Sec. 204. Data and logging retention for incident response
279 words·~1 min read·
/bill/117/s/2902/is/section-204A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 60 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Attorney General and the National Cyber Director, shall submit to the Director recommendations on requirements for logging events on agency systems and retaining other relevant data within the systems and networks of an agency. The recommendations provided under subsection
(a)shall include— the types of logs to be maintained; the time periods to retain the logs and other relevant data; the time periods for agencies to enable recommended logging and security requirements; how to ensure the confidentiality, integrity, and availability of logs; requirements to ensure that, upon request, agencies provide logs to— the Director of the Cybersecurity and Infrastructure Security Agency for a cybersecurity purpose; and the Federal Bureau of Investigation to investigate potential criminal activity; and ensuring the highest level security operations center of each agency has visibility into all agency logs. Not later than 90 days after receiving the recommendations submitted under subsection (a), the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Attorney General, shall promulgate guidance to agencies to establish requirements for logging, log retention, log management, and sharing of log data with other appropriate agencies. Not later than 2 years after the date on which the Director of the Cybersecurity and Infrastructure Security Agency submits the recommendations required under subsection (a), and not less frequently than every 2 years thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Attorney General, shall evaluate the recommendations and provide an update on the recommendations to the Director as necessary.