Sec. 1645. Reporting on penetrations into networks and information systems of operationally critical contractors
554 words·~3 min read·
/bill/113/s/2410/pcs/section-1645A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Secretary of Defense shall establish procedures that require an operationally critical contractor to report to the component of the Department of Defense designated by the Secretary pursuant to subsection (d)(2)(A) when a network or information system of such operationally critical contractor is successfully penetrated by a known or suspected advanced persistent threat actor. For purposes of this section, advanced persistent threats shall consist of such threats as the Secretary shall specify for the procedures established under this subsection. The procedures established pursuant to subsection
(a)shall include a process for— designating operationally critical contractors; and notifying a contractor that it has been designated as an operationally critical contractor. The procedures established pursuant to subsection
(a)shall require each operationally critical contractor to rapidly report to the component of the Department designated pursuant to subsection (d)(2)(A) on each successful penetration of any network or information systems of such contractor. Each such report shall include the following: The technique or method used in such penetration. A sample of any malicious software, if discovered and isolated by the contractor, involved in such penetration. The procedures established pursuant to subsection
(a)shall include mechanisms for Department personnel to— if requested, assist operationally critical contractors in detecting and mitigating penetrations; and upon request, obtain access to equipment or information of an operationally critical contractor necessary to conduct forensic analysis in addition to any analysis conducted by such contractor. The procedures established pursuant to subsection
(a)shall provide for the reasonable protection of trade secrets, commercial or financial information, and information that can be used to identify a specific person. The procedures established pursuant to subsection
(a)shall permit the dissemination of information obtained or derived through the procedures to agencies that conduct counterintelligence investigations for their use in such investigations. The Secretary shall establish the procedures required by subsection
(a)by not later than 90 days after the date of the enactment of this Act. The procedures shall take effect on the date of establishment. Not later than 90 days after the date of the enactment of the Act, the Secretary shall complete an assessment of— requirements that were in effect on the day before the date of the enactment of this Act for contractors to share information with Department components regarding successful penetrations into networks or information systems of contractors; and Department policies and systems for sharing information on successful penetrations into networks or information systems of Department contractors. Upon completion of the assessment required by paragraph (1), the Secretary shall— designate a single Department component to receive reports from Department contractors or other governmental agencies on successful penetrations into Department contractor networks or information systems; and issue or revise guidance applicable to Department components that ensures the rapid sharing by the component designated pursuant to subparagraph
(A)of information relating to successful penetrations into networks or information systems of contractors with other appropriate Department components. In this section: The term contingency operation has the meaning given that term in section 101(a)(13) of title 10, United States Code. The term operationally critical contractor means a contractor designated by the Secretary for purposes of this section as a critical source of supply for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.