S.Amdt. 2649

1. Adds SEC. 709. REPORTS TO DEPARTMENT OF DEFENSE ON PENETRATIONS OF NETWORKS AND INFORMATION SYSTEMS OF CERTAIN CONTRACTORS at the end of title VII

   Adds a section

   In S. 3414 · Placed on Calendar Senate

   (21) Third party.--The term "third party" includes Federal entities and non-Federal entities.

   Inserted: SEC. 709. REPORTS TO DEPARTMENT OF DEFENSE ON PENETRATIONS OF NETWORKS AND INFORMATION SYSTEMS OF CERTAIN CONTRACTORS.

   Inserted: (a) Process for Reporting Penetrations.--The Under Secretary of Defense for Intelligence shall, in coordination with the officials specified in subsection (c), establish a process by which cleared defense contractors shall report to elements of the Department of Defense designated by the Under Secretary for purposes of the process when a network or information system of such contractors designated pursuant to subsection (b) is successfully penetrated.

   Inserted: (b) Designation of Networks and Information Systems.--The Under Secretary of Defense for Intelligence shall, in coordination with the officials specified in subsection (c), establish criteria for designating the cleared defense contractors' networks or information systems that contain or process information created by or for the Department of Defense to be subject to the reporting process established pursuant to subsection (a).

   Inserted: (c) Officials.--The officials specified in this subsection are the following:

   Inserted: (1) The Under Secretary of Defense for Policy.

   Inserted: (2) The Under Secretary of Defense for Acquisition, Technology, and Logistics.

   Inserted: (3) The Chief Information Officer of the Department of Defense.

   Inserted: (4) The Commander of the United States Cyber Command.

   Inserted: (d) Process Requirements.--

   Inserted: (1) Rapid reporting.--The process required by subsection (a) shall provide for rapid reporting by contractors of successful penetrations of designated network or information systems.

   Inserted: (2) Report elements.--The report by a contractor on a successful penetration of a designated network or information system under the process shall include the following:

   Inserted: (A) A description of the technique or method used in the penetration.

   Show 3 more inserted paragraphsShow less

   Inserted: (B) A sample of the malicious software, if discovered and isolated by the contractor.

   Inserted: (3) Access.--The process shall include mechanisms by which Department of Defense personnel may, upon request, obtain access to equipment or information of a contractor necessary to conduct a forensic analysis to determine whether information created by or for the Department in connection with any Department program was successfully exfiltrated from a network or information system of the contractor and, if so, what information was exfiltrated.

   Inserted: (e) Cleared Defense Contractor Defined.--In this section, the term "cleared defense contractor" means a private entity granted clearance by the Defense Security Service to receive and store classified information for the purpose of bidding for a contract or conducting activities under a contract with the Department of Defense.

   Original wording

   At the end of title VII, add the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed