10 U.S.C. § 391 — Reporting on cyber incidents with respect to networks and information systems of operationally critical contractors and certain other contractors

(a) Designation of Department Component to Receive Reports: The Secretary of Defense must name a part of the Department of Defense to receive cyber-incident reports — both from contractors, under this section and section 393, and from other government bodies.

(b) Procedures for Reporting Cyber Incidents: The Secretary must set up procedures requiring an "operationally critical contractor" to report, in a timely way, each cyber incident on its network or information systems to the component named under subsection (a).

(c) Procedure Requirements: (1) Designation and notification: The procedures must include a way to designate operationally critical contractors and to notify a contractor once it has been designated. (2) Rapid reporting: The procedures must require each operationally critical contractor to quickly report each cyber incident to the designated Department component. Every report must include: (A) the contractor's assessment of how the incident affects its ability to meet its contract requirements with the Department; (B) the technique or method used in the incident; (C) a sample of any malicious software the contractor found and isolated; and (D) a summary of what information was compromised. (3) Department assistance and access to equipment and information by department personnel: The procedures must let Department personnel help contractors detect and stop intrusions when asked, and must limit what equipment or information a contractor has to give Department staff to only what's needed to find out whether Department-related information was stolen from the contractor's systems, and if so, what was taken. (4) Protection of trade secrets and other information: The procedures must reasonably protect trade secrets, financial and commercial information, and information that could identify a specific person. (5) Dissemination of information: The procedures must limit who receives information gathered this way to: (A) entities whose mission the information may affect; (B) entities that might help diagnose, detect, or fix cyber incidents; (C) entities doing counterintelligence or law enforcement investigations; or (D) entities needing it for national security, including cyber situational awareness and defense.

(d) Protection From Liability of Operationally Critical Contractors: (1) No lawsuit may proceed against an operationally critical contractor — and any such suit must be promptly dismissed — for complying with this section and with the related cyber-incident-reporting requirements in its Defense Federal Acquisition Regulation Supplement contract clause, as long as the contractor followed the procedures set under subsection (b). (2)(A) This protection does not require dismissing a suit against a contractor that engaged in "willful misconduct" while following those procedures, and it doesn't limit any other legal defenses the contractor might otherwise have. (B) In a suit claiming the shield doesn't apply because of willful misconduct, the person suing must prove, by clear and convincing evidence, that the contractor's willful misconduct directly caused their injury. (C) "Willful misconduct" means an act or failure to act that is done on purpose to achieve a wrongful goal, done knowingly without any legal or factual justification, and done while disregarding a known, obvious risk that's so serious it's highly likely harm will outweigh any benefit.

(e) Definitions: (1) "Cyber incident" means actions using computer networks that actually or potentially harm an information system or the information on it. (2) "Operationally critical contractor" means a contractor the Secretary designates as a critical supplier of airlift, sealift, intermodal transportation, or logistics support essential to mobilizing, deploying, or sustaining the Armed Forces^* in a contingency operation^*.