6 U.S.C. § 665i — CyberSentry program

(a) Establishment. The Agency^* must establish CyberSentry to continuously monitor^* and detect cybersecurity risks to critical-infrastructure entities that own or operate industrial control systems supporting national critical functions^*. It may do this only when the owner or operator requests and consents to it.

(b) Activities. Through CyberSentry, the Director^* must: (1) form strategic partnerships, subject to resources and the owner’s agreement and consent, with owners and operators that the Director determines have regionally or nationally important industrial-control systems supporting national critical functions, to provide technical assistance through continuous monitoring of those systems and supporting information systems, detect risks, and provide other appropriate cybersecurity services; (2) use sensitive or classified intelligence about risks involving particular sectors, adversaries, and tactics, techniques, and procedures to advise owners and operators about mitigation and share information when appropriate; (3) identify risks in information technology and systems supporting industrial-control systems that adversaries could exploit to access those systems, and work with owners and operators to fix the weaknesses; (4) create combined, anonymous analytical products based on threat hunting, continuous monitoring and detection, and partnerships, with findings and recommendations that can be shared with owners and operators; and (5) support activities authorized under section 1501 of the National Defense Authorization Act for Fiscal Year 2022.

(c) Privacy review. Within 180 days after December 27, 2021, the Agency’s Privacy Officer under 6 U.S.C. § 652(h) must review CyberSentry policies, guidelines, and activities for compliance with applicable privacy laws, including laws governing acquiring, intercepting, retaining, using, and disclosing communications. The officer must report to the two named congressional committees, certifying compliance or identifying noncompliance.

(d) Report to Congress. Within one year after December 27, 2021, the Director must give those committees a briefing and written report on implementation.

(e) Savings. This section does not allow the Federal Government to obtain information from a remote-computing service provider open to the public or an electronic-service provider open to the public when 18 U.S.C. § 2702 does not permit disclosure.

(f) Definition. “Industrial control system” means an information system^* used to monitor or control industrial processes such as manufacturing, product handling, production, and distribution. It includes SCADA systems for geographically dispersed assets^*, distributed control systems, human-machine interfaces, and programmable logic controllers for localized processes.

(g) Termination. Authority to carry out a program under this section ends seven years after December 27, 2021.