S.Amdt. 2751
What it does: 91 changes: replaces text in 57 places, strikes text in 6 places, adds a section, inserts text in 27 places
Sen. Joseph I. Lieberman (D-CT)What it changes
91 changes to S. 3414 · 20 shown in the bill's text
We couldn't read part of this amendment. That part is shown as written below.
Change 1: Replaces “the underlying framework that information systems and assets rely on” with “information and information systems relied upon”
In S. 3414 · Placed on Calendar Senate
(11) Incident.--The term "incident" has the meaning given that term in section 3552 of title 44, United States Code, as added by section 201 of this Act.
(12) Information infrastructure.--The term "information infrastructure" means
[struck: the underlying framework that ][inserted: information and ]information systems[struck: and assets rely on ][inserted: relied upon ]to process, transmit, receive, or store information electronically, including programmable electronic devices, communications networks, and industrial or supervisory control systems and any associated hardware, software, or data.(13) Information sharing and analysis organization.--The term "Information Sharing and Analysis Organization" has the meaning given that term in section 212 of the Homeland Security Act of 2002 (6 U.S.C. 131).
Original wording
On page 6, beginning on line 2, strike “the underlying framework that information systems and assets rely on” and insert “information and information systems relied upon”.
Change 2: Rewrites page 7, line 20 through page 8, line 9
ReplacesPrinted pageRemoves page 7, line 20 through page 8, line 9 of the printed bill. See that page
Inserted: (21) Operator.--The term "operator"--
Inserted: (A) means an entity that manages, runs, or operates, in whole or in part, the day-to-day operations of critical infrastructure; and
Inserted: (B) may include the owner of critical infrastructure.
Inserted: (22) Owner.--The term "owner"--
Inserted: (A) means an entity that owns critical infrastructure; and
Inserted: (B) does not include a company contracted by the owner to manage, run, or operate that critical infrastructure, or to provide a specific information technology product or service that is used or incorporated into that critical infrastructure.
Original wording
On page 7, strike line 20 and all that follows through page 8, line 9, and insert the following:
Change 3: Strikes “, or an attempted to cause an incident that, if successful, would have resulted in”
In S. 3414 · Placed on Calendar Senate
(23) Secretary.--The term "Secretary" means the Secretary of Homeland Security.
(24) Significant cyber incident.--The term "significant cyber incident" means an incident resulting in
[struck: , or an attempted to cause an incident that, if successful, would have resulted in]--(A) the exfiltration of data that is essential to the operation of critical cyber infrastructure; or
Original wording
On page 8, beginning on line 14, strike “, or an attempted to cause an incident that, if successful, would have resulted in”.
Change 4: Adds SEC. 3. RULE OF CONSTRUCTION on page 8, line 22
Adds a sectionPrinted pageInserted: SEC. 3. RULE OF CONSTRUCTION.
Inserted: (a) Definition.--In this section, the term "covered information" means information collected by a Federal agency solely for statistical purposes under a pledge of confidentiality.
Inserted: (b) Rule of Construction Relating to Covered Information.--Nothing in this Act or an amendment made by this Act shall be construed to alter, amend, or repeal any provision of title 13, United States Code, the International Investment and Trade in Services Survey Act (22 U.S.C. 3101 et seq.), or the Confidential Information Protection and Statistical Efficiency Act of 2002 (44 U.S.C. 3501 note), or any similar provision of law, that relates to the unauthorized disclosure or use of covered information, except that the head of each Federal agency that collects covered information pursuant to any such provision of law is authorized to disclose the covered information to the Secretary to fulfill the information security responsibilities of the head of the Federal agency and the Secretary under sections 3553 and 3554 of title 44, United States Code, as amended by this Act.
Original wording
On page 8, after line 22, insert the following:
Change 5: Inserts “, in connection with activities authorized and conducted in accordance with this title” before “; and”
…[inserted: , in connection with activities authorized and conducted in accordance with this title ]; and…
Original wording
On page 10, line 7, before “; and” insert “, in connection with activities authorized and conducted in accordance with this title”.
Change 6: Replaces “technical guidance or assistance to owners and operators consistent with this title” with “guidance on the application of cybersecurity practices in accordance with this title”
In S. 3414 · Placed on Calendar Senate
(5) develop procedures to inform owners and operators of cyber threats, vulnerabilities, and consequences; and
(6) upon request and to the maximum extent possible, provide any
[struck: technical ]guidance[struck: or assistance to owners and operators consistent ][inserted: on the application of cybersecurity practices in accordance ]with this title.(c) Procedures.--The President shall establish procedures, consistent with this section, for the operation of the Council, which shall include procedures that--
Original wording
On page 10, beginning on line 9, strike “technical guidance or assistance to owners and operators consistent with this title” and insert “guidance on the application of cybersecurity practices in accordance with this title”.
Change 7: Inserts “and” after the semicolon
Inserted: and
Original wording
On page 10, line 18, insert “and” after the semicolon.
Change 8: Rewrites page 11, lines 1–13
ReplacesPrinted pageRemoves page 11, lines 1–13 of the printed bill. See that page
Inserted: (d) Membership.--The Council shall be comprised of--
Inserted: (1) the Secretary of Commerce;
Inserted: (2) the Secretary of Defense;
Inserted: (3) the Attorney General;
Inserted: (4) the Director of National Intelligence;
Inserted: (5) the heads of sector-specific Federal agencies that are appointed by the President, by and with the advice and consent of the Senate, as determined by the President in accordance with subsection (g);
Inserted: (6) the heads of Federal agencies with responsibility for regulating the security of critical cyber infrastructure that are appointed by the President, by and with the advice and consent of the Senate, as determined by the President in accordance with subsection (g); and
Inserted: (7) the Secretary.
Original wording
On page 11, strike lines 1 through 13 and insert the following:
Change 9: Inserts “, to the maximum extent possible,” after “provide”
…provide[inserted: , to the maximum extent possible,]…
Original wording
On page 12, line 3, after “provide” insert “, to the maximum extent possible,”.
Change 10: Inserts “, to the maximum extent possible,” after “provide”
…provide[inserted: , to the maximum extent possible,]…
Original wording
On page 12, line 5, after “provide” insert “, to the maximum extent possible,”.
Change 11: Replaces “A” with “The head of a”
[struck: A][inserted: The head of a]Original wording
On page 12, line 8, strike “A” and insert “The head of a”.
Change 12: Replaces “and a” with “or a”
[struck: and a][inserted: or a]Original wording
On page 12, line 9, strike “and a” and insert “or a”.
Change 13: Inserts “, including” after “responsibility”
…responsibility[inserted: , including]…
Original wording
On page 12, line 13, after “responsibility” insert “, including”.
Change 14: Inserts “appropriate” after “with”
…with[inserted: appropriate]…
Original wording
On page 13, line 13, after “with” insert “appropriate”.
Change 15: Replaces “180 days” with “90 days”
[struck: 180 days][inserted: 90 days]Original wording
On page 13, line 20, strike “180 days” and insert “90 days”.
Change 16: Inserts new text on page 15, between lines 9 and 10
InsertsPrinted pageInserted: (6) Initial assessments.--Not later than 270 days after the date of enactment of this Act, the member agency designated under paragraph (1) shall complete initial cyber risk assessments described in paragraph (2)(B).
Original wording
On page 15, between lines 9 and 10, insert the following:
Change 17: Replaces “damage” with “harm”
[struck: damage][inserted: harm]Original wording
On page 17, line 16, strike “damage” and insert “harm”.
Change 18: Replaces “damage” with “harm”
[struck: damage][inserted: harm]Original wording
On page 18, line 2, strike “damage” and insert “harm”.
Change 19: Replaces “180 days” with “1 year”
[struck: 180 days][inserted: 1 year]Original wording
On page 20, line 5, strike “180 days” and insert “1 year”.
Change 20: Strikes “, standards,”
Struck: , standards,
Original wording
On page 20, line 12, strike “, standards,”.
Change 21: Inserts “appropriate” after “with”
…with[inserted: appropriate]…
Original wording
On page 20, line 22, after “with” insert “appropriate”.
Change 22: Replaces “relevant security experts and” with “appropriate security experts,”
In S. 3414 · Placed on Calendar Senate
(1) In general.--The Council shall, in consultation with owners and operators, the Critical Infrastructure Partnership Advisory Council, and appropriate information sharing and analysis organizations, and in coordination with appropriate representatives from State and local governments--
(A) consult with
[struck: relevant][inserted: appropriate] security experts[struck: and ][inserted: , ]institutions of higher education, including university information security centers, appropriate nongovernmental cybersecurity experts, and representatives from national laboratories;(B) review relevant regulations or compulsory standards or guidelines;
Original wording
On page 21, beginning on line 3, strike “relevant security experts and” and insert “appropriate security experts,”.
Change 23: Inserts new text on page 21, between lines 17 and 18
InsertsPrinted pageInserted: (2) NIST involvement.--As part of the process described in paragraph (1), the Director of the National Institute of Standards and Technology shall be invited to provide advice and guidance on any possible amendments to the cybersecurity practices and any additional cybersecurity practices in consultation with appropriate public and private stakeholders.
Original wording
On page 21, between lines 17 and 18, insert the following:
Change 24: Replaces “(2)” with “(3)”
[struck: (2)][inserted: (3)]Original wording
On page 21, line 18, strike “(2)” and insert “(3)”.
Change 25: Replaces “1 year” with “18 months”
[struck: 1 year][inserted: 18 months]Original wording
On page 21, line 19, strike “1 year” and insert “18 months”.
Change 26: Replaces “180 days” with “1 year”
[struck: 180 days][inserted: 1 year]Original wording
On page 22, beginning on line 11, strike “180 days” and insert “1 year”.
Change 27: Replaces “1 year” with “18 months”
[struck: 1 year][inserted: 18 months]Original wording
On page 22, line 13, strike “1 year” and insert “18 months”.
Change 28: Rewrites page 25, lines 10–17
ReplacesPrinted pageRemoves page 25, lines 10–17 of the printed bill. See that page
Inserted: (1) In general.--After the Council adopts a cybersecurity practice, a relevant sector coordinating council and the Critical Infrastructure Partnership Advisory Council may issue a public report evaluating the cybersecurity practice, which may include input from appropriate institutions of higher education, including university information security centers, national laboratories, and appropriate nongovernmental cybersecurity experts.
Original wording
On page 25, strike lines 10 through 17 and insert the following:
Change 29: Replaces “consider any review conducted” with “consider, in accordance with subsection (c), any public report issued”
In S. 3414 · Placed on Calendar Senate
(1) In general.--Each cybersecurity practice shall be publicly reviewed by the relevant sector coordinating council and the Critical Infrastructure Partnership Advisory Council, which may include input from relevant institutions of higher education, including university information security centers, national laboratories, and appropriate non-governmental cybersecurity experts.
(2) Consideration by council.--The Council shall consider
[struck: ][inserted: , in accordance with subsection (c), ]any[struck: review conducted ][inserted: public report issued ]under paragraph (1).(i) Voluntary Technical Assistance.--At the request of an owner or operator of critical infrastructure, the Council shall provide guidance on the application of cybersecurity practices to the critical infrastructure.
Original wording
On page 25, line 19, strike “consider any review conducted” and insert “consider, in accordance with subsection (c), any public report issued”.
Change 30: Rewrites page 25, lines 21–24
ReplacesPrinted pageRemoves page 25, lines 21–24 of the printed bill. See that page
Inserted: (i) Voluntary Guidance.--At the request of an owner or operator, the Council may provide guidance on the application of cybersecurity practices to the critical infrastructure in accordance with this title.
Original wording
On page 25, strike lines 21 through 24 and insert the following:
Change 31: Replaces “1 year” with “18 months”
[struck: 1 year][inserted: 18 months]Original wording
On page 26, line 5, strike “1 year” and insert “18 months”.
Change 32: Replaces “an assessment” with “a third-party assessment, in accordance with subsection (b),”
[struck: an assessment][inserted: a third-party assessment, in accordance with subsection (b),]Original wording
On page 27, line 13, strike “an assessment” and insert “a third-party assessment, in accordance with subsection (b),”.
Change 33: Replaces “specific cybersecurity measures that, if implemented, would” with “guidance on how to”
In S. 3414 · Placed on Calendar Senate
(i) notify the owner of such revocation; and
(ii) provide the owner with
[struck: specific cybersecurity measures that, if implemented, would ][inserted: guidance on how to ]remediate any deficiencies.(B) Recertification.--If the Council determines that an owner has remedied any deficiencies and is in compliance with the cybersecurity practices, the Council may recertify the owner.
Original wording
On page 28, beginning on line 15, strike “specific cybersecurity measures that, if implemented, would” and insert “guidance on how to”.
Change 34: Replaces “owner” through line 7 with “owner has effectively implemented cybersecurity measures sufficient to satisfy the outcom…”
[struck: owner …][inserted: owner has effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103.]Original wording
On page 29, line 5, strike “owner” and all that follows through line 7, and insert the following: “owner has effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103.”.
Change 35: Replaces “Subaragraph” with “Subparagraph”
In S. 3414 · Placed on Calendar Senate
(A) In general.--In any civil action for damages directly caused by an incident related to a cyber risk identified through an assessment conducted under section 102(a), a certified owner shall not be liable for any punitive damages intended to punish or deter if the certified owner is in substantial compliance with the appropriate cybersecurity practices at the time of the incident related to that cyber risk.
(B) Limitation.--
[struck: Subaragraph][inserted: Subparagraph] (A) shall only apply to harm directly caused by the incident related to the cyber risk and shall not apply to damages caused by any additional or intervening acts or omissions by the owner.(2) Expedited security clearance process.--The Council, in coordination with the Office of the Director of National Intelligence, shall establish a procedure to expedite the provision of security clearances to appropriate personnel employed by a certified owner.
Original wording
On page 30, line 20, strike “Subaragraph” and insert “Subparagraph”.
Change 36: Inserts “including under title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et seq.),” before “or”
…[inserted: including under title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et seq.), ]or…
Original wording
On page 34, line 15, before “or” insert “including under title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et seq.),”.
Change 37: Replaces “treated as voluntarily shared critical infrastructure information under” with “afforded the protections of”
[struck: treated as voluntarily shared critical infrastructure information under][inserted: afforded the protections of]Original wording
On page 35, beginning on line 19, strike “treated as voluntarily shared critical infrastructure information under” and insert “afforded the protections of”.
Change 38: Replaces “covered critical” with “critical cyber”
[struck: covered critical][inserted: critical cyber]Original wording
On page 36, beginning on line 16, strike “covered critical” and insert “critical cyber”.
Change 39: Replaces “concerns (in addition to any concerns described under subparagraph (A))” with “other concerns”
In S. 3414 · Placed on Calendar Senate
(A) concerns involving the security of covered critical infrastructure against cyber risks; and
(B)
[struck: concerns (in addition to any ][inserted: other ]concerns[struck: described under subparagraph (A)) ]with respect to programs and functions authorized or funded under this title involving--(i) a possible violation of any law, rule, regulation or guideline;
Original wording
On page 36, beginning on line 19, strike “concerns (in addition to any concerns described under subparagraph (A))” and insert “other concerns”.
Change 40: Strikes “specifically prohibited by law or is”
In S. 3414 · Placed on Calendar Senate
(A) disclosure of covered information; or
(B) any other disclosure of information that is specifically
[struck: prohibited by law or is specifically ]required by Executive order to be kept secret in the interest of national defense or the conduct of foreign affairs.(3) Handling of certain concerns.--A concern described in paragraph (1)(B)--
Original wording
On page 37, line 11, strike “specifically prohibited by law or is”.
Change 41: Inserts “or the disclosure of which is otherwise subject to legal restrictions” after “affairs”
In S. 3414 · Placed on Calendar Senate
(A) disclosure of covered information; or
(B) any other disclosure of information that is specifically prohibited by law or is specifically required by Executive order to be kept secret in the interest of national defense or the conduct of foreign affairs[inserted: or the disclosure of which is otherwise subject to legal restrictions].
(3) Handling of certain concerns.--A concern described in paragraph (1)(B)--
Original wording
On page 37, line 14, after “affairs” insert “or the disclosure of which is otherwise subject to legal restrictions”.
Change 42: Replaces “1 year” with “2 years”
[struck: 1 year][inserted: 2 years]Original wording
On page 41, line 4, strike “1 year” and insert “2 years”.
Change 43: Replaces “covered critical” with “critical cyber”
[struck: covered critical][inserted: critical cyber]Original wording
On page 42, line 16, strike “covered critical” and insert “critical cyber”.
Change 44: Inserts “in connection with affording the protections of section 214 of the Homeland Security Act…” after “and”
…and[inserted: in connection with affording the protections of section 214 of the Homeland Security Act of 2012 (6 U.S.C. 133) to covered information in accordance with]…
Original wording
On page 43, line 14, after “and” insert “in connection with affording the protections of section 214 of the Homeland Security Act of 2012 (6 U.S.C. 133) to covered information in accordance with”.
Change 45: Replaces “a private sector coordinating council” with “the entity”
In S. 3414 · Placed on Calendar Senate
(2) Cyber risk.--The term "cyber risk" means any risk to information infrastructure, including physical or personnel risks and security vulnerabilities, that, if exploited or not mitigated, could pose a significant risk of disruption to the operation of information infrastructure essential to the reliable operation of critical infrastructure.
(3) Sector coordinating council.--The term "sector coordinating council" means
[struck: a private sector coordinating council ][inserted: the entity ]comprised of representatives of owners and operators within a particular sector of critical infrastructure established by the National Infrastructure Protection Plan.(4) Sector-specific agency.--The term "sector-specific agency" means the relevant Federal agency responsible for infrastructure protection activities in a designated critical infrastructure sector or key resources category under the National Infrastructure Protection Plan, or any other appropriate Federal agency identified by the President after the date of enactment of this Act.
Original wording
On page 44, beginning on line 6, strike “a private sector coordinating council” and insert “the entity”.
Change 46: Replaces “sector of critical infrastructure” with “critical infrastructure or key resource sector”
[struck: sector of critical infrastructure][inserted: critical infrastructure or key resource sector]Original wording
On page 44, line 9, strike “sector of critical infrastructure” and insert “critical infrastructure or key resource sector”.
Change 47: Inserts “, or any successor plan” after “Plan”
…Plan[inserted: , or any successor plan]…
Original wording
On page 44, line 10, after “Plan” insert “, or any successor plan”.
Change 48: Replaces “under the National” through line 18 with “, as designated by the President or the President's designee.”
[struck: under the National …][inserted: , as designated by the President or the President's designee.]Original wording
On page 44, line 15, strike “under the National” and all that follows through line 18, and insert the following: “, as designated by the President or the President's designee.”.
Change 49: Replaces “improve and continuously monitor” with “continuously monitor and improve”
In S. 3414 · Placed on Calendar Senate
"(3) provide for development and maintenance of controls required to protect agency information and information systems and contribute to the overall improvement of agency information security posture; and
"(4) provide a mechanism to
[struck: improve and ]continuously monitor [inserted: and improve ]the security of agency information security programs and systems through a focus on continuous monitoring of agency information systems and streamlined reporting requirements rather than overly prescriptive manual reporting."Sec. 3552. Definitions
Original wording
On page 46, beginning on line 6, strike “improve and continuously monitor” and insert “continuously monitor and improve”.
Change 50: Strikes “the complete set of”
In S. 3414 · Placed on Calendar Senate
"(1) Adequate security.--The term 'adequate security' means security commensurate with the risk and impact resulting from the unauthorized access to or loss, misuse, destruction, or modification of information.
"(2) Continuous monitoring.--The term 'continuous monitoring' means the ongoing real time or near real-time process used to determine if
[struck: the complete set of ]planned, required, and deployed security controls within an information system continue to be effective over time in light of rapidly changing information technology and threat development. To the maximum extent possible, this also requires automation of that process to enable cost effective, efficient, and consistent monitoring and provide a more dynamic view of the security state of those deployed controls."(3) Countermeasure.--The term 'countermeasure' means automated or manual actions with defensive intent to modify or block data packets associated with electronic or wire communications, Internet traffic, program code, or other system traffic transiting to or from or stored on an information system for the purpose of protecting the information system from cybersecurity threats, conducted on an information system owned or operated by or on behalf of the party to be protected or operated by a private entity acting as a provider of electronic communication services, remote computing services, or cybersecurity services to the party to be protected.
Original wording
On page 46, beginning on line 25, strike “the complete set of”.
Change 51: Inserts “have been implemented and” after “system”
…system[inserted: have been implemented and]…
Original wording
On page 47, line 2, after “system” insert “have been implemented and”.
Change 52: Strikes “To the maximum” through line 9
Struck: To the maximum …
Original wording
On page 47, line 5, strike “To the maximum” and all that follows through line 9.
Change 53: Inserts “, or in accordance with section 3553(d)(3)” after “protected”
…protected[inserted: , or in accordance with section 3553(d)(3)]…
Original wording
On page 47, line 22, after “protected” insert “, or in accordance with section 3553(d)(3)”.
Change 54: Inserts new text on page 47, between lines 22 and 23
InsertsPrinted pageInserted: (4) Cybersecurity services.--The term "cybersecurity services
Original wording
On page 47, between lines 22 and 23, insert the following:
Change 55: Replaces “(4)” with “(5)”
[struck: (4)][inserted: (5)]Original wording
On page 47, line 23, strike “(4)” and insert “(5)”.
Change 56: Replaces “(5)” with “(6)”
[struck: (5)][inserted: (6)]Original wording
On page 48, line 8, strike “(5)” and insert “(6)”.
Change 57: Replaces “(6)” with “(7)”
[struck: (6)][inserted: (7)]Original wording
On page 49, line 1, strike “(6)” and insert “(7)”.
Change 58: Replaces “(7)” with “(8)”
[struck: (7)][inserted: (8)]Original wording
On page 49, line 4, strike “(7)” and insert “(8)”.
Change 59: Replaces “(8)” with “(9)”
[struck: (8)][inserted: (9)]Original wording
On page 50, line 13, strike “(8)” and insert “(9)”.
Change 60: Replaces “and penetration testing” with “, penetration testing, and the operation of a continuous monitoring capability to provide…”
[struck: and penetration testing][inserted: , penetration testing, and the operation of a continuous monitoring capability to provide real-time visibility into the condition and status of agency information systems]Original wording
On page 53, line 7, strike “and penetration testing” and insert “, penetration testing, and the operation of a continuous monitoring capability to provide real-time visibility into the condition and status of agency information systems”.
Change 61: Replaces “or information security services” with “services, remote computing services, or cybersecurity services”
In S. 3414 · Placed on Calendar Senate
"(E) the activities are implemented pursuant to policies and procedures governing the acquisition, interception, retention, use, and disclosure of communications and other system traffic that have been reviewed and approved by the Attorney General.
"(3) Private entities.--The Secretary may enter into contracts or other agreements, or otherwise request and obtain the assistance of, private entities that provide electronic communication
[struck: or information security][inserted: services, remote computing] services[struck: ][inserted: , or cybersecurity services ]to acquire, intercept, retain, use, and disclose communications and other system traffic or to deploy countermeasures in accordance with this subsection."(e) Directions to Agencies.--
Original wording
On page 57, beginning on line 21, strike “or information security services” and insert “services, remote computing services, or cybersecurity services”.
Change 62: Replaces “or to deploy countermeasures” with “, deploy countermeasures, or otherwise operate protective capabilities”
In S. 3414 · Placed on Calendar Senate
"(E) the activities are implemented pursuant to policies and procedures governing the acquisition, interception, retention, use, and disclosure of communications and other system traffic that have been reviewed and approved by the Attorney General.
"(3) Private entities.--The Secretary may enter into contracts or other agreements, or otherwise request and obtain the assistance of, private entities that provide electronic communication or information security services to acquire, intercept, retain, use, and disclose communications and other system traffic
[struck: ][inserted: , deploy countermeasures, ]or[struck: to deploy countermeasures ][inserted: otherwise operate protective capabilities ]in accordance with this subsection."(e) Directions to Agencies.--
Original wording
On page 57, line 24, strike “or to deploy countermeasures” and insert “, deploy countermeasures, or otherwise operate protective capabilities”.
Change 63: Replaces “Assistant Secretary” through line 19 with “Director of the National Center for Cybersecurity and Communications.”
[struck: Assistant Secretary …][inserted: Director of the National Center for Cybersecurity and Communications.]Original wording
On page 60, line 17, strike “Assistant Secretary” and all that follows through line 19, and insert the following: “Director of the National Center for Cybersecurity and Communications.”.
Change 64: Replaces “section 3553” with “section 3553(d)(3)”
[struck: section 3553][inserted: section 3553(d)(3)]Original wording
On page 76, line 5, strike “section 3553” and insert “section 3553(d)(3)”.
Change 65: Replaces “under the control of the Department of Defense” with “described in section 3553(g)(2)”
In S. 3414 · Placed on Calendar Senate
"(2) Specific agencies.--Periodic assessments conducted under subsection (a) shall be prepared in accordance with governmentwide reporting requirements by--
"(A) the Secretary of Defense for information systems
[struck: under the control of the Department of Defense][inserted: described in section 3553(g)(2)];"(B) the Director of the Central Intelligence Agency for information systems under the control of the Central Intelligence Agency; and
Original wording
On page 77, beginning on line 17, strike “under the control of the Department of Defense” and insert “described in section 3553(g)(2)”.
Change 66: Replaces “under the control of the Central Intelligence Agency” with “described in section 3553(g)(3)”
In S. 3414 · Placed on Calendar Senate
"(A) the Secretary of Defense for information systems under the control of the Department of Defense;
"(B) the Director of the Central Intelligence Agency for information systems
[struck: under the control of the Central Intelligence Agency][inserted: described in section 3553(g)(3)]; and"(C) the Director of National Intelligence for information systems under the control of the Office of the Director of National Intelligence.
Original wording
On page 77, beginning on line 20, strike “under the control of the Central Intelligence Agency” and insert “described in section 3553(g)(3)”.
Change 67: Replaces “under the control of the Office of the Director of National Intelligence” with “described in section 3553(g)(4)”
In S. 3414 · Placed on Calendar Senate
"(B) the Director of the Central Intelligence Agency for information systems under the control of the Central Intelligence Agency; and
"(C) the Director of National Intelligence for information systems
[struck: under the control of the Office of the Director of National Intelligence][inserted: described in section 3553(g)(4)]."(d) Agency-specific Assessments.--Each assessment conducted under subsection (a) that relates, in whole or in part, to the information systems of an agency shall be made available to the head of the agency.
Original wording
On page 77, beginning on line 24, strike “under the control of the Office of the Director of National Intelligence” and insert “described in section 3553(g)(4)”.
Change 68: Inserts “functions of the” before “National”
…[inserted: functions of the ]National…
Original wording
On page 90, line 16, before “National” insert “functions of the”.
Change 69: Replaces “on the date of enactment of the Cybersecurity Act of 2012” with “transferred to the Department”
In S. 3414 · Placed on Calendar Senate
"(11) Intelligence community.--The term 'intelligence community' has the meaning given that term in section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4)).
"(12) National security and emergency preparedness communications infrastructure.--The term 'national security and emergency preparedness communications infrastructure' means the systems supported or covered by the Office of Emergency Communications and the National Communications System
[struck: on the date of enactment of ][inserted: transferred to ]the[struck: Cybersecurity Act of 2012 ][inserted: Department ]or otherwise described in Executive Order 12472, or any successor thereto, relating to national security and emergency preparedness communications functions."(13) National information infrastructure.--The term 'national information infrastructure' means information and information systems--
Original wording
On page 90, beginning on line 17, strike “on the date of enactment of the Cybersecurity Act of 2012” and insert “transferred to the Department”.
Change 70: Replaces “Order 12472” with “Order 13618”
In S. 3414 · Placed on Calendar Senate
"(11) Intelligence community.--The term 'intelligence community' has the meaning given that term in section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4)).
"(12) National security and emergency preparedness communications infrastructure.--The term 'national security and emergency preparedness communications infrastructure' means the systems supported or covered by the Office of Emergency Communications and the National Communications System on the date of enactment of the Cybersecurity Act of 2012 or otherwise described in Executive Order
[struck: 12472][inserted: 13618], or any successor thereto, relating to national security and emergency preparedness communications functions."(13) National information infrastructure.--The term 'national information infrastructure' means information and information systems--
Original wording
On page 90, line 19, strike “Order 12472” and insert “Order 13618”.
Change 71: Replaces “National Communications System” with “functions of the National Communications System transferred to the Department under secti…”
[struck: National Communications System][inserted: functions of the National Communications System transferred to the Department under section 201(g)]Original wording
On page 91, beginning on line 19, strike “National Communications System” and insert “functions of the National Communications System transferred to the Department under section 201(g)”.
Change 72: Replaces “the” with “their”
[struck: the][inserted: their]Original wording
On page 91, line 20, strike “the” and insert “their”.
Change 73: Replaces “liabilities of the” through line 24 with “liabilities.”
[struck: liabilities of the …][inserted: liabilities.]Original wording
On page 91, line 21, strike “liabilities of the” and all that follows through line 24, and insert “liabilities.”.
Change 74: Inserts “technical assistance, analysis of incidents, and other” after “providing”
…providing[inserted: technical assistance, analysis of incidents, and other]…
Original wording
On page 93, line 20, after “providing” insert “technical assistance, analysis of incidents, and other”.
Change 75: Inserts “appropriate and” after “as”
…as[inserted: appropriate and]…
Original wording
On page 102, line 5, after “as” insert “appropriate and”.
Change 76: Replaces “authorized” with “permitted”
[struck: authorized][inserted: permitted]Original wording
On page 105, line 23, strike “authorized” and insert “permitted”.
Change 77: Replaces “Code, or” with “Code,”
[struck: Code, or][inserted: Code,]Original wording
On page 105, line 24, strike “Code, or” and insert “Code,”.
Change 78: Inserts “, or section 3553 of title 44, United States Code” after “et seq.)”
…et seq.)[inserted: , or section 3553 of title 44, United States Code]…
Original wording
On page 106, line 2, after “et seq.)” insert “, or section 3553 of title 44, United States Code”.
Change 79: Inserts “, and in consultation with the Director of the National Institute of Standards and Techno…” after “Communications”
…Communications[inserted: , and in consultation with the Director of the National Institute of Standards and Technology and the Administrator of the National Telecommunications and Information Administration]…
Original wording
On page 113, line 19, after “Communications” insert “, and in consultation with the Director of the National Institute of Standards and Technology and the Administrator of the National Telecommunications and Information Administration”.
Change 80: Inserts “and the Committee on Homeland Security and Governmental Affairs” before “of”
…[inserted: and the Committee on Homeland Security and Governmental Affairs ]of…
Original wording
On page 120, line 15, before “of” insert “and the Committee on Homeland Security and Governmental Affairs”.
Change 81: Inserts “and the Committee on Oversight and Government Reform” after “Technology”
…Technology[inserted: and the Committee on Oversight and Government Reform]…
Original wording
On page 120, line 16, after “Technology” insert “and the Committee on Oversight and Government Reform”.
Change 82: Inserts “cybersecurity” after “other”
…other[inserted: cybersecurity]…
Original wording
On page 125, line 15, after “other” insert “cybersecurity”.
Change 83: Inserts “and the Director of the Office of Personnel Management” after “Secretary”
…Secretary[inserted: and the Director of the Office of Personnel Management]…
Original wording
On page 128, line 18, after “Secretary” insert “and the Director of the Office of Personnel Management”.
Change 84: Replaces “shall” with “may”
[struck: shall][inserted: may]Original wording
On page 130, line 12, strike “shall” and insert “may”.
Change 85: Inserts “, in coordination with the Director of the Office of Personnel Management,” after “Foundation”
…Foundation[inserted: , in coordination with the Director of the Office of Personnel Management,]…
Original wording
On page 131, line 16, after “Foundation” insert “, in coordination with the Director of the Office of Personnel Management,”.
Change 86: Replaces “all” with “appropriate”
[struck: all][inserted: appropriate]Original wording
On page 134, line 6, strike “all” and insert “appropriate”.
Change 87: Replaces “engaged in” with “in vacant positions that are part of the Federal”
[struck: engaged in][inserted: in vacant positions that are part of the Federal]Original wording
On page 136, line 17, strike “engaged in” and insert “in vacant positions that are part of the Federal”.
Change 88: Rewrites page 152, line 20 through page 153, line 14
ReplacesPrinted pageRemoves page 152, line 20 through page 153, line 14 of the printed bill. See that page
Inserted: (1) legal or other impediments to appropriate public awareness of the nature of, methods of propagation of, and damage caused by common cybersecurity threats such as computer viruses, phishing techniques, and malware; and
Inserted: (2) a summary of the plans of the Secretary to enhance public awareness of common cybersecurity threats, including a description of the metrics used by the Department for evaluating the efficacy of public awareness campaigns.
Original wording
On page 152, strike line 20 and all that follows through page 153, line 14, and insert the following:
Change 89: Strikes “or”
Struck: or
Original wording
On page 201, line 19, strike “or”.
Change 90: Inserts new text on page 201, between lines 19 and 20
InsertsPrinted pageInserted: (11) to alter or amend the law enforcement or intelligence authorities of any agency or Federal cybersecurity center; or
Original wording
On page 201, between lines 19 and 20, insert the following:
Change 91: Replaces “(11)” with “(12)”
[struck: (11)][inserted: (12)]Original wording
On page 201, line 20, strike “(11)” and insert “(12)”.
Shown as written
On page 81, strike the matter between lines 15 and 16 and insert the following:
On page 147, strike the matter between lines 3 and 4 and insert the following:
Read automatically from the Congressional Record. Check the original before relying on it.
As printed
SA 2751. Mr. LIEBERMAN submitted an amendment intended to be proposed by him to the bill S. 3414, to enhance the security and resiliency of the cyber and communications infrastructure of the United States; which was ordered to lie on the table; as follows:
On page 6, beginning on line 2, strike “the underlying framework that information systems and assets rely on” and insert “information and information systems relied upon”.
On page 7, strike line 20 and all that follows through page 8, line 9, and insert the following:
(21) Operator.--The term “operator”--
(A) means an entity that manages, runs, or operates, in whole or in part, the day-to-day operations of critical infrastructure; and
(B) may include the owner of critical infrastructure.
(22) Owner.--The term “owner”--
(A) means an entity that owns critical infrastructure; and
(B) does not include a company contracted by the owner to manage, run, or operate that critical infrastructure, or to provide a specific information technology product or service that is used or incorporated into that critical infrastructure.
On page 8, beginning on line 14, strike “, or an attempted to cause an incident that, if successful, would have resulted in”.
On page 8, after line 22, insert the following:
SEC. 3. RULE OF CONSTRUCTION.
(a) Definition.--In this section, the term “covered information” means information collected by a Federal agency solely for statistical purposes under a pledge of confidentiality.
(b) Rule of Construction Relating to Covered Information.--Nothing in this Act or an amendment made by this Act shall be construed to alter, amend, or repeal any provision of title 13, United States Code, the International Investment and Trade in Services Survey Act (22 U.S.C. 3101 et seq.), or the Confidential Information Protection and Statistical Efficiency Act of 2002 (44 U.S.C. 3501 note), or any similar provision of law, that relates to the unauthorized disclosure or use of covered information, except that the head of each Federal agency that collects covered information pursuant to any such provision of law is authorized to disclose the covered information to the Secretary to fulfill the information security responsibilities of the head of the Federal agency and the Secretary under sections 3553 and 3554 of title 44, United States Code, as amended by this Act.
On page 10, line 7, before “; and” insert “, in connection with activities authorized and conducted in accordance with this title”.
On page 10, beginning on line 9, strike “technical guidance or assistance to owners and operators consistent with this title” and insert “guidance on the application of cybersecurity practices in accordance with this title”.
On page 10, line 18, insert “and” after the semicolon.
On page 11, strike lines 1 through 13 and insert the following:
(d) Membership.--The Council shall be comprised of--
(1) the Secretary of Commerce;
(2) the Secretary of Defense;
(3) the Attorney General;
(4) the Director of National Intelligence;
(5) the heads of sector-specific Federal agencies that are appointed by the President, by and with the advice and consent of the Senate, as determined by the President in accordance with subsection (g);
(6) the heads of Federal agencies with responsibility for regulating the security of critical cyber infrastructure that are appointed by the President, by and with the advice and consent of the Senate, as determined by the President in accordance with subsection (g); and
(7) the Secretary.
On page 12, line 3, after “provide” insert “, to the maximum extent possible,”.
On page 12, line 5, after “provide” insert “, to the maximum extent possible,”.
On page 12, line 8, strike “A” and insert “The head of a”.
On page 12, line 9, strike “and a” and insert “or a”.
On page 12, line 13, after “responsibility” insert “, including”.
On page 13, line 13, after “with” insert “appropriate”.
On page 13, line 20, strike “180 days” and insert “90 days”.
On page 15, between lines 9 and 10, insert the following:
(6) Initial assessments.--Not later than 270 days after the date of enactment of this Act, the member agency designated under paragraph (1) shall complete initial cyber risk assessments described in paragraph (2)(B).
On page 17, line 16, strike “damage” and insert “harm”.
On page 18, line 2, strike “damage” and insert “harm”.
On page 20, line 5, strike “180 days” and insert “1 year”.
On page 20, line 12, strike “, standards,”.
On page 20, line 22, after “with” insert “appropriate”.
On page 21, beginning on line 3, strike “relevant security experts and” and insert “appropriate security experts,”.
On page 21, between lines 17 and 18, insert the following:
(2) NIST involvement.--As part of the process described in paragraph (1), the Director of the National Institute of Standards and Technology shall be invited to provide advice and guidance on any possible amendments to the cybersecurity practices and any additional cybersecurity practices in consultation with appropriate public and private stakeholders.
On page 21, line 18, strike “(2)” and insert “(3)”.
On page 21, line 19, strike “1 year” and insert “18 months”.
On page 22, beginning on line 11, strike “180 days” and insert “1 year”.
On page 22, line 13, strike “1 year” and insert “18 months”.
On page 25, strike lines 10 through 17 and insert the following:
(1) In general.--After the Council adopts a cybersecurity practice, a relevant sector coordinating council and the Critical Infrastructure Partnership Advisory Council may issue a public report evaluating the cybersecurity practice, which may include input from appropriate institutions of higher education, including university information security centers, national laboratories, and appropriate nongovernmental cybersecurity experts.
On page 25, line 19, strike “consider any review conducted” and insert “consider, in accordance with subsection (c), any public report issued”.
On page 25, strike lines 21 through 24 and insert the following:
(i) Voluntary Guidance.--At the request of an owner or operator, the Council may provide guidance on the application of cybersecurity practices to the critical infrastructure in accordance with this title.
On page 26, line 5, strike “1 year” and insert “18 months”.
On page 27, line 13, strike “an assessment” and insert “a third-party assessment, in accordance with subsection (b),”.
On page 28, beginning on line 15, strike “specific cybersecurity measures that, if implemented, would” and insert “guidance on how to”.
On page 29, line 5, strike “owner” and all that follows through line 7, and insert the following: “owner has effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103.”.
On page 30, line 20, strike “Subaragraph” and insert “Subparagraph”.
On page 34, line 15, before “or” insert “including under title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et seq.),”.
On page 35, beginning on line 19, strike “treated as voluntarily shared critical infrastructure information under” and insert “afforded the protections of”.
On page 36, beginning on line 16, strike “covered critical” and insert “critical cyber”.
On page 36, beginning on line 19, strike “concerns (in addition to any concerns described under subparagraph (A))” and insert “other concerns”.
On page 37, line 11, strike “specifically prohibited by law or is”.
On page 37, line 14, after “affairs” insert “or the disclosure of which is otherwise subject to legal restrictions”.
On page 41, line 4, strike “1 year” and insert “2 years”.
On page 42, line 16, strike “covered critical” and insert “critical cyber”.
On page 43, line 14, after “and” insert “in connection with affording the protections of section 214 of the Homeland Security Act of 2012 (6 U.S.C. 133) to covered information in accordance with”.
On page 44, beginning on line 6, strike “a private sector coordinating council” and insert “the entity”.
On page 44, line 9, strike “sector of critical infrastructure” and insert “critical infrastructure or key resource sector”.
On page 44, line 10, after “Plan” insert “, or any successor plan”.
On page 44, line 15, strike “under the National” and all that follows through line 18, and insert the following: “, as designated by the President or the President's designee.”.
On page 46, beginning on line 6, strike “improve and continuously monitor” and insert “continuously monitor and improve”.
On page 46, beginning on line 25, strike “the complete set of”.
On page 47, line 2, after “system” insert “have been implemented and”.
On page 47, line 5, strike “To the maximum” and all that follows through line 9.
On page 47, line 22, after “protected” insert “, or in accordance with section 3553(d)(3)”.
On page 47, between lines 22 and 23, insert the following:
“(4) Cybersecurity services.--The term “cybersecurity services” means products, goods, or services intended to detect, mitigate, or prevent cybersecurity threats.
On page 47, line 23, strike “(4)” and insert “(5)”.
On page 48, line 8, strike “(5)” and insert “(6)”.
On page 49, line 1, strike “(6)” and insert “(7)”.
On page 49, line 4, strike “(7)” and insert “(8)”.
On page 50, line 13, strike “(8)” and insert “(9)”.
On page 53, line 7, strike “and penetration testing” and insert “, penetration testing, and the operation of a continuous monitoring capability to provide real-time visibility into the condition and status of agency information systems”.
On page 57, beginning on line 21, strike “or information security services” and insert “services, remote computing services, or cybersecurity services”.
On page 57, line 24, strike “or to deploy countermeasures” and insert “, deploy countermeasures, or otherwise operate protective capabilities”.
On page 60, line 17, strike “Assistant Secretary” and all that follows through line 19, and insert the following: “Director of the National Center for Cybersecurity and Communications.”.
On page 76, line 5, strike “section 3553” and insert “section 3553(d)(3)”.
On page 77, beginning on line 17, strike “under the control of the Department of Defense” and insert “described in section 3553(g)(2)”.
On page 77, beginning on line 20, strike “under the control of the Central Intelligence Agency” and insert “described in section 3553(g)(3)”.
On page 77, beginning on line 24, strike “under the control of the Office of the Director of National Intelligence” and insert “described in section 3553(g)(4)”.
On page 81, strike the matter between lines 15 and 16 and insert the following:
“subchapter ii--information security
“3551. Purposes.
“3552. Definitions.
“3553. Federal information security authority and coordination.
“3554. Agency responsibilities.
“3555. Annual assessments.
“3556. Independent evaluations.
“3557. National security systems.
“3558. Effect on existing law.”.
On page 90, line 16, before “National” insert “functions of the”.
On page 90, beginning on line 17, strike “on the date of enactment of the Cybersecurity Act of 2012” and insert “transferred to the Department”.
On page 90, line 19, strike “Order 12472” and insert “Order 13618”.
On page 91, beginning on line 19, strike “National Communications System” and insert “functions of the National Communications System transferred to the Department under section 201(g)”.
On page 91, line 20, strike “the” and insert “their”.
On page 91, line 21, strike “liabilities of the” and all that follows through line 24, and insert “liabilities.”.
On page 93, line 20, after “providing” insert “technical assistance, analysis of incidents, and other”.
On page 102, line 5, after “as” insert “appropriate and”.
On page 105, line 23, strike “authorized” and insert “permitted”.
On page 105, line 24, strike “Code, or” and insert “Code,”.
On page 106, line 2, after “et seq.)” insert “, or section 3553 of title 44, United States Code”.
On page 113, line 19, after “Communications” insert “, and in consultation with the Director of the National Institute of Standards and Technology and the Administrator of the National Telecommunications and Information Administration”.
On page 120, line 15, before “of” insert “and the Committee on Homeland Security and Governmental Affairs”.
On page 120, line 16, after “Technology” insert “and the Committee on Oversight and Government Reform”.
On page 125, line 15, after “other” insert “cybersecurity”.
On page 128, line 18, after “Secretary” insert “and the Director of the Office of Personnel Management”.
On page 130, line 12, strike “shall” and insert “may”.
On page 131, line 16, after “Foundation” insert “, in coordination with the Director of the Office of Personnel Management,”.
On page 134, line 6, strike “all” and insert “appropriate”.
On page 136, line 17, strike “engaged in” and insert “in vacant positions that are part of the Federal”.
On page 147, strike the matter between lines 3 and 4 and insert the following:
“Sec. 245. National Center for Cybersecurity and Communications acquisition authorities.
“Sec. 246. Recruitment and retention program for the National Center for Cybersecurity and Communications.”.
On page 152, strike line 20 and all that follows through page 153, line 14, and insert the following:
(1) legal or other impediments to appropriate public awareness of the nature of, methods of propagation of, and damage caused by common cybersecurity threats such as computer viruses, phishing techniques, and malware; and
(2) a summary of the plans of the Secretary to enhance public awareness of common cybersecurity threats, including a description of the metrics used by the Department for evaluating the efficacy of public awareness campaigns.
On page 201, line 19, strike “or”.
On page 201, between lines 19 and 20, insert the following:
(11) to alter or amend the law enforcement or intelligence authorities of any agency or Federal cybersecurity center; or
On page 201, line 20, strike “(11)” and insert “(12)”.
Legislative Activity
Stay on top of the latest movement without scrolling through every action
Senate amendment submitted
August 1, 2012