Sec. 1715. Cyber incident reporting
352 words·~2 min read·
/bill/118/s/2226/pap/section-1715·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall, in consultation with the Chief Information Officer of the Department of Defense, the Commander of United States Cyber Command, and the Commander of the Joint Force Headquarters Department of Defense Information Network— assign responsibility to the Commander of the Joint Force Headquarters Department of Defense Information Network to oversee cyber incident reporting and notification of cyber incidents to Department leadership; align policy and system requirements to enable the Department to have enterprise-wide visibility of cyber incident reporting to support rapid and appropriate response; and distribute new guidance to Department personnel on cyber incident reporting, which shall include detailed procedures for identifying, reporting, and notifying Department leadership of critical cyber incidents.
Not later than 180 days after the date of the enactment of this Act, the Secretary shall ensure that the Chief Information Officer determines what actions need to be taken to encourage more complete and timely mandatory cyber incident reporting from persons in the defense industrial base. The Secretary shall ensure that components of the Department document instances in which Department personnel affected by a privacy data breach are notified of the breach within 72 hours of the discovery of the breach.
Not later than one year after the date of the enactment of this Act, the Secretary of Defense shall complete an assessment of the feasibility and suitability of establishing, and resourcing required to establish, an office of cyber statistics to track cyber incidents and measure the response time of defense agencies and the military departments to address cyber threats, risks, and vulnerabilities. The assessment required under paragraph
(1)shall include an evaluation of the feasibility, suitability, and resourcing required for defense agencies and the military departments— to collect data on the amount of time it takes to detect a cyber incident; to respond to a cyber incident; to fully mitigate the risk of high-impact cyber vulnerabilities; to recover data following a malicious cyber intrusion; and to collect such other metrics as the Secretary determines would help improve cyber incident reporting practices.