6 U.S.C. § 681g — Federal sharing of incident reports

Page 393 TITLE 6—DOMESTIC SECURITY § 681g (b) Protections for reporting entities and infor- mation Reports describing covered cyber incidents or ransom payments submitted to the Agency by entities in accordance with section 681b of this title, as well as voluntarily-submitted cyber in- cident reports submitted to the Agency pursu- ant to section 681c of this title, shall— (1) be considered the commercial, financial, and proprietary information of the covered en- tity when so designated by the covered entity; (2) be exempt from disclosure under section 552(b)(3) of title 5 (commonly known as the ‘‘Freedom of Information Act’’), as well as any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of informa- tion or records; (3) be considered not to constitute a waiver of any applicable privilege or protection pro- vided by law, including trade secret protec- tion; and (4) not be subject to a rule of any Federal agency or department or any judicial doctrine regarding ex parte communications with a de- cision-making official. (c) Liability protections (1) In general No cause of action shall lie or be maintained in any court by any person or entity and any such action shall be promptly dismissed for the submission of a report pursuant to section 681b(a) of this title that is submitted in con- formance with this part and the rule promul- gated under section 681b(b) of this title, except that this subsection shall not apply with re- gard to an action by the Federal Government pursuant to section 681d(c)(2) of this title. (2) Scope The liability protections provided in this subsection shall only apply to or affect litiga- tion that is solely based on the submission of a covered cyber incident report or ransom pay- ment report to the Agency. (3) Restrictions Notwithstanding paragraph (2), no report submitted to the Agency pursuant to this part or any communication, document, material, or other record, created for the sole purpose of preparing, drafting, or submitting such report, may be received in evidence, subject to dis- covery, or otherwise used in any trial, hearing, or other proceeding in or before any court, regulatory body, or other authority of the United States, a State, or a political subdivi- sion thereof, provided that nothing in this part shall create a defense to discovery or oth- erwise affect the discovery of any communica- tion, document, material, or other record not created for the sole purpose of preparing, drafting, or submitting such report. (d) Sharing with non-Federal entities The Agency shall anonymize the victim who reported the information when making informa- tion provided in reports received under section 681b of this title available to critical infrastruc- ture owners and operators and the general pub- lic. (e) Stored Communications Act Nothing in this part shall be construed to per- mit or require disclosure by a provider of a re- mote computing service or a provider of an elec- tronic communication service to the public of information not otherwise permitted or required to be disclosed under chapter 121 of title 18 (commonly known as the ‘‘Stored Communica- tions Act’’). (Pub. L. 107–296, title XXII, § 2245, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1051.) § 681f. Cyber Incident Reporting Council (a) Responsibility of the Secretary The Secretary shall lead an intergovernmental Cyber Incident Reporting Council, in consulta- tion with the Director of the Office of Manage- ment and Budget, the Attorney General, the Na- tional Cyber Director, Sector Risk Management Agencies, and other appropriate Federal agen- cies, to coordinate, deconflict, and harmonize Federal incident reporting requirements, includ- ing those issued through regulations. (b) Rule of construction Nothing in subsection (a) shall be construed to provide any additional regulatory authority to any Federal entity. (Pub. L. 107–296, title XXII, § 2246, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1054.) § 681g. Federal sharing of incident reports (a) Cyber incident reporting sharing (1) In general Notwithstanding any other provision of law or regulation, any Federal agency, including any independent establishment (as defined in section 104 of title 5), that receives a report from an entity of a cyber incident, including a ransomware attack, shall provide the report to the Agency as soon as possible, but not later than 24 hours after receiving the report, unless a shorter period is required by an agree- ment made between the Department of Home- land Security (including the Cybersecurity and Infrastructure Security Agency) and the recipient Federal agency. The Director shall share and coordinate each report pursuant to section 681a(b) of this title, as added by sec- tion 103 of this division. (2) Rule of construction The requirements described in paragraph (1) and section 681e(d) of this title, as added by section 103 of this division, may not be con- strued to be a violation of any provision of law or policy that would otherwise prohibit disclo- sure or provision of information within the ex- ecutive branch. (3) Protection of information The Director shall comply with any obliga- tions of the recipient Federal agency described in paragraph (1) to protect information, in- cluding with respect to privacy, confiden- tiality, or information security, if those obli- gations would impose greater protection re- Page 394 TITLE 6—DOMESTIC SECURITY § 681g quirements than this division or the amend- ments made by this division. (4) Effective date This subsection shall take effect on the ef- fective date of the final rule issued pursuant to section 681b(b) of this title, as added by sec- tion 103 of this division. (5) Agency agreements (A) In general The Agency and any Federal agency, in- cluding any independent establishment (as defined in section 104 of title 5), that re- ceives incident reports from entities, includ- ing due to ransomware attacks, shall, as ap- propriate, enter into a documented agree- ment to establish policies, processes, proce- dures, and mechanisms to ensure reports are shared with the Agency pursuant to para- graph (1). (B) Availability To the maximum extent practicable, each documented agreement required under sub- paragraph (A) shall be made publicly avail- able. (C) Requirement The documented agreements required by subparagraph (A) shall require reports be shared from Federal agencies with the Agen- cy in such time as to meet the overall timeline for covered entity reporting of cov- ered cyber incidents and ransom payments established in section 681b of this title, as added by section 103 of this division. (b) Harmonizing reporting requirements The Secretary of Homeland Security, acting through the Director, shall, in consultation with the Cyber Incident Reporting Council described in section 681f of this title, as added by section 103 of this division, to the maximum extent practicable— (1) periodically review existing regulatory requirements, including the information re- quired in such reports, to report incidents and ensure that any such reporting requirements and procedures avoid conflicting, duplicative, or burdensome requirements; and (2) coordinate with appropriate Federal part- ners and regulatory authorities that receive reports relating to incidents to identify oppor- tunities to streamline reporting processes, and where feasible, facilitate interagency agree- ments between such authorities to permit the sharing of such reports, consistent with appli- cable law and policy, without impacting the ability of the Agency to gain timely situa- tional awareness of a covered cyber incident or ransom payment. (Pub. L. 117–103, div. Y, § 104, Mar. 15, 2022, 136 Stat. 1054.) Editorial Notes REFERENCES IN TEXT Section 103 of this division, referred to in text, is sec- tion 103 of div. Y of Pub. L. 117–103, which enacted this part and amended section 659 of this title. CODIFICATION Section was enacted as part of the Cyber Incident Re- porting for Critical Infrastructure Act of 2022, and also as part of the Consolidated Appropriations Act, 2022, and not as part of the Homeland Security Act of 2002 which comprises this chapter. Statutory Notes and Related Subsidiaries DEFINITIONS For definitions of terms used in this section, see sec- tion 102 of div. Y of Pub. L. 117–103, which is set out as a note under section 665j of this title. CHAPTER 2—NATIONAL EMERGENCY MANAGEMENT Sec. 701. Definitions. SUBCHAPTER I—PERSONNEL PROVISIONS PART A—FEDERAL EMERGENCY MANAGEMENT AGENCY PERSONNEL 711. Surge Capacity Force. PART B—EMERGENCY MANAGEMENT CAPABILITIES 721. Evacuation preparedness technical assist- ance. 722. Urban Search and Rescue Response System. 723. Metropolitan Medical Response Grant Pro- gram. 724. Logistics. 725. Prepositioned equipment program. 726. Basic life supporting first aid and education. 727. Improvements to information technology sys- tems. 728. Disclosure of certain information to law en- forcement agencies. SUBCHAPTER II—COMPREHENSIVE PREPAREDNESS SYSTEM PART A—NATIONAL PREPAREDNESS SYSTEM 741. Definitions. 742. National preparedness. 743. National preparedness goal. 744. Establishment of national preparedness sys- tem. 745. National planning scenarios. 746. Target capabilities and preparedness prior- ities. 747. Equipment and training standards. 748. Training and exercises. 748a. Prioritization of facilities. 749. Comprehensive assessment system. 750. Remedial action management program. 751. Federal response capability inventory. 752. Reporting requirements. 753. Federal preparedness. 754. Use of existing resources. PART B—ADDITIONAL PREPAREDNESS 761. Emergency Management Assistance Compact grants. 762. Emergency management performance grants program. 763. Transfer of Noble Training Center. 763a. Training for Federal Government, foreign governments, or private entities. 764. National exercise simulation center. 765. Real property transactions. PART C—MISCELLANEOUS AUTHORITIES 771. National Disaster Recovery Strategy. 772. National Disaster Housing Strategy. 773. Individuals with disabilities guidelines. 774. Reunification. 775. National Emergency Family Registry and Lo- cator System. 776. Individuals and households pilot program. 777. Public assistance pilot program.