Sec. 103. Actions to enhance Federal incident response
631 words·~3 min read·
/bill/117/hr/6497/ih/section-103A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 180 days after the date of the enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall— develop a plan for the development of the analysis required under section 3597(a) of title 44, United States Code, as added by this Act, and the report required under subsection
(b)of that section that includes— a description of any challenges the Director anticipates encountering; and the use of automation and machine-readable formats for collecting, compiling, monitoring, and analyzing data; and provide to the appropriate congressional committees a briefing on the plan developed under subparagraph (A). Not later than 1 year after the date of the enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall provide to the appropriate congressional committees a briefing on— the execution of the plan required under paragraph (1)(A); and the development of the report required under section 3597(b) of title 44, United States Code, as added by this Act. Section 2 of the Federal Information Security Modernization Act of 2014 ( Public Law 113–283 ; 44 U.S.C. 3554 note) is amended— by striking subsection (b); and by redesignating subsections
(c)through
(f)as subsections
(b)through (e), respectively. The Director shall develop guidance, to be updated not less frequently than once every 2 years, on the content, timeliness, and format of the information provided by agencies under section 3594(a) of title 44, United States Code, as added by this Act. Not later than 1 year after the date of the enactment of this Act, the Director shall develop guidance for agencies to implement the requirement under section 3594(c) of title 44, United States Code, as added by this Act, to provide information to other agencies experiencing incidents. Not later than 1 year after the date of the enactment of this Act, the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, shall develop guidance and templates, to be reviewed and, if necessary, updated not less frequently than once every 2 years, for use by Federal agencies in the activities required under sections 3592, 3593, and 3596 of title 44, United States Code, as added by this Act. Not later than 1 year after the date of the enactment of this Act, the Director, in coordination with the Secretary of Homeland Security, the Secretary of Defense, the Administrator of General Services, and the heads of other agencies determined appropriate by the Director, shall issue guidance to Federal agencies on how to deconflict, to the greatest extent practicable, existing regulations, policies, and procedures relating to the responsibilities of contractors and awardees established under section 3595 of title 44, United States Code, as added by this Act. To the greatest extent practicable, the guidance issued under subparagraph
(A)shall allow contractors and awardees to use existing processes for notifying Federal agencies of incidents involving information of the Federal Government. Not less frequently than once every 2 years, the Director shall provide to the appropriate congressional committees an update on the guidance and templates developed under paragraphs
(2)through (4). Section 552a(b) of title 5, United States Code (commonly known as the Privacy Act of 1974 ) is amended— in paragraph (11), by striking or at the end; in paragraph (12), by striking the period at the end and inserting ; or ; and by adding at the end the following: to another agency in furtherance of a response to an incident (as defined in section 3552 of title 44) and pursuant to the information sharing requirements in section 3594 of title 44, if the head of the requesting agency has made a written request to the agency that maintains the record specifying the particular portion desired and the activity for which the record is sought. .
Connectionstraces to 2
Traces to 2 documents
Citation graph
cites case law
Cites 2Cited by 0 across 0 sources