Sec. 2. Sharing of cyber threat indicators and defensive measures by the Federal Government with non-Federal entities
591 words·~3 min read·
/bill/114/hr/1560/rh/section-2A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Title I of the National Security Act of 1947 ( 50 U.S.C. 3021 et seq. ) is amended by inserting after section 110 ( 50 U.S.C. 3045 ) the following new section: Consistent with the protection of classified information, intelligence sources and methods, and privacy and civil liberties, the Director of National Intelligence, in consultation with the heads of the other appropriate Federal entities, shall develop and promulgate procedures to facilitate and promote— the timely sharing of classified cyber threat indicators in the possession of the Federal Government with representatives of relevant non-Federal entities with appropriate security clearances; the timely sharing with relevant non-Federal entities of cyber threat indicators in the possession of the Federal Government that may be declassified and shared at an unclassified level; and the sharing with non-Federal entities, if appropriate, of information in the possession of the Federal Government about imminent or ongoing cybersecurity threats to such entities to prevent or mitigate adverse impacts from such cybersecurity threats.
The procedures developed and promulgated under paragraph
(1)shall— ensure the Federal Government has and maintains the capability to share cyber threat indicators in real time consistent with the protection of classified information; incorporate, to the greatest extent practicable, existing processes and existing roles and responsibilities of Federal and non-Federal entities for information sharing by the Federal Government, including sector-specific information sharing and analysis centers; include procedures for notifying non-Federal entities that have received a cyber threat indicator from a Federal entity in accordance with this Act that is known or determined to be in error or in contravention of the requirements of this section, the Protecting Cyber Networks Act , or the amendments made by such Act or another provision of Federal law or policy of such error or contravention; include requirements for Federal entities receiving a cyber threat indicator or defensive measure to implement appropriate security controls to protect against unauthorized access to, or acquisition of, such cyber threat indicator or defensive measure; include procedures that require Federal entities, prior to the sharing of a cyber threat indicator, to— review such cyber threat indicator to assess whether such cyber threat indicator, in contravention of the requirement under section 3(d)(2) of the Protecting Cyber Networks Act , contains any information that such Federal entity knows at the time of sharing to be personal information of or information identifying a specific person not directly related to a cybersecurity threat and remove such information; or implement a technical capability configured to remove or exclude any personal information of or information identifying a specific person not directly related to a cybersecurity threat; and include procedures to promote the efficient granting of security clearances to appropriate representatives of non-Federal entities. In this section, the terms appropriate Federal entities , cyber threat indicator , defensive measure , Federal entity , and non-Federal entity have the meaning given such terms in section 11 of the Protecting Cyber Networks Act . . Not later than 90 days after the date of the enactment of this Act, the Director of National Intelligence, in consultation with the heads of the other appropriate Federal entities, shall submit to Congress the procedures required by section 111(a) of the National Security Act of 1947, as inserted by subsection
(a)of this section. The table of contents in the first section of the National Security Act of 1947 is amended by inserting after the item relating to section 110 the following new item: Sec. 111. Sharing of cyber threat indicators and defensive measures by the Federal Government with non-Federal entities. .
Connectionstraces to 2
Traces to 2 documents
Citation graph
cites case law
Sec. 2
Sharing of cyber threat indicators and defensive measures by the Federal Government with non-Federal entities
Cites 2Cited by 0 across 0 sources