To require reports to the Department of Defense on penetrations of networks and information systems of certain contractors.

SA 3280. Mr. LEVIN submitted an amendment intended to be proposed by him to the bill S. 3254, to authorize appropriations for fiscal year 2013 for military activities of the Department of Defense, for military construction, and for defense activities of the Department of Energy, to prescribe military personnel strengths for such fiscal year, and for other purposes; which was ordered to lie on the table; as follows:

At the end of subtitle C title IX, add the following:

SEC. 935. REPORTS TO DEPARTMENT OF DEFENSE ON PENETRATIONS OF NETWORKS AND INFORMATION SYSTEMS OF CERTAIN CONTRACTORS.

(a) Process for Reporting Penetrations.--The Under Secretary of Defense for Intelligence shall, in coordination with the officials specified in subsection (c), establish a process by which cleared defense contractors shall report to elements of the Department of Defense designated by the Under Secretary for purposes of the process when a network or information system of such contractors designated pursuant to subsection (b) is successfully penetrated.

(b) Designation of Networks and Information Systems.--The Under Secretary of Defense for Intelligence shall, in coordination with the officials specified in subsection (c), establish criteria for designating the cleared defense contractors' networks or information systems that contain or process information created by or for the Department of Defense to be subject to the reporting process established pursuant to subsection (a).

(c) Officials.--The officials specified in this subsection are the following:

(1) The Under Secretary of Defense for Policy.

(2) The Under Secretary of Defense for Acquisition, Technology, and Logistics.

(3) The Chief Information Officer of the Department of Defense.

(4) The Commander of the United States Cyber Command.

(d) Process Requirements.--

(1) Rapid reporting.--The process required by subsection (a) shall provide for rapid reporting by contractors of successful penetrations of designated network or information systems.

(2) Report elements.--The report by a contractor on a successful penetration of a designated network or information system under the process shall include the following:

(A) A description of the technique or method used in the penetration.

(B) A sample of the malicious software, if discovered and isolated by the contractor.

(3) Access.--The process shall include mechanisms by which Department of Defense personnel may, upon request, obtain access to equipment or information of a contractor necessary to conduct a forensic analysis to determine whether information created by or for the Department in connection with any Department program was successfully exfiltrated from a network or information system of the contractor and, if so, what information was exfiltrated.

(4) Limitation on dissemination of certain information.--The process shall prohibit the dissemination outside the Department of Defense of information obtained or derived through the process that is not created by or for the Department except with the approval of the contractor providing such information.

(e) Cleared Defense Contractor Defined.--In this section, the term “cleared defense contractor” means a private entity granted clearance by the Defense Security Service to receive and store classified information for the purpose of bidding for a contract or conducting activities under a contract with the Department of Defense.