10 U.S.C. § 393 — Reporting on penetrations of networks and information systems of certain contractors

(a) Procedures for Reporting Penetrations: The Secretary of Defense must create procedures requiring every "cleared defense contractor" to report to a Department of Defense component (chosen by the Secretary) whenever one of the contractor's networks or information systems — one that meets the criteria set under (b) — is successfully broken into ("penetrated"). (b) Networks and Information Systems Subject to Reporting: The Secretary must pick a senior official who, working with a listed group of officials — the Under Secretaries for Policy, for Acquisition and Sustainment, for Research and Engineering, and for Intelligence and Security, the Department's Chief Information Officer, and the Commander of U.S. Cyber Command — sets the criteria for which "covered networks" must follow the reporting procedures in (a). (c) Procedure Requirements: The procedures must require contractors to quickly report each successful penetration of a covered network to the designated Department component. Each report must include a description of the technique or method used; a sample of any malicious software the contractor found and isolated; and a summary of any Department-related information that may have been compromised. The procedures must also let Department personnel, on request, get access to a contractor's equipment or information to do their own forensic analysis, in addition to whatever the contractor does — but that access is limited to figuring out whether Department information was stolen ("exfiltrated") and what was taken, and must reasonably protect trade secrets, financial or commercial information, and information that could identify a specific person. Finally, the procedures must limit who can receive the gathered information to entities whose mission it may affect, entities that might help diagnose or fix cyber incidents, entities doing counterintelligence or law enforcement investigations, or entities working on national security, including cyber situational awareness and defense. (d) Protection From Liability of Cleared Defense Contractors: No lawsuit can be brought or continued against a cleared defense contractor for complying with this section the way the procedures require — any such case must be dismissed right away. But this protection does not apply if the contractor engaged in "willful misconduct" while complying, and it does not limit any other legal defenses that might normally apply. If someone claims the protection should not apply because of willful misconduct, that person has the burden of proving — with clear and convincing evidence — that the contractor engaged in willful misconduct and that this misconduct actually caused the person's injury. "Willful misconduct" means an act or failure to act that was intentional and meant to achieve a wrongful purpose; done knowingly, without any legal or factual justification; and done while disregarding a known or obvious risk so great that harm was highly likely to outweigh any benefit. (e) Definitions: "Cleared defense contractor" means a private company the Department of Defense has cleared to access, receive, or store classified information, for bidding on a contract or supporting a Department program. "Covered network" means a network or information system of a cleared defense contractor that holds or processes Department-related information which the contractor is required to give enhanced protection.