Of a perfecting nature.

1. Rewrites page 20, line 3 through page 42, line 10

   ReplacesPrinted page

   Removes page 20, line 3 through page 42, line 10 of the printed bill. See that page

   Inserted: SEC. 103. VOLUNTARY CYBERSECURITY PRACTICES.

   Inserted: (a) Private Sector Development of Cybersecurity Practices.--Not later than 180 days after the date of enactment of this Act, each sector coordinating council shall propose to the Council voluntary outcome-based cybersecurity practices (referred to in this section as "cybersecurity practices") sufficient to effectively remediate or mitigate cyber risks identified through an assessment conducted under section 102(a) comprised of--

   Inserted: (1) industry best practices, standards, and guidelines; or

   Inserted: (2) practices developed by the sector coordinating council in coordination with owners and operators, voluntary consensus standards development organizations, representatives of State and local governments, the private sector, and appropriate information sharing and analysis organizations.

   Inserted: (b) Review of Cybersecurity Practices.--

   Inserted: (1) In general.--The Council shall, in consultation with owners and operators, the Critical Infrastructure Partnership Advisory Council, and appropriate information sharing and analysis organizations, and in coordination with appropriate representatives from State and local governments--

   Inserted: (A) consult with relevant security experts and institutions of higher education, including university information security centers, appropriate nongovernmental cybersecurity experts, and representatives from national laboratories;

   Inserted: (B) review relevant regulations or compulsory standards or guidelines;

   Inserted: (C) review cybersecurity practices proposed under subsection (a); and

   Inserted: (D) consider any amendments to the cybersecurity practices and any additional cybersecurity practices necessary to ensure adequate remediation or mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Inserted: (2) Adoption.--

   Inserted: (A) In general.--Not later than 1 year after the date of enactment of this Act, the Council shall--

   Show 128 more inserted paragraphsShow less

   Inserted: (i) adopt any cybersecurity practices proposed under subsection (a) that adequately remediate or mitigate identified cyber risks and any associated consequences identified through an assessment conducted under section 102(a); and

   Inserted: (ii) adopt any amended or additional cybersecurity practices necessary to ensure the adequate remediation or mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Inserted: (B) No submission by sector coordinating council.--If a sector coordinating council fails to propose to the Council cybersecurity practices under subsection (a) within 180 days of the date of enactment of this Act, not later than 1 year after the date of enactment of this Act the Council shall adopt cybersecurity practices that adequately remediate or mitigate identified cyber risks and associated consequences identified through an assessment conducted under section 102(a) for the sector.

   Inserted: (c) Flexibility of Cybersecurity Practices.--Each sector coordinating council and the Council shall periodically assess cybersecurity practices, but not less frequently than once every 3 years, and update or modify cybersecurity practices as necessary to ensure adequate remediation and mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Inserted: (d) Prioritization.--Based on the risk assessments performed under section 102(a), the Council shall prioritize the development of cybersecurity practices to ensure the reduction or mitigation of the greatest cyber risks.

   Inserted: (e) Private Sector Recommended Measures.--Each sector coordinating council shall develop voluntary recommended cybersecurity measures that provide owners reasonable and cost-effective methods of meeting any cybersecurity practice.

   Inserted: (f) Technology Neutrality.--No cybersecurity practice shall require--

   Inserted: (1) the use of a specific commercial information technology product; or

   Inserted: (2) that a particular commercial information technology product be designed, developed, or manufactured in a particular manner.

   Inserted: (g) Relationship to Existing Regulations.--

   Inserted: (1) Rule of construction.--Nothing in this section shall be construed to increase, decrease, or otherwise alter the existing authority of any Federal agency to regulate the security of critical cyber infrastructure.

   Inserted: (2) Avoidance of conflict.--No cybersecurity practice shall--

   Inserted: (A) prevent an owner (including a certified owner) or operator from complying with any law or regulation; or

   Inserted: (B) require an owner (including a certified owner) or operator to implement cybersecurity measures that prevent the owner or operator from complying with any law or regulation.

   Inserted: (h) Independent Review.--

   Inserted: (1) In general.--Each cybersecurity practice shall be publicly reviewed by the relevant sector coordinating council and the Critical Infrastructure Partnership Advisory Council, which may include input from relevant institutions of higher education, including university information security centers, national laboratories, and appropriate non-governmental cybersecurity experts.

   Inserted: (2) Consideration by council.--The Council shall consider any review conducted under paragraph (1).

   Inserted: (i) Voluntary Technical Assistance.--At the request of an owner or operator of critical infrastructure, the Council shall provide guidance on the application of cybersecurity practices to the critical infrastructure.

   Inserted: SEC. 104. VOLUNTARY CYBERSECURITY PROGRAM FOR CRITICAL INFRASTRUCTURE.

   Inserted: (a) Voluntary Cybersecurity Program for Critical Infrastructure.--

   Inserted: (1) In general.--Not later than 1 year after the date of enactment of this Act, the Council, in consultation with owners and operators and the Critical Infrastructure Partnership Advisory Council, shall establish the Voluntary Cybersecurity Program for Critical Infrastructure in accordance with this section.

   Inserted: (2) Eligibility.--

   Inserted: (A) In general.--An owner of critical cyber infrastructure may apply for certification under the Voluntary Cybersecurity Program for Critical Infrastructure.

   Inserted: (B) Criteria.--The Council shall establish criteria for owners of critical infrastructure that is not critical cyber infrastructure to be eligible to apply for certification in the Voluntary Cybersecurity Program for Critical Infrastructure.

   Inserted: (3) Application for certification.--An owner of critical cyber infrastructure or an owner of critical infrastructure that meets the criteria established under paragraph (2)(B) that applies for certification under this subsection shall--

   Inserted: (A) select and implement cybersecurity measures of their choosing that satisfy the outcome-based cybersecurity practices established under section 103; and

   Inserted: (B)(i) certify in writing and under penalty of perjury to the Council that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103; or

   Inserted: (ii) submit to the Council an assessment verifying that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103.

   Inserted: (4) Certification.--Upon receipt of a self-certification under paragraph (3)(B)(i) or an assessment under paragraph (3)(B)(ii) the Council shall certify an owner.

   Inserted: (5) Nonperformance.--If the Council determines that a certified owner is not in compliance with the cybersecurity practices established under section 103, the Council shall--

   Inserted: (A) notify the certified owner of such determination; and

   Inserted: (B) work with the certified owner to remediate promptly any deficiencies.

   Inserted: (6) Revocation.--If a certified owner fails to remediate promptly any deficiencies identified by the Council, the Council shall revoke the certification of the certified owner.

   Inserted: (7) Redress.--

   Inserted: (A) In general.--If the Council revokes a certification under paragraph (6), the Council shall--

   Inserted: (i) notify the owner of such revocation; and

   Inserted: (ii) provide the owner with specific cybersecurity measures that, if implemented, would remediate any deficiencies.

   Inserted: (B) Recertification.--If the Council determines that an owner has remedied any deficiencies and is in compliance with the cybersecurity practices, the Council may recertify the owner.

   Inserted: (b) Assessments.--

   Inserted: (1) Third-party assessments.--The Council, in consultation with owners and operators and the Critical Infrastructure Protection Advisory Council, shall enter into agreements with qualified third-party private entities, to conduct assessments that use reliable, repeatable, performance-based evaluations and metrics to assess whether an owner certified under subsection (a)(3)(B)(ii) is in compliance with all applicable cybersecurity practices.

   Inserted: (2) Training.--The Council shall ensure that third party assessors described in paragraph (1) undergo regular training and accreditation.

   Inserted: (3) Other assessments.--Using the procedures developed under this section, the Council may perform cybersecurity assessments of a certified owner based on actual knowledge or a reasonable suspicion that the certified owner is not in compliance with the cybersecurity practices or any other risk-based factors as identified by the Council.

   Inserted: (4) Notification.--The Council shall provide copies of any assessments by the Federal Government to the certified owner.

   Inserted: (5) Access to information.--

   Inserted: (A) In general.--For the purposes of an assessment conducted under this subsection, a certified owner shall provide the Council, or a third party assessor, any reasonable access necessary to complete an assessment.

   Inserted: (B) Protection of information.--Information provided to the Council, the Council's designee, or any assessor during the course of an assessment under this section shall be protected from disclosure in accordance with section 106.

   Inserted: (c) Benefits of Certification.--

   Inserted: (1) Limitations on civil liability.--

   Inserted: (A) In general.--In any civil action for damages directly caused by an incident related to a cyber risk identified through an assessment conducted under section 102(a), a certified owner shall not be liable for any punitive damages intended to punish or deter if the certified owner is in substantial compliance with the appropriate cybersecurity practices at the time of the incident related to that cyber risk.

   Inserted: (B) Limitation.--Subaragraph (A) shall only apply to harm directly caused by the incident related to the cyber risk and shall not apply to damages caused by any additional or intervening acts or omissions by the owner.

   Inserted: (2) Expedited security clearance process.--The Council, in coordination with the Office of the Director of National Intelligence, shall establish a procedure to expedite the provision of security clearances to appropriate personnel employed by a certified owner.

   Inserted: (3) Prioritized technical assistance.--The Council shall ensure that certified owners are eligible to receive prioritized technical assistance.

   Inserted: (4) Provision of cyber threat information.--The Council shall develop, in coordination with certified owners, a procedure for ensuring that certified owners are, to the maximum extent practicable and consistent with the protection of sources and methods, informed of relevant real-time cyber threat information.

   Inserted: (5) Public recognition.--With the approval of a certified owner, the Council may publicly recognize the certified owner if the Council determines such recognition does not pose a risk to the security of critical cyber infrastructure.

   Inserted: (6) Study to examine benefits of procurement preference.--

   Inserted: (A) In general.--The Federal Acquisition Regulatory Council, in coordination with the Council and with input from relevant private sector individuals and entities, shall conduct a study examining the potential benefits of establishing a procurement preference for the Federal Government for certified owners.

   Inserted: (B) Areas.--The study under subparagraph (A) shall include a review of--

   Inserted: (i) potential persons and related property and services that could be eligible for preferential consideration in the procurement process;

   Inserted: (ii) development and management of an approved list of categories of property and services that could be eligible for preferential consideration in the procurement process;

   Inserted: (iii) appropriate mechanisms to implement preferential consideration in the procurement process, including--

   Inserted: (I) establishing a policy encouraging Federal agencies to conduct market research and industry outreach to identify property and services that adhere to relevant cybersecurity practices;

   Inserted: (II) authorizing the use of a mark for the Voluntary Cybersecurity Program for Critical Infrastructure to be used for marketing property or services to the Federal Government;

   Inserted: (III) establishing a policy of encouraging procurement of certain property and services from an approved list;

   Inserted: (IV) authorizing the use of a preference by Federal agencies in the evaluation process; and

   Inserted: (V) authorizing a requirement in certain solicitations that the person providing the property or services be a certified owner; and

   Inserted: (iv) benefits of and impact on the economy and efficiency of the Federal procurement system, if preferential consideration were given in the procurement process to encourage the procurement of property and services that adhere to relevant baseline performance goals establishing under the Voluntary Cybersecurity Program for Critical Infrastructure.

   Inserted: SEC. 105. RULES OF CONSTRUCTION.

   Inserted: Nothing in this title shall be construed to--

   Inserted: (1) provide additional authority for any sector-specific agency or any Federal agency that is not a sector-specific agency with responsibilities for regulating the security of critical infrastructure to establish standards or other cybersecurity measures that are applicable to the security of critical infrastructure not otherwise authorized by law;

   Inserted: (2) limit or restrict the authority of the Department, or any other Federal agency, under any other provision of law; or

   Inserted: (3) permit any owner (including a certified owner) to fail to comply with any other law or regulation, unless specifically authorized.

   Inserted: SEC. 106. PROTECTION OF INFORMATION.

   Inserted: (a) Definitions.--In this section--

   Inserted: (1) the term "covered information" means any information--

   Inserted: (A) submitted as part of the process established under section 102(a)(3);

   Inserted: (B) submitted under section 102(b)(2)(C);

   Inserted: (C) required to be submitted by owners under section 102(b)(4);

   Inserted: (D) provided to the Secretary, the Secretary's designee, or any assessor during the course of an assessment under section 104; or

   Inserted: (E) provided to the Secretary or the Inspector General of the Department through the tip line or another secure channel established under subsection (c); and

   Inserted: (2) the term "Inspector General" means an Inspector General described in subparagraph (A), (B), or (I) of section 11(b)(1) of the Inspector General Act of 1978 (5 U.S.C. App.), the Inspector General of the United States Postal Service, the Inspector General of the Central Intelligence Agency, and the Inspector General of the Intelligence Community.

   Inserted: (b) Critical Infrastructure Information.--

   Inserted: (1) In general.--Covered information shall be treated as voluntarily shared critical infrastructure information under section 214 of the Homeland Security Act of 2002 (6 U.S.C. 133), except that the requirement of such section 214 that the information be voluntarily submitted shall not be required for protection of information under this section to apply.

   Inserted: (2) Savings clause for existing whistleblower protections.--With respect to covered information, the rights and protections relating to disclosure by individuals of voluntarily shared critical infrastructure information submitted under subtitle B of title II of the Homeland Security Act of 2002 (6 U.S.C. 131 et seq.) shall apply with respect to disclosure of the covered information by individuals.

   Inserted: (c) Critical Infrastructure Cyber Security Tip Line.--

   Inserted: (1) In general.--The Secretary shall establish and publicize the availability of a Critical Infrastructure Cyber Security Tip Line (and any other secure means the Secretary determines would be desirable to establish), by which individuals may report--

   Inserted: (A) concerns involving the security of covered critical infrastructure against cyber risks; and

   Inserted: (B) concerns (in addition to any concerns described under subparagraph (A)) with respect to programs and functions authorized or funded under this title involving--

   Inserted: (i) a possible violation of any law, rule, regulation or guideline;

   Inserted: (ii) mismanagement;

   Inserted: (iii) risk to public health, safety, security, or privacy; or

   Inserted: (iv) other misfeasance or nonfeasance.

   Inserted: (2) Designation of employees.--The Secretary and the Inspector General of the Department shall each designate employees authorized to receive concerns reported under this subsection that include--

   Inserted: (A) disclosure of covered information; or

   Inserted: (B) any other disclosure of information that is specifically prohibited by law or is specifically required by Executive order to be kept secret in the interest of national defense or the conduct of foreign affairs.

   Inserted: (3) Handling of certain concerns.--A concern described in paragraph (1)(B)--

   Inserted: (A) shall be received initially to the Inspector General of the Department;

   Inserted: (B) shall not be provided initially to the Secretary; and

   Inserted: (C) may be provided to the Secretary if determined appropriate by the Inspector General of the Department.

   Inserted: (d) Rules of Construction.--Nothing in this section shall be construed to--

   Inserted: (1) limit or otherwise affect the right, ability, duty, or obligation of any entity to use or disclose any information of that entity, including in the conduct of any judicial or other proceeding;

   Inserted: (2) prevent the classification of information submitted under this section if that information meets the standards for classification under Executive Order 12958, or any successor thereto, or affect measures and controls relating to the protection of classified information as prescribed by Federal statute or under Executive Order 12958, or any successor thereto;

   Inserted: (3) limit or otherwise affect the ability of an entity, agency, or authority of a State, a local government, or the Federal Government or any other individual or entity under applicable law to obtain information that is not covered information (including any information lawfully and properly disclosed generally or broadly to the public) and to use such information in any manner permitted by law, including the disclosure of such information under--

   Inserted: (A) section 552 or 2302(b)(8) of title 5, United States Code;

   Inserted: (B) section 2409 of title 10, United States Code; or

   Inserted: (C) any other Federal, State, or local law, ordinance, or regulation that protects against retaliation an individual who discloses information that the individual reasonably believes evidences a violation of any law, rule, or regulation, gross mismanagement, substantial and specific danger to public health, safety, or security, or other misfeasance or nonfeasance;

   Inserted: (4) prevent the Secretary from using information required to be submitted under this Act for enforcement of this title, including enforcement proceedings subject to appropriate safeguards;

   Inserted: (5) authorize information to be withheld from any committee of Congress, the Comptroller General, or any Inspector General;

   Inserted: (6) affect protections afforded to trade secrets under any other provision of law; or

   Inserted: (7) create a private right of action for enforcement of any provision of this section.

   Inserted: (e) Audit.--

   Inserted: (1) In general.--Not later than 1 year after the date of enactment of this Act, the Inspector General of the Department shall conduct an audit of the management of covered information under this title and report the findings to appropriate congressional committees.

   Inserted: (2) Contents.--The audit under paragraph (1) shall include assessments of--

   Inserted: (A) whether the covered information is adequately safeguarded against inappropriate disclosure;

   Inserted: (B) the processes for marking and disseminating the covered information and resolving any disputes;

   Inserted: (C) how the covered information is used for the purposes of this title, and whether that use is effective;

   Inserted: (D) whether sharing of covered information has been effective to fulfill the purposes of this title;

   Inserted: (E) whether the kinds of covered information submitted have been appropriate and useful, or overbroad or overnarrow;

   Inserted: (F) whether the protections of covered information allow for adequate accountability and transparency of the regulatory, enforcement, and other aspects of implementing this title; and

   Inserted: (G) any other factors at the discretion of the Inspector General of the Department.

   Inserted: SEC. 107. ANNUAL ASSESSMENT OF CYBERSECURITY.

   Inserted: (a) In General.--Not later than 1 year after the date of enactment of this Act, and every year thereafter, the Council shall submit to the appropriate congressional committees a report on the effectiveness of this title in reducing the risk of cyber attack to critical infrastructure.

   Inserted: (b) Contents.--Each report submitted under subsection (a) shall include--

   Inserted: (1) a discussion of cyber risks and associated consequences and whether the cybersecurity practices developed under section 103 are sufficient to effectively remediate and mitigate cyber risks and associated consequences; and

   Inserted: (2) an analysis of--

   Inserted: (A) whether owners of critical cyber infrastructure are successfully implementing the cybersecurity practices adopted under section 103;

   Inserted: (B) whether the critical infrastructure of the United States is effectively secured from cybersecurity threats, vulnerabilities, and consequences; and

   Inserted: (C) whether additional legislative authority or other actions are needed to effectively remediate or mitigate cyber risks and associated consequences.

   Inserted: (c) Form of Report.--A report submitted under this subsection shall be submitted in an unclassified form, but may include a classified annex, if necessary.

   Original wording

   On page 20, strike line 3 and all that follows through page 42, line 10, and insert the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed