Browse Arkansas Code titles and sections
6 U.S.C. § 681b — Declaration
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general**
(1) **Declaration** — The Secretary, in consultation with the National Cyber Director, may make a declaration of a significant incident in accordance with this section for the purpose of enabling the activities described in this part if the Secretary determines that—
(A) a specific significant incident—
(i) has occurred; or
(ii) is likely to occur imminently; and
(B) otherwise available resources, other than the Fund, are likely insufficient to respond effectively to, or to mitigate effectively, the specific significant incident described in subparagraph (A).
(2) **Prohibition on delegation** — The Secretary may not delegate the authority provided to the Secretary under paragraph (1).
**(b) Asset response activities** Upon a declaration, the Director shall coordinate—
(1) the asset response activities of each Federal agency in response to the specific significant incident associated with the declaration; and
(2) with appropriate entities, which may include—
(A) public and private entities and State and local governments with respect to the asset response activities of those entities and governments; and
(B) Federal, State, local, and Tribal law enforcement agencies with respect to investigations and threat response activities of those law enforcement agencies; and
(3) Federal, State, local, and Tribal emergency management and response agencies.
**(c) Duration** Subject to subsection (d), a declaration shall terminate upon the earlier of—
(1) a determination by the Secretary that the declaration is no longer necessary; or
(2) the expiration of the 120-day period beginning on the date on which the Secretary makes the declaration.
**(d) Renewal** The Secretary, without delegation, may renew a declaration as necessary.
**(
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 681b
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 48ba2a0f7fa3914bbe3aca9181f1c8de87b8fe60bffb5e810233e07a910d3ced. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_1bbf2df6514e95228e1cb9d6
Source file: Laws/federal/codes/united-states-code/title-6/section-681b-declaration--cc390523e0.md
Pages: Not recorded – Not recorded
Passage SHA-256: e5055015ae0213e16ce656408898587c9a5fb05b1a9e58666eaa2f1a9473ab55
Source location: Title 6, Chapter 1, § 681b; chapter-001-homeland-security-organization.md
Stored source content
**(a) In general**
(1) **Declaration** — The Secretary, in consultation with the National Cyber Director, may make a declaration of a significant incident in accordance with this section for the purpose of enabling the activities described in this part if the Secretary determines that—
(A) a specific significant incident—
(i) has occurred; or
(ii) is likely to occur imminently; and
(B) otherwise available resources, other than the Fund, are likely insufficient to respond effectively to, or to mitigate effectively, the specific significant incident described in subparagraph (A).
(2) **Prohibition on delegation** — The Secretary may not delegate the authority provided to the Secretary under paragraph (1).
**(b) Asset response activities** Upon a declaration, the Director shall coordinate—
(1) the asset response activities of each Federal agency in response to the specific significant incident associated with the declaration; and
(2) with appropriate entities, which may include—
(A) public and private entities and State and local governments with respect to the asset response activities of those entities and governments; and
(B) Federal, State, local, and Tribal law enforcement agencies with respect to investigations and threat response activities of those law enforcement agencies; and
(3) Federal, State, local, and Tribal emergency management and response agencies.
**(c) Duration** Subject to subsection (d), a declaration shall terminate upon the earlier of—
(1) a determination by the Secretary that the declaration is no longer necessary; or
(2) the expiration of the 120-day period beginning on the date on which the Secretary makes the declaration.
**(d) Renewal** The Secretary, without delegation, may renew a declaration as necessary.
**(e) Publication**
(1) **In general** — Not later than 72 hours after a declaration or a renewal, the Secretary shall publish the declaration or renewal in the Federal Register.
(2) **Prohibition** — A declaration or renewal published under paragraph (1) may not include the name of any affected individual or private company.
**(f) Advance actions**
(1) **In general** — The Secretary—
(A) shall assess the resources available to respond to a potential declaration; and
(B) may take actions before and while a declaration is in effect to arrange or procure additional resources for asset response activities or technical assistance the Secretary determines necessary, which may include entering into standby contracts with private entities for cybersecurity services or incident responders in the event of a declaration.
(2) **Expenditure of funds** — Any expenditure from the Fund for the purpose of paragraph (1)(B) shall be made from amounts available in the Fund, and amounts available in the Fund shall be in addition to any other appropriations available to the Cybersecurity and Infrastructure Security Agency for such purpose.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** Entities may voluntarily report cyber incidents or ransom payments to the Agency that are not required under paragraph (1), (2), or (3) of [section 681b(a) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b/a&num=0&edition=prelim), but may enhance the situational awareness of cyber threats.
**(b) Voluntary provision of additional information in required reports** Covered entities may voluntarily include in reports required under paragraph (1), (2), or (3) of [section 681b(a) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b/a&num=0&edition=prelim) information that is not required to be included, but may enhance the situational awareness of cyber threats.
**(c) Application of [section 681e of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681e&num=0&edition=prelim)** [Section 681e of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681e&num=0&edition=prelim) shall apply in the same manner and to the same extent to reports and information submitted under subsections (a) and (b) as it applies to reports and information submitted under [section 681b of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b&num=0&edition=prelim).
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 103
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Purpose** In the event that a covered entity that is required to submit a report under [section 681b(a) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b/a&num=0&edition=prelim) fails to comply with the requirement to report, the Director may obtain information about the cyber incident or ransom payment by engaging the covered entity directly to request information about the cyber incident or ransom payment, and if the Director is unable to obtain information through such engagement, by issuing a subpoena to the covered entity, pursuant to subsection (c), to gather information sufficient to determine whether a covered cyber incident or ransom payment has occurred.
**(b) Initial request for information**
(1) **In general** — If the Director has reason to believe, whether through public reporting or other information in the possession of the Federal Government, including through analysis performed pursuant to paragraph (1) or (2) of [section 681a(a) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681a/a&num=0&edition=prelim), that a covered entity has experienced a covered cyber incident or made a ransom payment but failed to report such cyber incident or payment to the Agency in accordance with [section 681b(a) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b/a&num=0&edition=prelim), the Director may request additional information from the covered entity to confirm whether or not a covered cyber incident or ransom payment has occurred.
(2) **Treatment** — Information provided to the Agency in response to a request under paragraph (1) shall be treated as if it was submitted through the reporting procedures established in [section 68
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 103a
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Disclosure, retention, and use**
(1) **Authorized activities** — Information provided to the Agency pursuant to section 681b or 681c of this title may be disclosed to, retained by, and used by, consistent with otherwise applicable provisions of Federal law, any Federal agency or department, component, officer, employee, or agent of the Federal Government solely for—
(A) a cybersecurity purpose;
(B) the purpose of identifying—
(i) a cyber threat, including the source of the cyber threat; or
(ii) a security vulnerability;
(C) the purpose of responding to, or otherwise preventing or mitigating, a specific threat of death, a specific threat of serious bodily harm, or a specific threat of serious economic harm, including a terrorist act or use of a weapon of mass destruction;
(D) the purpose of responding to, investigating, prosecuting, or otherwise preventing or mitigating, a serious threat to a minor, including sexual exploitation and threats to physical safety; or
(E) the purpose of preventing, investigating, disrupting, or prosecuting an offense arising out of a cyber incident reported pursuant to section 681b or 681c of this title or any of the offenses listed in [section 1504(d)(5)(A)(v) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1504/d/5/A/v&num=0&edition=prelim).
(2) **Agency actions after receipt**
(A) *Rapid, confidential sharing of cyber threat indicators* — Upon receiving a covered cyber incident or ransom payment report submitted pursuant to this section, the Agency shall immediately review the report to determine whether the cyber incident that is the subject of the report is connected to an ongoing cyber threat or security vulnerability and where applicable, use such report to i
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 104
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Cyber incident reporting sharing**
(1) **In general** — Notwithstanding any other provision of law or regulation, any Federal agency, including any independent establishment (as defined in [section 104 of title 5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section104&num=0&edition=prelim)), that receives a report from an entity of a cyber incident, including a ransomware attack, shall provide the report to the Agency as soon as possible, but not later than 24 hours after receiving the report, unless a shorter period is required by an agreement made between the Department of Homeland Security (including the Cybersecurity and Infrastructure Security Agency) and the recipient Federal agency. The Director shall share and coordinate each report pursuant to [section 681a(b) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681a/b&num=0&edition=prelim), as added by section 103 of this division.
(2) **Rule of construction** — The requirements described in paragraph (1) and [section 681e(d) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681e/d&num=0&edition=prelim), as added by section 103 of this division, may not be construed to be a violation of any provision of law or policy that would otherwise prohibit disclosure or provision of information within the executive branch.
(3) **Protection of information** — The Director shall comply with any obligations of the recipient Federal agency described in paragraph (1) to protect information, including with respect to privacy, confidentiality, or information security, if those obligations would impose greater protection requirements than this division or the amendments made by this division.
(4) **Effective date** — T
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 106
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 387
TITLE 6—DOMESTIC SECURITY
§ 681b
1 So in original. Probably should be ‘‘subparagraph’’.
§ 681b. Required reporting of certain cyber inci-
dents
(a) In general
(1) Covered cyber incident reports
(A) In general
A covered entity that experiences a cov-
ered cyber incident shall report the covered
cyber incident to the Agency not later than
72 hours after the covered entity reasonably
believes that the covered cyber incident has
occurred.
(B) Limitation
The Director may not require reporting
under subparagraph (A) any earlier than 72
hours after the covered entity reasonably
believes that a covered cyber incident has
occurred.
(2) Ransom payment reports
(A) In general
A covered entity that makes a ransom
payment as the result of a ransomware at-
tack against the covered entity shall report
the payment to the Agency not later than 24
hours after the ransom payment has been
made.
(B) Application
The requirements under subparagraph (A)
shall apply even if the ransomware attack is
not a covered cyber incident subject to the
reporting requirements under paragraph (1).
(3) Supplemental reports
A covered entity shall promptly submit to
the Agency an update or supplement to a pre-
viously submitted covered cyber incident re-
port if substantial new or different informa-
tion becomes available or if the covered entity
makes a ransom payment after submitting a
covered cyber incident report required under
paragraph (1), until such date that such cov-
ered entity notifies the Agency that the cov-
ered cyber incident at issue has concluded and
has been fully mitigated and resolved.
(4) Preservation of information
Any covered entity subject to requirements
of paragraph (1), (2), or (3) shall preserve data
relevant to the covered cyber incid
Source: Supplied 2024 U.S. Code historical extraction · 6 U.S.C. § 681b
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.