10 U.S.C. § 6228 — Reporting on penetrations of networks of contractors and subcontractors

(a) Reporting procedures. The Administrator^* must require each contractor and subcontractor to report to the Chief Information Officer^* when a qualifying covered network is successfully penetrated.
(b) Criteria. Consulting the Deputy Administrator for Defense Programs, Associate Administrator for Acquisition and Project Management, Chief Information Officer, and any other needed Administration^* official, the Administrator must set the criteria for networks covered by the reporting procedures.
(c) Requirements. (1)(A) A contractor or subcontractor must report each qualifying successful penetration within 60 days after discovering it. (B) The report must include the penetration technique or method, a sample of discovered and isolated malicious software, and a summary of Administration-created or Administration-created-for information potentially compromised. (C) If all information is unavailable at 60 days, the report must include what is available then and the rest when it becomes available. (2) At the same time, the Administrator must establish procedures for cases in which Administration-owned information was in use or at risk because of a penetration. For a management-and-operating contractor, the procedures must improve Administration personnel’s access to government equipment and information; for another contractor or subcontractor, they must facilitate access to that entity’s equipment and information. They must include requested access for Administration forensic analysis in addition to the entity’s analysis; limit required access to determining whether Administration-connected information was successfully taken from the network and what it was; and reasonably protect trade secrets, commercial or financial information, and person-identifying information. (3) The procedures must allow information dissemination only to entities whose missions may be affected, that may help diagnose, detect, or reduce cyber incidents, that conduct counterintelligence or law-enforcement investigations, or that need it for national-security purposes including cyber awareness and defense.
(d) Definitions. “Chief Information Officer” means the Administration’s Associate Administrator for Information Management and Chief Information Officer. “Contractor” means a private entity contracting with the Administration to provide any kind of supplies^*, equipment, materials, or services. “Covered network” includes a network or information system accessing, receiving, or storing classified information^* or sensitive unclassified information related to an Administration program, as the Administrator determines. “Subcontractor” means a private entity contracting with a contractor or another subcontractor to provide such things for a contract supporting an Administration program. This section does not otherwise define the quoted terms.