Browse Arkansas Code titles and sections
6 U.S.C. § 106 — Federal sharing of incident reports
Federal law — U.S. Code and appendices · legal_authorities
**(a) Cyber incident reporting sharing**
(1) **In general** — Notwithstanding any other provision of law or regulation, any Federal agency, including any independent establishment (as defined in [section 104 of title 5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section104&num=0&edition=prelim)), that receives a report from an entity of a cyber incident, including a ransomware attack, shall provide the report to the Agency as soon as possible, but not later than 24 hours after receiving the report, unless a shorter period is required by an agreement made between the Department of Homeland Security (including the Cybersecurity and Infrastructure Security Agency) and the recipient Federal agency. The Director shall share and coordinate each report pursuant to [section 681a(b) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681a/b&num=0&edition=prelim), as added by section 103 of this division.
(2) **Rule of construction** — The requirements described in paragraph (1) and [section 681e(d) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681e/d&num=0&edition=prelim), as added by section 103 of this division, may not be construed to be a violation of any provision of law or policy that would otherwise prohibit disclosure or provision of information within the executive branch.
(3) **Protection of information** — The Director shall comply with any obligations of the recipient Federal agency described in paragraph (1) to protect information, including with respect to privacy, confidentiality, or information security, if those obligations would impose greater protection requirements than this division or the amendments made by this division.
(4) **Effective date** — T
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 106
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 8110054df64a38d79d98999a435f263b3839e6f2fa67d4cb765766956b5fcf3f. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_51d795d2025055ece3876fa0
Source file: Laws/federal/codes/united-states-code/title-6/section-106-federal-sharing-of-incident-reports--de6e7b80fc.md
Pages: Not recorded – Not recorded
Passage SHA-256: 0cc5c6c63eb3a681155d3bcc8589e816ac88f730f6f531dae745179e0ed3e69f
Source location: Title 6, Chapter 1, § 106; chapter-001-homeland-security-organization.md
Stored source content
**(a) Cyber incident reporting sharing**
(1) **In general** — Notwithstanding any other provision of law or regulation, any Federal agency, including any independent establishment (as defined in [section 104 of title 5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section104&num=0&edition=prelim)), that receives a report from an entity of a cyber incident, including a ransomware attack, shall provide the report to the Agency as soon as possible, but not later than 24 hours after receiving the report, unless a shorter period is required by an agreement made between the Department of Homeland Security (including the Cybersecurity and Infrastructure Security Agency) and the recipient Federal agency. The Director shall share and coordinate each report pursuant to [section 681a(b) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681a/b&num=0&edition=prelim), as added by section 103 of this division.
(2) **Rule of construction** — The requirements described in paragraph (1) and [section 681e(d) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681e/d&num=0&edition=prelim), as added by section 103 of this division, may not be construed to be a violation of any provision of law or policy that would otherwise prohibit disclosure or provision of information within the executive branch.
(3) **Protection of information** — The Director shall comply with any obligations of the recipient Federal agency described in paragraph (1) to protect information, including with respect to privacy, confidentiality, or information security, if those obligations would impose greater protection requirements than this division or the amendments made by this division.
(4) **Effective date** — This subsection shall take effect on the effective date of the final rule issued pursuant to [section 681b(b) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b/b&num=0&edition=prelim), as added by section 103 of this division.
(5) **Agency agreements**
(A) *In general* — The Agency and any Federal agency, including any independent establishment (as defined in [section 104 of title 5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section104&num=0&edition=prelim)), that receives incident reports from entities, including due to ransomware attacks, shall, as appropriate, enter into a documented agreement to establish policies, processes, procedures, and mechanisms to ensure reports are shared with the Agency pursuant to paragraph (1).
(B) *Availability* — To the maximum extent practicable, each documented agreement required under subparagraph (A) shall be made publicly available.
(C) *Requirement* — The documented agreements required by subparagraph (A) shall require reports be shared from Federal agencies with the Agency in such time as to meet the overall timeline for covered entity reporting of covered cyber incidents and ransom payments established in [section 681b of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b&num=0&edition=prelim), as added by section 103 of this division.
**(b) Harmonizing reporting requirements** The Secretary of Homeland Security, acting through the Director, shall, in consultation with the Cyber Incident Reporting Council described in [section 681f of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681f&num=0&edition=prelim), as added by section 103 of this division, to the maximum extent practicable—
(1) periodically review existing regulatory requirements, including the information required in such reports, to report incidents and ensure that any such reporting requirements and procedures avoid conflicting, duplicative, or burdensome requirements; and
(2) coordinate with appropriate Federal partners and regulatory authorities that receive reports relating to incidents to identify opportunities to streamline reporting processes, and where feasible, facilitate interagency agreements between such authorities to permit the sharing of such reports, consistent with applicable law and policy, without impacting the ability of the Agency to gain timely situational awareness of a covered cyber incident or ransom payment.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Redesignation**
(1) **In general** — The National Protection and Programs Directorate of the Department shall, on and after November 16, 2018, be known as the “Cybersecurity and Infrastructure Security Agency”.
(2) **References** — Any reference to the National Protection and Programs Directorate of the Department in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Cybersecurity and Infrastructure Security Agency of the Department.
**(b) Director**
(1) **In general** — The Agency shall be headed by the Director, who shall report to the Secretary.
(2) **Qualifications**
(A) *In general* — The Director shall be appointed from among individuals who have—
(i) extensive knowledge in at least two of the areas specified in subparagraph (B); and
(ii) not fewer than five years of demonstrated experience in efforts to foster coordination and collaboration between the Federal Government, the private sector, and other entities on issues related to cybersecurity, infrastructure security, or security risk management.
(B) *Specified areas* — The areas specified in this subparagraph are the following:
(i) Cybersecurity.
(ii) Infrastructure security.
(iii) Security risk management.
(3) **Reference** — Any reference to an Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and any other related program of the Department as described in [section 113(a)(1)(H) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section113/a/1/H&num=0&edition=prelim) as in effect on the day before November 16, 2018, in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a re
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 659
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
There are authorized to be appropriated to the Fund $20,000,000 for fiscal year 2022 and each fiscal year thereafter until September 30, 2028, which shall remain available until September 30, 2028.
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 681f
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general**
(1) **Declaration** — The Secretary, in consultation with the National Cyber Director, may make a declaration of a significant incident in accordance with this section for the purpose of enabling the activities described in this part if the Secretary determines that—
(A) a specific significant incident—
(i) has occurred; or
(ii) is likely to occur imminently; and
(B) otherwise available resources, other than the Fund, are likely insufficient to respond effectively to, or to mitigate effectively, the specific significant incident described in subparagraph (A).
(2) **Prohibition on delegation** — The Secretary may not delegate the authority provided to the Secretary under paragraph (1).
**(b) Asset response activities** Upon a declaration, the Director shall coordinate—
(1) the asset response activities of each Federal agency in response to the specific significant incident associated with the declaration; and
(2) with appropriate entities, which may include—
(A) public and private entities and State and local governments with respect to the asset response activities of those entities and governments; and
(B) Federal, State, local, and Tribal law enforcement agencies with respect to investigations and threat response activities of those law enforcement agencies; and
(3) Federal, State, local, and Tribal emergency management and response agencies.
**(c) Duration** Subject to subsection (d), a declaration shall terminate upon the earlier of—
(1) a determination by the Secretary that the declaration is no longer necessary; or
(2) the expiration of the 120-day period beginning on the date on which the Secretary makes the declaration.
**(d) Renewal** The Secretary, without delegation, may renew a declaration as necessary.
**(
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 681b
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Establishment of Office** There is established in the Agency an office for joint cyber planning (in this section referred to as the “Office”) to develop, for public and private sector entities, plans for cyber defense operations, including the development of a set of coordinated actions to protect, detect, respond to, and recover from cybersecurity risks or incidents or limit, mitigate, or defend against coordinated, malicious cyber operations that pose a potential risk to critical infrastructure or national interests. The Office shall be headed by a senior official of the Agency selected by the Director.
**(b) Planning and execution** In leading the development of plans for cyber defense operations pursuant to subsection (a), the head of the Office shall—
(1) coordinate with relevant Federal departments and agencies to establish processes and procedures necessary to develop and maintain ongoing coordinated plans for cyber defense operations;
(2) leverage cyber capabilities and authorities of participating Federal departments and agencies, as appropriate, in furtherance of plans for cyber defense operations;
(3) ensure that plans for cyber defense operations are, to the greatest extent practicable, developed in collaboration with relevant private sector entities, particularly in areas in which such entities have comparative advantages in limiting, mitigating, or defending against a cybersecurity risk or incident or coordinated, malicious cyber operation;
(4) ensure that plans for cyber defense operations, as appropriate, are responsive to potential adversary activity conducted in response to United States offensive cyber operations;
(5) facilitate the exercise of plans for cyber defense operations, including by developing and modeling scenarios based on an u
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 665j
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
For the purpose of this title, “independent establishment” means—
(1) an establishment in the executive branch (other than the United States Postal Service or the Postal Regulatory Commission) which is not an Executive department, military department, Government corporation, or part thereof, or part of an independent establishment; and
(2) the Government Accountability Office.
Source: Supplied U.S. Code snapshot — release unconfirmed · 5 U.S.C. § 104
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 14
TITLE 6—DOMESTIC SECURITY
§ 105
plan under subsection (c), the Comptroller Gen-
eral of the United States shall conduct a review
of the strategy and implementation plan to ana-
lyze gaps and resources mapped against the re-
quirements of the National Biodefense Strategy
and existing United States biodefense policy
documents.
(f) Appropriate congressional committees de-
fined
In this section, the term ‘‘appropriate congres-
sional committees’’ means the following:
(1) The congressional defense committees.
(2) The Committee on Energy and Commerce
of the House of Representatives and the Com-
mittee on Health, Education, Labor, and Pen-
sions of the Senate.
(3) The Committee on Homeland Security of
the House of Representatives and the Com-
mittee on Homeland Security and Govern-
mental Affairs of the Senate.
(4) The Committee on Agriculture of the
House of Representatives and the Committee
on Agriculture, Nutrition, and Forestry of the
Senate.
(Pub. L. 114–328, div. A, title X, § 1086, Dec. 23,
2016, 130 Stat. 2423; Pub. L. 116–92, div. A, title
XVII, § 1704, Dec. 20, 2019, 133 Stat. 1797.)
Editorial Notes
CODIFICATION
Section was enacted as part of the National Defense
Authorization Act for Fiscal Year 2017, and not as part
of the Homeland Security Act of 2002 which comprises
this chapter.
AMENDMENTS
2019—Subsec. (d). Pub. L. 116–92 substituted ‘‘March 1,
2025’’ for ‘‘March 1, 2019’’.
Statutory Notes and Related Subsidiaries
‘‘CONGRESSIONAL DEFENSE COMMITTEES’’ DEFINED
Congressional defense committees means the Com-
mittees on Armed Services and Appropriations of the
Senate and the House of Representatives, see section 3
of Pub. L. 114–328, 130 Stat. 2025. See note under section
101 of Title 10, Armed Forces.
§ 105. Biodefense analysi
Source: Supplied 2024 U.S. Code historical extraction · 6 U.S.C. § 106
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.