Sec. 109. Data and logging retention for incident response
310 words·~1 min read·
/bill/117/s/3600/es/section-109·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 2 years after the date of enactment of this Act, and not less frequently than every 2 years thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Attorney General, shall submit to the Director recommendations on requirements for logging events on agency systems and retaining other relevant data within the systems and networks of an agency. The recommendations provided under subsection
(a)shall include— the types of logs to be maintained; the duration that logs and other relevant data should be retained; the time periods for agency implementation of recommended logging and security requirements; how to ensure the confidentiality, integrity, and availability of logs; requirements to ensure that, upon request, in a manner that excludes or otherwise reasonably protects personally identifiable information, and to the extent permitted by applicable law (including privacy and statistical laws), agencies provide logs to— the Director of the Cybersecurity and Infrastructure Security Agency for a cybersecurity purpose; and the Director of the Federal Bureau of Investigation, or the appropriate Federal law enforcement agency, to investigate potential criminal activity; and requirements to ensure that, subject to compliance with statistical laws and other relevant data protection requirements, the highest level security operations center of each agency has visibility into all agency logs. Not later than 90 days after receiving the recommendations submitted under subsection (a), the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Attorney General, shall, as determined to be appropriate by the Director, update guidance to agencies regarding requirements for logging, log retention, log management, sharing of log data with other appropriate agencies, or any other logging activity determined to be appropriate by the Director. This section shall cease to have force or effect on the date that is 10 years after the date of the enactment of this Act.