6 U.S.C. § 677b — Declaration

Page 382 TITLE 6—DOMESTIC SECURITY § 677b (D) facilitating information sharing and operational coordination with entities per- forming threat response activities; and (E) providing guidance on how best to use Federal resources and capabilities in a time- ly, effective manner to speed recovery from the incident. (2) Declaration The term ‘‘declaration’’ means a declaration of the Secretary under section 677b(a)(1) of this title. (3) Director The term ‘‘Director’’ means the Director of the Cybersecurity and Infrastructure Security Agency. (4) Federal agency The term ‘‘Federal agency’’ has the meaning given the term ‘‘agency’’ in section 3502 of title 44. (5) Fund The term ‘‘Fund’’ means the Cyber Response and Recovery Fund established under section 677c(a) of this title. (6) Incident The term ‘‘incident’’ has the meaning given the term in section 3552 of title 44. (7) Renewal The term ‘‘renewal’’ means a renewal of a declaration under section 677b(d) of this title. (8) Significant incident The term ‘‘significant incident’’— (A) means an incident or a group of related incidents that results, or is likely to result, in demonstrable harm to— (i) the national security interests, for- eign relations, or economy of the United States; or (ii) the public confidence, civil liberties, or public health and safety of the people of the United States; and (B) does not include an incident or a por- tion of a group of related incidents that oc- curs on— (i) a national security system (as defined in section 3552 of title 44); or (ii) an information system described in paragraph (2) or (3) of section 3553(e) of title 44. (Pub. L. 107–296, title XXII, § 2232, as added Pub. L. 117–58, div. G, title VI, § 70602(a), Nov. 15, 2021, 135 Stat. 1267.) § 677b. Declaration (a) In general (1) Declaration The Secretary, in consultation with the Na- tional Cyber Director, may make a declara- tion of a significant incident in accordance with this section for the purpose of enabling the activities described in this part if the Sec- retary determines that— (A) a specific significant incident— (i) has occurred; or (ii) is likely to occur imminently; and (B) otherwise available resources, other than the Fund, are likely insufficient to re- spond effectively to, or to mitigate effec- tively, the specific significant incident de- scribed in subparagraph (A). (2) Prohibition on delegation The Secretary may not delegate the author- ity provided to the Secretary under paragraph (1). (b) Asset response activities Upon a declaration, the Director shall coordi- nate— (1) the asset response activities of each Fed- eral agency in response to the specific signifi- cant incident associated with the declaration; and (2) with appropriate entities, which may in- clude— (A) public and private entities and State and local governments with respect to the asset response activities of those entities and governments; and (B) Federal, State, local, and Tribal law enforcement agencies with respect to inves- tigations and threat response activities of those law enforcement agencies; and (3) Federal, State, local, and Tribal emer- gency management and response agencies. (c) Duration Subject to subsection (d), a declaration shall terminate upon the earlier of— (1) a determination by the Secretary that the declaration is no longer necessary; or (2) the expiration of the 120-day period be- ginning on the date on which the Secretary makes the declaration. (d) Renewal The Secretary, without delegation, may renew a declaration as necessary. (e) Publication (1) In general Not later than 72 hours after a declaration or a renewal, the Secretary shall publish the declaration or renewal in the Federal Reg- ister. (2) Prohibition A declaration or renewal published under paragraph (1) may not include the name of any affected individual or private company. (f) Advance actions (1) In general The Secretary— (A) shall assess the resources available to respond to a potential declaration; and (B) may take actions before and while a declaration is in effect to arrange or procure additional resources for asset response ac- tivities or technical assistance the Sec- retary determines necessary, which may in- clude entering into standby contracts with private entities for cybersecurity services or incident responders in the event of a dec- laration. (2) Expenditure of funds Any expenditure from the Fund for the pur- pose of paragraph (1)(B) shall be made from Page 383 TITLE 6—DOMESTIC SECURITY § 677d amounts available in the Fund, and amounts available in the Fund shall be in addition to any other appropriations available to the Cybersecurity and Infrastructure Security Agency for such purpose. (Pub. L. 107–296, title XXII, § 2233, as added Pub. L. 117–58, div. G, title VI, § 70602(a), Nov. 15, 2021, 135 Stat. 1268.) § 677c. Cyber Response and Recovery Fund (a) In general There is established a Cyber Response and Re- covery Fund, which shall be available for— (1) the coordination of activities described in section 677b(b) of this title; (2) response and recovery support for the specific significant incident associated with a declaration to Federal, State, local, and Trib- al, entities and public and private entities on a reimbursable or non-reimbursable basis, in- cluding through asset response activities and technical assistance, such as— (A) vulnerability assessments and mitiga- tion; (B) technical incident mitigation; (C) malware analysis; (D) analytic support; (E) threat detection and hunting; and (F) network protections; (3) as the Director determines appropriate, grants for, or cooperative agreements with, Federal, State, local, and Tribal public and private entities to respond to, and recover from, the specific significant incident associ- ated with a declaration, such as— (A) hardware or software to replace, up- date, improve, harden, or enhance the functionality of existing hardware, software, or systems; and (B) technical contract personnel support; and (4) advance actions taken by the Secretary under section 677b(f)(1)(B) of this title. (b) Deposits and expenditures (1) In general Amounts shall be deposited into the Fund from— (A) appropriations to the Fund for activi- ties of the Fund; and (B) reimbursement from Federal agencies for the activities described in paragraphs (1), (2), and (4) of subsection (a), which shall only be from amounts made available in advance in appropriations Acts for such reimburse- ment. (2) Expenditures Any expenditure from the Fund for the pur- poses of this part shall be made from amounts available in the Fund from a deposit described in paragraph (1), and amounts available in the Fund shall be in addition to any other appro- priations available to the Cybersecurity and Infrastructure Security Agency for such pur- poses. (c) Supplement not supplant Amounts in the Fund shall be used to supple- ment, not supplant, other Federal, State, local, or Tribal funding for activities in response to a declaration. (d) Reporting The Secretary shall require an entity that re- ceives amounts from the Fund to submit a re- port to the Secretary that details the specific use of the amounts. (Pub. L. 107–296, title XXII, § 2234, as added Pub. L. 117–58, div. G, title VI, § 70602(a), Nov. 15, 2021, 135 Stat. 1270.) § 677d. Notification and reporting (a) Notification Upon a declaration or renewal, the Secretary shall immediately notify the National Cyber Di- rector and appropriate congressional commit- tees and include in the notification— (1) an estimation of the planned duration of the declaration; (2) with respect to a notification of a dec- laration, the reason for the declaration, in- cluding information relating to the specific significant incident or imminent specific sig- nificant incident, including— (A) the operational or mission impact or anticipated impact of the specific significant incident on Federal and non-Federal enti- ties; (B) if known, the perpetrator of the spe- cific significant incident; and (C) the scope of the Federal and non-Fed- eral entities impacted or anticipated to be impacted by the specific significant inci- dent; (3) with respect to a notification of a re- newal, the reason for the renewal; (4) justification as to why available re- sources, other than the Fund, are insufficient to respond to or mitigate the specific signifi- cant incident; and (5) a description of the coordination activi- ties described in section 677b(b) of this title that the Secretary anticipates the Director to perform. (b) Report to Congress Not later than 180 days after the date of a dec- laration or renewal, the Secretary shall submit to the appropriate congressional committees a report that includes— (1) the reason for the declaration or renewal, including information and intelligence relat- ing to the specific significant incident that led to the declaration or renewal; (2) the use of any funds from the Fund for the purpose of responding to the incident or threat described in paragraph (1); (3) a description of the actions, initiatives, and projects undertaken by the Department and State and local governments and public and private entities in responding to and re- covering from the specific significant incident described in paragraph (1); (4) an accounting of the specific obligations and outlays of the Fund; and (5) an analysis of— (A) the impact of the specific significant incident described in paragraph (1) on Fed- eral and non-Federal entities;