Sec. 5. Ransomware vulnerability warning pilot program
309 words·~1 min read·
/bill/117/s/2875/is/section-5·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not less than 90 days after the date of enactment of this Act, the Director shall establish a ransomware vulnerability warning program to leverage existing authorities and technology to specifically develop processes and procedures, and to dedicate resources, to identifying information systems that contain security vulnerabilities associated with common ransomware attacks, and to notify the owners of those vulnerable systems of their security vulnerability. The pilot program established under subsection
(a)shall— identify the most common security vulnerabilities utilized in ransomware attacks and mitigation techniques; and utilize existing authorities to identify Federal and other relevant information systems that contain the security vulnerabilities identified in paragraph (1). If the Director is able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection (b), the Director may notify the owner of the information system. If the Director is not able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection (b), the Director may utilize the subpoena authority pursuant to section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ) to identify and notify the entity at risk pursuant to the procedures within that section. A notification made under paragraph
(1)shall include information on the identified security vulnerability and mitigation techniques. To the extent practical, the Director shall prioritize covered entities for identification and notification activities under the pilot program established under this section. No procedure, notification, or other authorities utilized in the execution of the pilot program established under subsection
(a)shall require an owner or operator of a vulnerable information system to take any action as a result of a notice of a security vulnerability made pursuant to subsection (c). Nothing in this section shall be construed to provide additional authorities to the Director to identify vulnerabilities or vulnerable systems.
Connectionstraces to 1
Traces to 1 document
Citation graph
cites case law
Sec. 5
Ransomware vulnerability warning pilot program
Cites 1Cited by 0 across 0 sources