S.Amdt. 2714

1. Rewrites page 23, line 19 through page 34, line 19

   ReplacesPrinted page

   Removes page 23, line 19 through page 34, line 19 of the printed bill. See that page

   Inserted: (1) Rule of construction.--Nothing in this section shall be construed to provide a Federal agency that has authority for regulating the security of critical cyber infrastructure any authority in addition to or to a greater extent than the authority the Federal agency has under other law.

   Inserted: (2) Avoidance of conflict.--No cybersecurity practice shall--

   Inserted: (A) prevent an owner (including a certified owner) from complying with any law or regulation; or

   Inserted: (B) require an owner (including a certified owner) to implement cybersecurity measures that prevent the owner from complying with any law or regulation.

   Inserted: (3) Avoidance of duplication.--Where regulations or compulsory standards regulate the security of critical cyber infrastructure, a cybersecurity practice shall, to the greatest extent possible, complement or otherwise improve the regulations or compulsory standards.

   Inserted: (h) Independent Review.--

   Inserted: (1) In general.--Each cybersecurity practice shall be publicly reviewed by the relevant sector coordinating council and the Critical Infrastructure Partnership Advisory Council, which may include input from relevant institutions of higher education, including university information security centers, national laboratories, and appropriate non-governmental cybersecurity experts.

   Inserted: (2) Consideration by council.--The Council shall consider any review conducted under paragraph (1).

   Inserted: (i) Voluntary Technical Assistance.--At the request of an owner or operator of critical infrastructure, the Council shall provide guidance on the application of cybersecurity practices to the critical infrastructure.

   Inserted: SEC. 104. VOLUNTARY CYBERSECURITY PROGRAM FOR CRITICAL INFRASTRUCTURE.

   Inserted: (a) Voluntary Cybersecurity Program for Critical Infrastructure.--

   Inserted: (1) In general.--Not later than 1 year after the date of enactment of this Act, the Council, in consultation with owners and operators and the Critical Infrastructure Partnership Advisory Council, shall establish the Voluntary Cybersecurity Program for Critical Infrastructure in accordance with this section.

   Show 50 more inserted paragraphsShow less

   Inserted: (2) Eligibility.--

   Inserted: (A) In general.--An owner of critical cyber infrastructure may apply for certification under the Voluntary Cybersecurity Program for Critical Infrastructure.

   Inserted: (B) Criteria.--The Council shall establish criteria for owners of critical infrastructure that is not critical cyber infrastructure to be eligible to apply for certification in the Voluntary Cybersecurity Program for Critical Infrastructure.

   Inserted: (3) Application for certification.--An owner of critical cyber infrastructure or an owner of critical infrastructure that meets the criteria established under paragraph (2)(B) that applies for certification under this subsection shall--

   Inserted: (A) select and implement cybersecurity measures of their choosing that satisfy the outcome-based cybersecurity practices established under section 103; and

   Inserted: (B)(i) certify in writing and under penalty of perjury to the Council that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103; or

   Inserted: (ii) submit to the Council an assessment verifying that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103.

   Inserted: (4) Certification.--Upon receipt of a self-certification under paragraph (3)(B)(i) or an assessment under paragraph (3)(B)(ii) the Council shall certify an owner.

   Inserted: (5) Nonperformance.--If the Council determines that a certified owner is not in compliance with the cybersecurity practices established under section 103, the Council shall--

   Inserted: (A) notify the certified owner of such determination; and

   Inserted: (B) work with the certified owner to remediate promptly any deficiencies.

   Inserted: (6) Revocation.--If a certified owner fails to remediate promptly any deficiencies identified by the Council, the Council shall revoke the certification of the certified owner.

   Inserted: (7) Redress.--

   Inserted: (A) In general.--If the Council revokes a certification under paragraph (6), the Council shall--

   Inserted: (i) notify the owner of such revocation; and

   Inserted: (ii) provide the owner with specific cybersecurity measures that, if implemented, would remediate any deficiencies.

   Inserted: (B) Recertification.--If the Council determines that an owner has remedied any deficiencies and is in compliance with the cybersecurity practices, the Council may recertify the owner.

   Inserted: (b) Assessments.--

   Inserted: (1) Third-party assessments.--The Council, in consultation with owners and operators and the Critical Infrastructure Protection Advisory Council, shall enter into agreements with qualified third-party private entities, to conduct assessments that use reliable, repeatable, performance-based evaluations and metrics to assess whether an owner certified under subsection (a)(3)(B)(ii) is in compliance with all applicable cybersecurity practices.

   Inserted: (2) Training.--The Council shall ensure that third party assessors described in paragraph (1) undergo regular training and accreditation.

   Inserted: (3) Other assessments.--Using the procedures developed under this section, the Council may perform cybersecurity assessments of a certified owner based on actual knowledge or a reasonable suspicion that the certified owner is not in compliance with the cybersecurity practices or any other risk-based factors as identified by the Council.

   Inserted: (4) Notification.--The Council shall provide copies of any assessments by the Federal Government to the certified owner.

   Inserted: (5) Access to information.--

   Inserted: (A) In general.--For the purposes of an assessment conducted under this subsection, a certified owner shall provide the Council, or a third party assessor, any reasonable access necessary to complete an assessment.

   Inserted: (B) Protection of information.--Information provided to the Council, the Council's designee, or any assessor during the course of an assessment under this section shall be protected from disclosure in accordance with section 106.

   Inserted: (c) Benefits of Certification.--

   Inserted: (1) Limitations on civil liability.--

   Inserted: (A) In general.--In any civil action for damages directly caused by an incident related to a cyber risk identified through an assessment conducted under section 102(a), a certified owner shall not be liable for any punitive damages intended to punish or deter if the certified owner is in substantial compliance with the appropriate cybersecurity practices at the time of the incident related to that cyber risk.

   Inserted: (B) Limitation.--Subaragraph (A) shall only apply to harm directly caused by the incident related to the cyber risk and shall not apply to damages caused by any additional or intervening acts or omissions by the owner.

   Inserted: (2) Expedited security clearance process.--The Council, in coordination with the Office of the Director of National Intelligence, shall establish a procedure to expedite the provision of security clearances to appropriate personnel employed by a certified owner.

   Inserted: (3) Prioritized technical assistance.--The Council shall ensure that certified owners are eligible to receive prioritized technical assistance.

   Inserted: (4) Provision of cyber threat information.--The Council shall develop, in coordination with certified owners, a procedure for ensuring that certified owners are, to the maximum extent practicable and consistent with the protection of sources and methods, informed of relevant real-time cyber threat information.

   Inserted: (5) Public recognition.--With the approval of a certified owner, the Council may publicly recognize the certified owner if the Council determines such recognition does not pose a risk to the security of critical cyber infrastructure.

   Inserted: (6) Study to examine benefits of procurement preference.--

   Inserted: (A) In general.--The Federal Acquisition Regulatory Council, in coordination with the Council and with input from relevant private sector individuals and entities, shall conduct a study examining the potential benefits of establishing a procurement preference for the Federal Government for certified owners.

   Inserted: (B) Areas.--The study under subparagraph (A) shall include a review of--

   Inserted: (i) potential persons and related property and services that could be eligible for preferential consideration in the procurement process;

   Inserted: (ii) development and management of an approved list of categories of property and services that could be eligible for preferential consideration in the procurement process;

   Inserted: (iii) appropriate mechanisms to implement preferential consideration in the procurement process, including--

   Inserted: (I) establishing a policy encouraging Federal agencies to conduct market research and industry outreach to identify property and services that adhere to relevant cybersecurity practices;

   Inserted: (II) authorizing the use of a mark for the Voluntary Cybersecurity Program for Critical Infrastructure to be used for marketing property or services to the Federal Government;

   Inserted: (III) establishing a policy of encouraging procurement of certain property and services from an approved list;

   Inserted: (IV) authorizing the use of a preference by Federal agencies in the evaluation process; and

   Inserted: (V) authorizing a requirement in certain solicitations that the person providing the property or services be a certified owner; and

   Inserted: (iv) benefits of and impact on the economy and efficiency of the Federal procurement system, if preferential consideration were given in the procurement process to encourage the procurement of property and services that adhere to relevant baseline performance goals establishing under the Voluntary Cybersecurity Program for Critical Infrastructure.

   Inserted: SEC. 105. RULES OF CONSTRUCTION.

   Inserted: Nothing in this title shall be construed to--

   Inserted: (1) provide additional authority for any sector-specific agency or any Federal agency that is not a sector-specific agency with responsibilities for regulating the security of critical infrastructure to establish standards or other cybersecurity measures that are applicable to the security of critical infrastructure not otherwise authorized by law;

   Inserted: (2) limit or restrict the authority of the Department, or any other Federal agency, under any other provision of law; or

   Inserted: (3) permit any owner (including a certified owner) to fail to comply with any other law or regulation, unless specifically authorized.

   Original wording

   On page 23, strike line 19 and all that follows through page 34, line 19, and insert the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed