S.Amdt. 2741

1. Rewrites page 27, line 13 through page 30, line 19

   ReplacesPrinted page

   Removes page 27, line 13 through page 30, line 19 of the printed bill. See that page

   Inserted: (ii) submit to the Council an application for an assessment described in subsection (b)(1)(B) by a qualified third-party private entity verifying that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103.

   Inserted: (4) Certification.--

   Inserted: (A) Self-certification.--Upon receipt of a self-certification under paragraph (3)(B)(i), the Council shall certify an owner.

   Inserted: (B) Assessment application.--

   Inserted: (i) In general.--Upon receipt of an application by an owner for an assessment under paragraph (3)(B)(ii), the Council shall direct a qualified third-party private entity to conduct an assessment of the owner in accordance with an agreement described in subsection (b)(1).

   Inserted: (ii) In compliance.--If a qualified third-party private entity determines an owner is in compliance with all applicable cybersecurity practices, the Council shall certify the owner.

   Inserted: (5) Nonperformance.--If the Council determines that a certified owner is not in compliance with the cybersecurity practices established under section 103, the Council shall--

   Inserted: (A) notify the certified owner of such determination; and

   Inserted: (B) work with the certified owner to remediate promptly any deficiencies.

   Inserted: (6) Revocation.--If a certified owner fails to remediate promptly any deficiencies identified by the Council, the Council shall revoke the certification of the certified owner.

   Inserted: (7) Redress.--

   Inserted: (A) In general.--If the Council revokes a certification under paragraph (6), the Council shall--

   Show 29 more inserted paragraphsShow less

   Inserted: (i) notify the owner of such revocation; and

   Inserted: (ii) provide the owner with specific cybersecurity measures that, if implemented, would remediate any deficiencies.

   Inserted: (B) Recertification.--If the Council determines that an owner has remedied any deficiencies and is in compliance with the cybersecurity practices, the Council may recertify the owner.

   Inserted: (b) Assessments.--

   Inserted: (1) Third-party assessments.--The Council shall--

   Inserted: (A) develop qualifications for third-party private entities that ensure that the entity has--

   Inserted: (i) substantial expertise in cybersecurity;

   Inserted: (ii) the expertise necessary to perform third-party audits of the cybersecurity of critical cyber infrastructure systems and assets;

   Inserted: (iii) adopted appropriate policies and procedures to ensure that the entity provides independent analysis that is not affected by any conflict of interest or colored by any business interest that the entity may hold; and

   Inserted: (iv) any other qualifications determined relevant by the Council; and

   Inserted: (B) in consultation with owners and operators and the Critical Infrastructure Protection Advisory Council, shall enter into agreements with qualified third-party private entities, to conduct assessments that use reliable, repeatable, performance-based evaluations and metrics to assess whether an owner submitting an application under subsection (a)(3)(B)(ii) is in compliance with all applicable cybersecurity practices.

   Inserted: (2) Training.--The Council shall ensure that third party assessors described in paragraph (1) undergo regular training and accreditation.

   Inserted: (3) Other assessments.--Using the procedures developed under this section, the Council may perform cybersecurity assessments of a certified owner based on actual knowledge or a reasonable suspicion that the certified owner is not in compliance with the cybersecurity practices or any other risk-based factors as identified by the Council.

   Inserted: (4) Notification.--The Council shall provide copies of any assessments by the Federal Government to the certified owner.

   Inserted: (5) Access to information.--

   Inserted: (A) In general.--For the purposes of an assessment conducted under this subsection, a certified owner shall provide the Council, or a third party assessor, any reasonable access necessary to complete an assessment.

   Inserted: (B) Protection of information.--Information provided to the Council, the Council's designee, or any assessor during the course of an assessment under this section shall be protected from disclosure in accordance with section 106.

   Inserted: (c) Benefits of Certification.--

   Inserted: (1) Limitations on civil liability.--

   Inserted: (A) Definition.--

   Inserted: (i) In general.--In this paragraph, the term "cyber attack" means an incident determined by the Attorney General to be an unauthorized intrusion or attack on or through a computer system or asset that causes damage or disruption to the operation or integrity of critical infrastructure that results in--

   Inserted: (I) loss of life, serious physical injury, or the substantial interruption of life-sustaining services;

   Inserted: (II) catastrophic economic damage to the United States, including--

   Inserted: (aa) failure or substantial disruption of a United States financial market;

   Inserted: (bb) incapacitation or sustained disruption of a transportation system; or

   Inserted: (cc) other systemic, long-term damage to the United States economy; or

   Inserted: (III) severe degradation of national security or national security capabilities, including intelligence and defense functions.

   Inserted: (ii) No judicial review.--A determination by the Attorney General under clause (i) shall not be subject to judicial review.

   Inserted: (B) Limitation.--In any civil action for damages directly caused by a cyber attack, a certified owner shall not be liable for any punitive damages intended to punish or deter if the certified owner is in compliance with the appropriate cybersecurity practices at the time of the incident related to that cyber risk.

   Original wording

   On page 27, strike line 13 and all that follows through page 30, line 19, and insert the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed