contrast, Sec. 204 of NCPAA, on ISAOs, is in Table 1 because it is on information sharing, even though there are no corresponding provisions in the other bills. Note that subsections that address topics not found in other bills are included in Table 1 if other parts of the section have corresponding provisions in other bills. For example, Sec. 104(c) in PCNA, establishing the CTIIC (see p. 27 ), has no corresponding provisions in the other bills but is included in Table 1 because the other subsections have corresponding provisions.
subsections: section_title: Glossary of Abbreviations in the Tables
section_title: Notes on the Tables
paragraphs: Entries describing provisions in a bill are summaries or paraphrases, with direct quotes enclosed in double quotation marks. The tables use the following formatting conventions to aid in the comparison:
In Table 1 , related provisions in the bills are adjacent to each other, with NCPAA serving as the basis for comparison. As a result, many provisions of PCNA and CISA appear out of sequence in that table. Bold formatting denotes that the identified provision is the subject of the subsequent text (e.g., (d) or Sec. 10 2 (a) ). Numbers and names of sections, subsections, and paragraphs (except definitions) added to existing laws by the bills are enclosed in single quotation marks (e.g., 'Sec. 111(a)' ). Underlined text (visible only in the pdf version) is used in selected cases in Table 1 as a visual aid to highlight differences with a corresponding provision in the other bills that might otherwise be difficult to discern. The names of titles, sections, and some paragraphs are stated the first time a provision from them is discussed in the tables—for example, Sec. 10 3. Authorizations for Preventing, Detecting, Analyzing, and Mitigating Cybersecurity Threats — but only the number, to the paragraph level or higher, is used thereafter. In cases where a provision of a bill is out of sequence from that immediately above it, as much of the provision number is repeated as is needed to make its origin clear. For example, on p. 29 , a provision from Sec. 103 of PCNA is described immediately after an entry for Sec. 109 and is therefore labelled Sec. 103(c)(3) . That is followed immediately by an entry labelled (a) , which is a subsection of Sec. 103 and therefore is not preceded by the section number. Page numbers cited within the table are hyperlinked to the provisions they reference in the table; the page numbers themselves refer to pages in the pdf version of this report. Explanatory notes on provisions are enclosed in square brackets. Also, the entry "[Similar to {bill}]" means that the text in that provision is closely similar in text, with no significant difference in meaning as interpreted by CRS, to the corresponding provision in the named bill. "[Identical to {bill}]" means that there are no differences in language between the text of that provision and the corresponding provision in the named bill. A double em-dash (——) means that the bill has no provision corresponding to that described for other bills in that row of the table.
See the " Glossary of Abbreviations in the Tables " for meanings of abbreviations used therein.