6 U.S.C. § 681g — Federal sharing of incident reports
submitted 4 years ago by Pub. L. 117-103 to r/title-6-DOMESTIC-SECURITY · 533 words · no verdicts yet
A Federal agency that receives a cyber-incident report must send it to the Agency promptly and generally within 24 hours, subject to specified agreements and protections. Homeland Security must also review and streamline overlapping incident-reporting requirements.
(a)(1) Despite other law or regulation, a Federal agency*, including an independent establishment as defined in 5 U.S.C. § 104, that receives an entity’s cyber-incident* report, including a ransomware report, must send it to the Agency as soon as possible and no later than 24 hours later, unless a DHS-agency agreement requires less time. The Director* must share and coordinate each report under section 681a(b). (2) These requirements and section 681e(d) do not violate a law or policy that would otherwise bar information sharing within the Executive Branch. (3) The Director must follow the recipient agency’s stronger privacy, confidentiality, or information-security duties if they provide more protection than this division or its amendments. (4) This subsection begins when the final section 681b(b) rule takes effect. (5)(A) The Agency and each Federal agency receiving entity reports must, when suitable, make documented agreements establishing policies, processes, procedures, and mechanisms for sharing reports. (B) They must make each agreement public as far as practicable. (C) Agreements must require sharing soon enough to meet section 681b’s overall covered-entity deadlines. (b) To the greatest practicable extent, the Secretary* of Homeland* Security, through the Director and consulting the Council*, must: (1) periodically review regulatory incident-reporting requirements, including required information, and ensure they are not conflicting, duplicative, or burdensome; and (2) coordinate with Federal partners and regulators receiving incident reports to streamline reporting and, when possible, facilitate agreements allowing reports to be shared consistently with law and policy without preventing the Agency from timely understanding covered incidents or ransom payments.
Notwithstanding any other provision of law or regulation, any Federal agency*, including any independent establishment (as defined in section 104 of title 5), that receives a report from an entity of a cyber incident*, including a ransomware attack*, shall provide the report to the Agency as soon as possible, but not later than 24 hours after receiving the report, unless a shorter period is required by an agreement made between the Department* of Homeland* Security (including the Cybersecurity and Infrastructure Security Agency) and the recipient Federal agency. The Director* shall share and coordinate each report pursuant to section 681a(b) of this title, as added by section 103 of this division.
The requirements described in paragraph (1) and section 681e(d) of this title, as added by section 103 of this division, may not be construed to be a violation of any provision of law or policy that would otherwise prohibit disclosure or provision of information within the executive branch.
The Director shall comply with any obligations of the recipient Federal agency described in paragraph (1) to protect information, including with respect to privacy, confidentiality, or information security, if those obligations would impose greater protection requirements than this division or the amendments made by this division.
This subsection shall take effect on the effective date of the final rule issued pursuant to section 681b(b) of this title, as added by section 103 of this division.
The Agency and any Federal agency, including any independent establishment (as defined in section 104 of title 5), that receives incident reports from entities, including due to ransomware attacks, shall, as appropriate, enter into a documented agreement to establish policies, processes, procedures, and mechanisms to ensure reports are shared with the Agency pursuant to paragraph (1).
To the maximum extent practicable, each documented agreement required under subparagraph (A) shall be made publicly available.
The documented agreements required by subparagraph (A) shall require reports be shared from Federal agencies with the Agency in such time as to meet the overall timeline for covered entity* reporting of covered cyber incidents and ransom payments established in section 681b of this title, as added by section 103 of this division.
The Secretary* of Homeland Security, acting through the Director, shall, in consultation with the Cyber Incident Reporting Council* described in section 681f of this title, as added by section 103 of this division, to the maximum extent practicable—
periodically review existing regulatory requirements, including the information required in such reports, to report incidents and ensure that any such reporting requirements and procedures avoid conflicting, duplicative, or burdensome requirements; and
coordinate with appropriate Federal partners and regulatory authorities that receive reports relating to incidents to identify opportunities to streamline reporting processes, and where feasible, facilitate interagency agreements between such authorities to permit the sharing of such reports, consistent with applicable law and policy, without impacting the ability of the Agency to gain timely situational awareness of a covered cyber incident* or ransom payment*.
Source credit: (Pub. L. 117–103, div. Y, § 104, Mar. 15, 2022, 136 Stat. 1054.)
- 2022Enacted · Pub. L. 117-103 · 136 Stat. 1054
A history note hasn’t been published yet. The record shows enactment by Pub. L. 117-103 on 2022-03-15.
all 0 arguments · sorted by: best
no arguments yet — make the first case