S.Amdt. 2691

1. Strikes title I

   Strikes

   In S. 3414 · Placed on Calendar Senate

   Struck: TITLE I--PUBLIC-PRIVATE PARTNERSHIP TO PROTECT CRITICAL INFRASTRUCTURE

   Struck: SEC. 101. NATIONAL CYBERSECURITY COUNCIL.

   Struck: (a) In General.--There is established a National Cybersecurity Council.

   Struck: (b) Responsibilities.--The Council shall--

   Show 241 more struck paragraphsShow less

   Struck: (1) conduct sector-by-sector risk assessments in partnership with owners and operators, private sector entities, relevant Federal agencies, and appropriate non-governmental entities and institutions of higher education;

   Struck: (2) identify categories of critical cyber infrastructure, in partnership with relevant Federal agencies, owners and operators, other appropriate private sector entities, and appropriate non-governmental entities and institutions of higher education;

   Struck: (3) coordinate the adoption of private-sector recommended voluntary outcome-based cybersecurity practices with owners and operators, private sector entities, relevant Federal agencies, the Critical Infrastructure Partnership Advisory Council, institutions of higher education, and appropriate non- governmental cybersecurity experts, in accordance with this title;

   Struck: (4) establish an incentives-based voluntary cybersecurity program for critical infrastructure to encourage owners to adopt voluntary outcome-based cybersecurity practices under section 103;

   Struck: (5) develop procedures to inform owners and operators of cyber threats, vulnerabilities, and consequences; and

   Struck: (6) upon request and to the maximum extent possible, provide any technical guidance or assistance to owners and operators consistent with this title.

   Struck: (c) Procedures.--The President shall establish procedures, consistent with this section, for the operation of the Council, which shall include procedures that--

   Struck: (1) prescribe the responsibilities of the Council and the member agencies;

   Struck: (2) ensure the timely implementation of decisions of the Council;

   Struck: (3) delegate authority to the Chairperson to take action to fulfill the responsibilities of the Council if--

   Struck: (A) the Council is not fulfilling the responsibilities of the Council in a timely fashion; or

   Struck: (B) necessary to prevent or mitigate an imminent cybersecurity threat.

   Struck: (d) Membership.--The Council shall be comprised of appropriate representatives appointed by the President from--

   Struck: (1) the Department of Commerce;

   Struck: (2) the Department of Defense;

   Struck: (3) the Department of Justice;

   Struck: (4) the intelligence community;

   Struck: (5) sector-specific Federal agencies, as appropriate;

   Struck: (6) Federal agencies with responsibility for regulating the security of critical cyber infrastructure, as appropriate; and

   Struck: (7) the Department.

   Struck: (e) Coordination.--The Council shall coordinate the activities of the Council with--

   Struck: (1) appropriate representatives of the private sector; and

   Struck: (2) owners and operators.

   Struck: (f) Chairperson.--

   Struck: (1) In general.--The Secretary shall serve as Chairperson of the Council (referred to in this section as the "Chairperson").

   Struck: (2) Responsibilities of the chairperson.--The Chairperson shall--

   Struck: (A) ensure the responsibilities of the Council are expeditiously fulfilled;

   Struck: (B) provide expertise and support to the Council; and

   Struck: (C) provide recommendations to the Council.

   Struck: (g) Participation of Sector-specific Federal Agencies and Federal Regulatory Agencies.--A sector-specific Federal agency and a Federal agency with responsibility for regulating the security of critical cyber infrastructure shall participate on the Council on matters directly relating to the sector of critical infrastructure for which the Federal agency has responsibility to ensure that any cybersecurity practice adopted by the Council under section 103--

   Struck: (1) does not contradict any regulation or compulsory standard in effect before the adoption of the cybersecurity practice; and

   Struck: (2) to the extent possible, complements or otherwise improves the regulation or compulsory standard described in paragraph (1).

   Struck: SEC. 102. INVENTORY OF CRITICAL INFRASTRUCTURE.

   Struck: (a) Risk Assessments.--

   Struck: (1) In general.--

   Struck: (A) Designation of member agency.--The Council shall designate a member agency to conduct top-level cybersecurity assessments of cyber risks to critical infrastructure with voluntary participation from private sector entities.

   Struck: (B) Rule of construction.--Nothing in this subsection shall be construed to give new authority to a Federal agency to require owners or operators to provide information to the Federal Government.

   Struck: (2) Responsibility.--The member agency designated under paragraph (1), in consultation with owners and operators, the Critical Infrastructure Partnership Advisory Council, and appropriate Information Sharing and Analysis Organizations, and in coordination with other member agencies, the intelligence community, and the Department of Commerce, shall--

   Struck: (A) not later than 180 days after the date of enactment of this Act, conduct a top-level assessment of the cybersecurity threats, vulnerabilities, and consequences and the probability of a catastrophic incident and associated risk across all critical infrastructure sectors to determine which sectors pose the greatest immediate risk, in order to guide the allocation of resources for the implementation of this Act; and

   Struck: (B) beginning with the highest priority sectors identified under subparagraph (A), conduct, on an ongoing, sector-by-sector basis, cyber risk assessments of the threats to, vulnerabilities of, and consequences of a cyber attack on critical infrastructure.

   Struck: (3) Voluntary input of owners and operators.--The member agency designated under paragraph (1) shall--

   Struck: (A) establish a process under which owners and operators and other relevant private sector experts may provide input into the risk assessments conducted under this section; and

   Struck: (B) seek and incorporate private sector expertise available through established public-private partnerships, including the Critical Infrastructure Partnership Advisory Council and appropriate Information Sharing and Analysis Organizations.

   Struck: (4) Protection of information.--Any information submitted as part of the process established under paragraph (3) shall be protected in accordance with section 106.

   Struck: (5) Submission of risk assessments.--The Council shall submit each risk assessment conducted under this section, in a classified or unclassified form as necessary, to--

   Struck: (A) the President;

   Struck: (B) appropriate Federal agencies; and

   Struck: (C) appropriate congressional committees.

   Struck: (b) Identification of Critical Cyber Infrastructure Categories.--

   Struck: (1) In general.--The Council, in consultation with owners and operators, the Critical Infrastructure Partnership Advisory Council, appropriate Information Sharing and Analysis Organizations, and other appropriate representatives of State and local governments, shall establish procedures to identify categories of critical cyber infrastructure within each sector of critical infrastructure for the purposes of this Act.

   Struck: (2) Duties.--In establishing the procedure under paragraph (1), the Council shall--

   Struck: (A) prioritize efforts based on the prioritization established under subsection (a);

   Struck: (B) incorporate, to the extent practicable, the input of owners and operators, the Critical Infrastructure Partnership Advisory Council, appropriate Information Sharing and Analysis Organizations, and other appropriate representatives of the private sector and State and local governments;

   Struck: (C) develop a voluntary mechanism for owners to submit information to assist the Council in making determinations under this section;

   Struck: (D) inform owners and operators of the criteria used to identify categories of critical cyber infrastructure;

   Struck: (E) establish procedures for an owner of critical infrastructure identified as critical cyber infrastructure to challenge the identification;

   Struck: (F) select a member agency to make recommendations to the Council on the identification of categories of critical cyber infrastructure; and

   Struck: (G) periodically review and update identifications under this subsection.

   Struck: (3) Identification requirements.--The Council shall--

   Struck: (A) identify categories of critical cyber infrastructure within each sector of critical infrastructure and identify owners of critical infrastructure within each category of critical cyber infrastructure;

   Struck: (B) only identify a category of critical infrastructure as critical cyber infrastructure if damage to or unauthorized access to such critical infrastructure could reasonably result in--

   Struck: (i) the interruption of life-sustaining services, including energy, water, transportation, emergency services, or food, sufficient to cause--

   Struck: (I) a mass casualty event; or

   Struck: (II) mass evacuations;

   Struck: (ii) catastrophic economic damage to the United States including--

   Struck: (I) failure or substantial disruption of a financial market of the United States;

   Struck: (II) incapacitation or sustained disruption of a transportation system; or

   Struck: (III) other systemic, long-term damage to the economy of the United States; or

   Struck: (iii) severe degradation of national security or national security capabilities, including intelligence and defense functions; and

   Struck: (C) consider the sector-by-sector risk assessments developed in accordance with subsection (a).

   Struck: (4) Incident reporting.--The Council shall establish procedures under which each owner of critical cyber infrastructure shall report significant cyber incidents affecting critical cyber infrastructure.

   Struck: (5) Limitations.--The Council may not identify as a category of critical cyber infrastructure under this section--

   Struck: (A) critical infrastructure based solely on activities protected by the first amendment to the Constitution of the United States;

   Struck: (B) an information technology product based solely on a finding that the product is capable of, or is actually, being used in critical cyber infrastructure; or

   Struck: (C) a commercial item that organizes or communicates information electronically.

   Struck: (6) Notification of identification of category of critical cyber infrastructure.--Not later than 10 days after the Council identifies a category of critical cyber infrastructure under this section, the Council shall notify the relevant owners of the identified critical cyber infrastructure.

   Struck: (7) Definition.--In this subsection, the term "damage" has the meaning given that term in section 1030(e) of title 18, United States Code.

   Struck: (c) Congressional Notice and Opportunity for Disapproval.--

   Struck: (1) Notification.--Not later than 10 days after the date on which the Council identifies a category of critical infrastructure as critical cyber infrastructure under this section, the Council shall--

   Struck: (A) notify Congress of the identification; and

   Struck: (B) submit to Congress a report explaining the basis for the identification.

   Struck: (2) Opportunity for congressional review.--The identification of a category of critical infrastructure as critical cyber infrastructure shall not take effect for purposes of this title until the date that is 60 days after the date on which the Council notifies Congress under paragraph (1).

   Struck: SEC. 103. VOLUNTARY CYBERSECURITY PRACTICES.

   Struck: (a) Private Sector Development of Cybersecurity Practices.--Not later than 180 days after the date of enactment of this Act, each sector coordinating council shall propose to the Council voluntary outcome-based cybersecurity practices (referred to in this section as "cybersecurity practices") sufficient to effectively remediate or mitigate cyber risks identified through an assessment conducted under section 102(a) comprised of--

   Struck: (1) industry best practices, standards, and guidelines; or

   Struck: (2) practices developed by the sector coordinating council in coordination with owners and operators, voluntary consensus standards development organizations, representatives of State and local governments, the private sector, and appropriate information sharing and analysis organizations.

   Struck: (b) Review of Cybersecurity Practices.--

   Struck: (1) In general.--The Council shall, in consultation with owners and operators, the Critical Infrastructure Partnership Advisory Council, and appropriate information sharing and analysis organizations, and in coordination with appropriate representatives from State and local governments--

   Struck: (A) consult with relevant security experts and institutions of higher education, including university information security centers, appropriate nongovernmental cybersecurity experts, and representatives from national laboratories;

   Struck: (B) review relevant regulations or compulsory standards or guidelines;

   Struck: (C) review cybersecurity practices proposed under subsection (a); and

   Struck: (D) consider any amendments to the cybersecurity practices and any additional cybersecurity practices necessary to ensure adequate remediation or mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Struck: (2) Adoption.--

   Struck: (A) In general.--Not later than 1 year after the date of enactment of this Act, the Council shall--

   Struck: (i) adopt any cybersecurity practices proposed under subsection (a) that adequately remediate or mitigate identified cyber risks and any associated consequences identified through an assessment conducted under section 102(a); and

   Struck: (ii) adopt any amended or additional cybersecurity practices necessary to ensure the adequate remediation or mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Struck: (B) No submission by sector coordinating council.-- If a sector coordinating council fails to propose to the Council cybersecurity practices under subsection (a) within 180 days of the date of enactment of this Act, not later than 1 year after the date of enactment of this Act the Council shall adopt cybersecurity practices that adequately remediate or mitigate identified cyber risks and associated consequences identified through an assessment conducted under section 102(a) for the sector.

   Struck: (c) Flexibility of Cybersecurity Practices.--Each sector coordinating council and the Council shall periodically assess cybersecurity practices, but not less frequently than once every 3 years, and update or modify cybersecurity practices as necessary to ensure adequate remediation and mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Struck: (d) Prioritization.--Based on the risk assessments performed under section 102(a), the Council shall prioritize the development of cybersecurity practices to ensure the reduction or mitigation of the greatest cyber risks.

   Struck: (e) Private Sector Recommended Measures.--Each sector coordinating council shall develop voluntary recommended cybersecurity measures that provide owners reasonable and cost-effective methods of meeting any cybersecurity practice.

   Struck: (f) Technology Neutrality.--No cybersecurity practice shall require--

   Struck: (1) the use of a specific commercial information technology product; or

   Struck: (2) that a particular commercial information technology product be designed, developed, or manufactured in a particular manner.

   Struck: (g) Relationship to Existing Regulations.--

   Struck: (1) Inclusion in regulatory regimes.--

   Struck: (A) In general.--A Federal agency with responsibilities for regulating the security of critical infrastructure may adopt the cybersecurity practices as mandatory requirements.

   Struck: (B) Reports.--If, as of the date that is 1 year after the date of enactment of this Act, a Federal agency with responsibilities for regulating the security of critical infrastructure has not adopted the cybersecurity practices as mandatory requirements, the agency shall submit to the appropriate congressional committees a report on the reasons the agency did not do so, including a description of whether the critical cyber infrastructure for which the Federal agency has responsibility is maintaining practices sufficient to effectively remediate or mitigate cyber risks identified through an assessment conducted under section 102(a).

   Struck: (C) Rule of construction.--Nothing in this subsection shall be construed to provide a Federal agency with authority for regulating the security of critical cyber infrastructure in addition or to a greater extent than the authority the Federal agency has under other law.

   Struck: (2) Avoidance of conflict.--No cybersecurity practice shall--

   Struck: (A) prevent an owner (including a certified owner) from complying with any law or regulation; or

   Struck: (B) require an owner (including a certified owner) to implement cybersecurity measures that prevent the owner from complying with any law or regulation.

   Struck: (3) Avoidance of duplication.--Where regulations or compulsory standards regulate the security of critical cyber infrastructure, a cybersecurity practice shall, to the greatest extent possible, complement or otherwise improve the regulations or compulsory standards.

   Struck: (h) Independent Review.--

   Struck: (1) In general.--Each cybersecurity practice shall be publicly reviewed by the relevant sector coordinating council and the Critical Infrastructure Partnership Advisory Council, which may include input from relevant institutions of higher education, including university information security centers, national laboratories, and appropriate non-governmental cybersecurity experts.

   Struck: (2) Consideration by council.--The Council shall consider any review conducted under paragraph (1).

   Struck: (i) Voluntary Technical Assistance.--At the request of an owner or operator of critical infrastructure, the Council shall provide guidance on the application of cybersecurity practices to the critical infrastructure.

   Struck: SEC. 104. VOLUNTARY CYBERSECURITY PROGRAM FOR CRITICAL INFRASTRUCTURE.

   Struck: (a) Voluntary Cybersecurity Program for Critical Infrastructure.--

   Struck: (1) In general.--Not later than 1 year after the date of enactment of this Act, the Council, in consultation with owners and operators and the Critical Infrastructure Partnership Advisory Council, shall establish the Voluntary Cybersecurity Program for Critical Infrastructure in accordance with this section.

   Struck: (2) Eligibility.--

   Struck: (A) In general.--An owner of critical cyber infrastructure may apply for certification under the Voluntary Cybersecurity Program for Critical Infrastructure.

   Struck: (B) Criteria.--The Council shall establish criteria for owners of critical infrastructure that is not critical cyber infrastructure to be eligible to apply for certification in the Voluntary Cybersecurity Program for Critical Infrastructure.

   Struck: (3) Application for certification.--An owner of critical cyber infrastructure or an owner of critical infrastructure that meets the criteria established under paragraph (2)(B) that applies for certification under this subsection shall--

   Struck: (A) select and implement cybersecurity measures of their choosing that satisfy the outcome-based cybersecurity practices established under section 103; and

   Struck: (B)(i) certify in writing and under penalty of perjury to the Council that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103; or

   Struck: (ii) submit to the Council an assessment verifying that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103.

   Struck: (4) Certification.--Upon receipt of a self-certification under paragraph (3)(B)(i) or an assessment under paragraph (3)(B)(ii) the Council shall certify an owner.

   Struck: (5) Nonperformance.--If the Council determines that a certified owner is not in compliance with the cybersecurity practices established under section 103, the Council shall--

   Struck: (A) notify the certified owner of such determination; and

   Struck: (B) work with the certified owner to remediate promptly any deficiencies.

   Struck: (6) Revocation.--If a certified owner fails to remediate promptly any deficiencies identified by the Council, the Council shall revoke the certification of the certified owner.

   Struck: (7) Redress.--

   Struck: (A) In general.--If the Council revokes a certification under paragraph (6), the Council shall--

   Struck: (i) notify the owner of such revocation; and

   Struck: (ii) provide the owner with specific cybersecurity measures that, if implemented, would remediate any deficiencies.

   Struck: (B) Recertification.--If the Council determines that an owner has remedied any deficiencies and is in compliance with the cybersecurity practices, the Council may recertify the owner.

   Struck: (b) Assessments.--

   Struck: (1) Third-party assessments.--The Council, in consultation with owners and operators and the Critical Infrastructure Protection Advisory Council, shall enter into agreements with qualified third-party private entities, to conduct assessments that use reliable, repeatable, performance-based evaluations and metrics to assess whether an owner certified under subsection (a)(3)(B)(ii) is in compliance with all applicable cybersecurity practices.

   Struck: (2) Training.--The Council shall ensure that third party assessors described in paragraph (1) undergo regular training and accreditation.

   Struck: (3) Other assessments.--Using the procedures developed under this section, the Council may perform cybersecurity assessments of a certified owner based on actual knowledge or a reasonable suspicion that the certified owner is not in compliance with the cybersecurity practices or any other risk- based factors as identified by the Council.

   Struck: (4) Notification.--The Council shall provide copies of any assessments by the Federal Government to the certified owner.

   Struck: (5) Access to information.--

   Struck: (A) In general.--For the purposes of an assessment conducted under this subsection, a certified owner shall provide the Council, or a third party assessor, any reasonable access necessary to complete an assessment.

   Struck: (B) Protection of information.--Information provided to the Council, the Council's designee, or any assessor during the course of an assessment under this section shall be protected from disclosure in accordance with section 106.

   Struck: (c) Benefits of Certification.--

   Struck: (1) Limitations on civil liability.--

   Struck: (A) In general.--In any civil action for damages directly caused by an incident related to a cyber risk identified through an assessment conducted under section 102(a), a certified owner shall not be liable for any punitive damages intended to punish or deter if the certified owner is in substantial compliance with the appropriate cybersecurity practices at the time of the incident related to that cyber risk.

   Struck: (B) Limitation.--Subaragraph (A) shall only apply to harm directly caused by the incident related to the cyber risk and shall not apply to damages caused by any additional or intervening acts or omissions by the owner.

   Struck: (2) Expedited security clearance process.--The Council, in coordination with the Office of the Director of National Intelligence, shall establish a procedure to expedite the provision of security clearances to appropriate personnel employed by a certified owner.

   Struck: (3) Prioritized technical assistance.--The Council shall ensure that certified owners are eligible to receive prioritized technical assistance.

   Struck: (4) Provision of cyber threat information.--The Council shall develop, in coordination with certified owners, a procedure for ensuring that certified owners are, to the maximum extent practicable and consistent with the protection of sources and methods, informed of relevant real-time cyber threat information.

   Struck: (5) Public recognition.--With the approval of a certified owner, the Council may publicly recognize the certified owner if the Council determines such recognition does not pose a risk to the security of critical cyber infrastructure.

   Struck: (6) Study to examine benefits of procurement preference.--

   Struck: (A) In general.--The Federal Acquisition Regulatory Council, in coordination with the Council and with input from relevant private sector individuals and entities, shall conduct a study examining the potential benefits of establishing a procurement preference for the Federal Government for certified owners.

   Struck: (B) Areas.--The study under subparagraph (A) shall include a review of--

   Struck: (i) potential persons and related property and services that could be eligible for preferential consideration in the procurement process;

   Struck: (ii) development and management of an approved list of categories of property and services that could be eligible for preferential consideration in the procurement process;

   Struck: (iii) appropriate mechanisms to implement preferential consideration in the procurement process, including--

   Struck: (I) establishing a policy encouraging Federal agencies to conduct market research and industry outreach to identify property and services that adhere to relevant cybersecurity practices;

   Struck: (II) authorizing the use of a mark for the Voluntary Cybersecurity Program for Critical Infrastructure to be used for marketing property or services to the Federal Government;

   Struck: (III) establishing a policy of encouraging procurement of certain property and services from an approved list;

   Struck: (IV) authorizing the use of a preference by Federal agencies in the evaluation process; and

   Struck: (V) authorizing a requirement in certain solicitations that the person providing the property or services be a certified owner; and

   Struck: (iv) benefits of and impact on the economy and efficiency of the Federal procurement system, if preferential consideration were given in the procurement process to encourage the procurement of property and services that adhere to relevant baseline performance goals establishing under the Voluntary Cybersecurity Program for Critical Infrastructure.

   Struck: SEC. 105. RULES OF CONSTRUCTION.

   Struck: Nothing in this title shall be construed to--

   Struck: (1) limit the ability of a Federal agency with responsibilities for regulating the security of critical infrastructure from requiring that the cybersecurity practices developed under section 103 be met;

   Struck: (2) provide additional authority for any sector-specific agency or any Federal agency that is not a sector-specific agency with responsibilities for regulating the security of critical infrastructure to establish standards or other cybersecurity measures that are applicable to the security of critical infrastructure not otherwise authorized by law;

   Struck: (3) limit or restrict the authority of the Department, or any other Federal agency, under any other provision of law; or

   Struck: (4) permit any owner (including a certified owner) to fail to comply with any other law or regulation, unless specifically authorized.

   Struck: SEC. 106. PROTECTION OF INFORMATION.

   Struck: (a) Definitions.--In this section--

   Struck: (1) the term "covered information" means any information--

   Struck: (A) submitted as part of the process established under section 102(a)(3);

   Struck: (B) submitted under section 102(b)(2)(C);

   Struck: (C) required to be submitted by owners under section 102(b)(4);

   Struck: (D) provided to the Secretary, the Secretary's designee, or any assessor during the course of an assessment under section 104; or

   Struck: (E) provided to the Secretary or the Inspector General of the Department through the tip line or another secure channel established under subsection (c); and

   Struck: (2) the term "Inspector General" means an Inspector General described in subparagraph (A), (B), or (I) of section 11(b)(1) of the Inspector General Act of 1978 (5 U.S.C. App.), the Inspector General of the United States Postal Service, the Inspector General of the Central Intelligence Agency, and the Inspector General of the Intelligence Community.

   Struck: (b) Critical Infrastructure Information.--

   Struck: (1) In general.--Covered information shall be treated as voluntarily shared critical infrastructure information under section 214 of the Homeland Security Act of 2002 (6 U.S.C. 133), except that the requirement of such section 214 that the information be voluntarily submitted shall not be required for protection of information under this section to apply.

   Struck: (2) Savings clause for existing whistleblower protections.--With respect to covered information, the rights and protections relating to disclosure by individuals of voluntarily shared critical infrastructure information submitted under subtitle B of title II of the Homeland Security Act of 2002 (6 U.S.C. 131 et seq.) shall apply with respect to disclosure of the covered information by individuals.

   Struck: (c) Critical Infrastructure Cyber Security Tip Line.--

   Struck: (1) In general.--The Secretary shall establish and publicize the availability of a Critical Infrastructure Cyber Security Tip Line (and any other secure means the Secretary determines would be desirable to establish), by which individuals may report--

   Struck: (A) concerns involving the security of covered critical infrastructure against cyber risks; and

   Struck: (B) concerns (in addition to any concerns described under subparagraph (A)) with respect to programs and functions authorized or funded under this title involving--

   Struck: (i) a possible violation of any law, rule, regulation or guideline;

   Struck: (ii) mismanagement;

   Struck: (iii) risk to public health, safety, security, or privacy; or

   Struck: (iv) other misfeasance or nonfeasance.

   Struck: (2) Designation of employees.--The Secretary and the Inspector General of the Department shall each designate employees authorized to receive concerns reported under this subsection that include--

   Struck: (A) disclosure of covered information; or

   Struck: (B) any other disclosure of information that is specifically prohibited by law or is specifically required by Executive order to be kept secret in the interest of national defense or the conduct of foreign affairs.

   Struck: (3) Handling of certain concerns.--A concern described in paragraph (1)(B)--

   Struck: (A) shall be received initially to the Inspector General of the Department;

   Struck: (B) shall not be provided initially to the Secretary; and

   Struck: (C) may be provided to the Secretary if determined appropriate by the Inspector General of the Department.

   Struck: (d) Rules of Construction.--Nothing in this section shall be construed to--

   Struck: (1) limit or otherwise affect the right, ability, duty, or obligation of any entity to use or disclose any information of that entity, including in the conduct of any judicial or other proceeding;

   Struck: (2) prevent the classification of information submitted under this section if that information meets the standards for classification under Executive Order 12958, or any successor thereto, or affect measures and controls relating to the protection of classified information as prescribed by Federal statute or under Executive Order 12958, or any successor thereto;

   Struck: (3) limit or otherwise affect the ability of an entity, agency, or authority of a State, a local government, or the Federal Government or any other individual or entity under applicable law to obtain information that is not covered information (including any information lawfully and properly disclosed generally or broadly to the public) and to use such information in any manner permitted by law, including the disclosure of such information under--

   Struck: (A) section 552 or 2302(b)(8) of title 5, United States Code;

   Struck: (B) section 2409 of title 10, United States Code; or

   Struck: (C) any other Federal, State, or local law, ordinance, or regulation that protects against retaliation an individual who discloses information that the individual reasonably believes evidences a violation of any law, rule, or regulation, gross mismanagement, substantial and specific danger to public health, safety, or security, or other misfeasance or nonfeasance;

   Struck: (4) prevent the Secretary from using information required to be submitted under this Act for enforcement of this title, including enforcement proceedings subject to appropriate safeguards;

   Struck: (5) authorize information to be withheld from any committee of Congress, the Comptroller General, or any Inspector General;

   Struck: (6) affect protections afforded to trade secrets under any other provision of law; or

   Struck: (7) create a private right of action for enforcement of any provision of this section.

   Struck: (e) Audit.--

   Struck: (1) In general.--Not later than 1 year after the date of enactment of this Act, the Inspector General of the Department shall conduct an audit of the management of covered information under this title and report the findings to appropriate congressional committees.

   Struck: (2) Contents.--The audit under paragraph (1) shall include assessments of--

   Struck: (A) whether the covered information is adequately safeguarded against inappropriate disclosure;

   Struck: (B) the processes for marking and disseminating the covered information and resolving any disputes;

   Struck: (C) how the covered information is used for the purposes of this title, and whether that use is effective;

   Struck: (D) whether sharing of covered information has been effective to fulfill the purposes of this title;

   Struck: (E) whether the kinds of covered information submitted have been appropriate and useful, or overbroad or overnarrow;

   Struck: (F) whether the protections of covered information allow for adequate accountability and transparency of the regulatory, enforcement, and other aspects of implementing this title; and

   Struck: (G) any other factors at the discretion of the Inspector General of the Department.

   Struck: SEC. 107. ANNUAL ASSESSMENT OF CYBERSECURITY.

   Struck: (a) In General.--Not later than 1 year after the date of enactment of this Act, and every year thereafter, the Council shall submit to the appropriate congressional committees a report on the effectiveness of this title in reducing the risk of cyber attack to critical infrastructure.

   Struck: (b) Contents.--Each report submitted under subsection (a) shall include--

   Struck: (1) a discussion of cyber risks and associated consequences and whether the cybersecurity practices developed under section 103 are sufficient to effectively remediate and mitigate cyber risks and associated consequences; and

   Struck: (2) an analysis of--

   Struck: (A) whether owners of critical cyber infrastructure are successfully implementing the cybersecurity practices adopted under section 103;

   Struck: (B) whether the critical infrastructure of the United States is effectively secured from cybersecurity threats, vulnerabilities, and consequences;

   Struck: (C) whether Federal agencies with responsibilities for regulating the security of critical infrastructure are adequately adopting and enforcing the cybersecurity practices adopted under section 103; and

   Struck: (D) whether additional legislative authority or other actions are needed to effectively remediate or mitigate cyber risks and associated consequences.

   Struck: (c) Form of Report.--A report submitted under this subsection shall be submitted in an unclassified form, but may include a classified annex, if necessary.

   Struck: SEC. 108. INTERNATIONAL COOPERATION.

   Struck: (a) In General.--The Secretary, in coordination with the Secretary of State, the heads of appropriate sector-specific agencies, and the heads of any appropriate Federal agency with responsibilities for regulating the security of covered critical infrastructure, shall--

   Struck: (1) consistent with the protection of intelligence sources and methods and other sensitive matters, inform the owner or operator of information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage within the United States and the government of the country in which the information infrastructure is located of any cyber risks to such information infrastructure; and

   Struck: (2) coordinate with the government of the country in which such information infrastructure is located and, as appropriate, the owner or operator of the information infrastructure regarding the implementation of cybersecurity measures or other measures to the information infrastructure to mitigate or remediate cyber risks.

   Struck: (b) International Agreements.--The Secretary, in coordination with the Secretary of State, including in particular with the interpretation of international agreements, shall perform the functions prescribed by this section consistent with applicable international agreements.

   Struck: SEC. 109. EFFECT ON OTHER LAWS.

   Struck: Except as expressly provided in section 104(c)(1) and section 106, nothing in this Act shall be construed to preempt the applicability of any State law or requirement.

   Struck: SEC. 110. DEFINITIONS.

   Struck: In this title:

   Struck: (1) Certified owner.--The term "certified owner" means an owner of critical cyber infrastructure or an owner of critical infrastructure that is certified by the Council under section 104(a)(4).

   Struck: (2) Cyber risk.--The term "cyber risk" means any risk to information infrastructure, including physical or personnel risks and security vulnerabilities, that, if exploited or not mitigated, could pose a significant risk of disruption to the operation of information infrastructure essential to the reliable operation of critical infrastructure.

   Struck: (3) Sector coordinating council.--The term "sector coordinating council" means a private sector coordinating council comprised of representatives of owners and operators within a particular sector of critical infrastructure established by the National Infrastructure Protection Plan.

   Struck: (4) Sector-specific agency.--The term "sector-specific agency" means the relevant Federal agency responsible for infrastructure protection activities in a designated critical infrastructure sector or key resources category under the National Infrastructure Protection Plan, or any other appropriate Federal agency identified by the President after the date of enactment of this Act.

   Original wording

   Strike title I.

Read automatically from the Congressional Record. Check the original before relying on it.

As printed