Sec. 205. Ransomware vulnerability warning pilot program
331 words·~2 min read·
/bill/117/s/3600/es/section-205·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 1 year after the date of enactment of this Act, the Director shall establish a ransomware vulnerability warning pilot program to leverage existing authorities and technology to specifically develop processes and procedures for, and to dedicate resources to, identifying information systems that contain security vulnerabilities associated with common ransomware attacks, and to notify the owners of those vulnerable systems of their security vulnerability. The pilot program established under subsection
(a)shall— identify the most common security vulnerabilities utilized in ransomware attacks and mitigation techniques; and utilize existing authorities to identify information systems that contain the security vulnerabilities identified in paragraph (1). If the Director is able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection (b), the Director may notify the owner of the information system. If the Director is not able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection (b), the Director may utilize the subpoena authority pursuant to section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ) to identify and notify the entity at risk pursuant to the procedures under that section. A notification made under paragraph
(1)shall include information on the identified security vulnerability and mitigation techniques. To the extent practicable, the Director shall prioritize covered entities for identification and notification activities under the pilot program established under this section. No procedure, notification, or other authorities utilized in the execution of the pilot program established under subsection
(a)shall require an owner or operator of a vulnerable information system to take any action as a result of a notice of a security vulnerability made pursuant to subsection (c). Nothing in this section shall be construed to provide additional authorities to the Director to identify vulnerabilities or vulnerable systems. The pilot program established under subsection
(a)shall terminate on the date that is 4 years after the date of enactment of this Act.
Connectionstraces to 1
Traces to 1 document
Citation graph
cites case law
Sec. 205
Ransomware vulnerability warning pilot program
Cites 1Cited by 0 across 0 sources