6 U.S.C. § 665i — CyberSentry program

Page 372 TITLE 6—DOMESTIC SECURITY § 665h § 665h. National Cyber Exercise Program (a) Establishment of program (1) In general There is established in the Agency the Na- tional Cyber Exercise Program (referred to in this section as the ‘‘Exercise Program’’) to evaluate the National Cyber Incident Re- sponse Plan, and other related plans and strat- egies. (2) Requirements (A) In general The Exercise Program shall be— (i) based on current risk assessments, in- cluding credible threats, vulnerabilities, and consequences; (ii) designed, to the extent practicable, to simulate the partial or complete inca- pacitation of a government or critical in- frastructure network resulting from a cyber incident; (iii) designed to provide for the system- atic evaluation of cyber readiness and en- hance operational understanding of the cyber incident response system and rel- evant information sharing agreements; and (iv) designed to promptly develop after- action reports and plans that can quickly incorporate lessons learned into future op- erations. (B) Model exercise selection The Exercise Program shall— (i) include a selection of model exercises that government and private entities can readily adapt for use; and (ii) aid such governments and private en- tities with the design, implementation, and evaluation of exercises that— (I) conform to the requirements de- scribed in subparagraph (A); (II) are consistent with any applicable national, State, local, or Tribal strategy or plan; and (III) provide for systematic evaluation of readiness. (3) Consultation In carrying out the Exercise Program, the Director may consult with appropriate rep- resentatives from Sector Risk Management Agencies, the Office of the National Cyber Di- rector, cybersecurity research stakeholders, and Sector Coordinating Councils. (b) Definitions In this section: (1) State The term ‘‘State’’ means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the Northern Mariana Islands, the United States Virgin Is- lands, Guam, American Samoa, and any other territory or possession of the United States. (2) Private entity The term ‘‘private entity’’ has the meaning given such term in section 1501 of this title. (c) Rule of construction Nothing in this section shall be construed to affect the authorities or responsibilities of the Administrator of the Federal Emergency Man- agement Agency pursuant to section 748 of this title. (Pub. L. 107–296, title XXII, § 2220B, as added Pub. L. 117–81, div. A, title XV, § 1547(a), Dec. 27, 2021, 135 Stat. 2059.) § 665i. CyberSentry program (a) Establishment There is established in the Agency a program, to be known as ‘‘CyberSentry’’, to provide con- tinuous monitoring and detection of cybersecurity risks to critical infrastructure en- tities that own or operate industrial control sys- tems that support national critical functions, upon request and subject to the consent of such owner or operator. (b) Activities The Director, through CyberSentry, shall— (1) enter into strategic partnerships with critical infrastructure owners and operators that, in the determination of the Director and subject to the availability of resources, own or operate regionally or nationally significant in- dustrial control systems that support national critical functions, in order to provide tech- nical assistance in the form of continuous monitoring of industrial control systems and the information systems that support such systems and detection of cybersecurity risks to such industrial control systems and other cybersecurity services, as appropriate, based on and subject to the agreement and consent of such owner or operator; (2) leverage sensitive or classified intel- ligence about cybersecurity risks regarding particular sectors, particular adversaries, and trends in tactics, techniques, and procedures to advise critical infrastructure owners and operators regarding mitigation measures and share information as appropriate; (3) identify cybersecurity risks in the infor- mation technology and information systems that support industrial control systems which could be exploited by adversaries attempting to gain access to such industrial control sys- tems, and work with owners and operators to remediate such vulnerabilities; (4) produce aggregated, anonymized analytic products, based on threat hunting and contin- uous monitoring and detection activities and partnerships, with findings and recommenda- tions that can be disseminated to critical in- frastructure owners and operators; and (5) support activities authorized in accord- ance with section 1501 of the National Defense Authorization Act for Fiscal Year 2022. (c) Privacy review Not later than 180 days after December 27, 2021, the Privacy Officer of the Agency under section 652(h) of this title shall— (1) review the policies, guidelines, and ac- tivities of CyberSentry for compliance with all applicable privacy laws, including such laws governing the acquisition, interception, reten- tion, use, and disclosure of communities; and (2) submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Page 373 TITLE 6—DOMESTIC SECURITY § 665j 1 So in original. Governmental Affairs of the Senate a report certifying compliance with all applicable pri- vacy laws as referred to in paragraph (1), or identifying any instances of noncompliance with such privacy laws. (d) Report to Congress Not later than one year after December 27, 2021, the Director shall provide to the Com- mittee on Homeland Security of the House of Representatives and the Committee on Home- land Security and Governmental Affairs of the Senate a briefing and written report on imple- mentation of this section. (e) Savings Nothing in this section may be construed to permit the Federal Government to gain access to information of a remote computing service provider to the public or an electronic service provider to the public, the disclosure of which is not permitted under section 2702 of title 18. (f) Definition In this section, the term ‘‘industrial control system’’ means an information system used to monitor and/or control industrial processes such as manufacturing, product handling, production, and distribution, including supervisory control and data acquisition (SCADA) systems used to monitor and/or control geographically dispersed assets, distributed control systems (DCSs), Human-Machine Interfaces (HMIs), and pro- grammable logic controllers that control local- ized processes. (g) Termination The authority to carry out a program under this section shall terminate on the date that is seven years after December 27, 2021. (Pub. L. 107–296, title XXII, § 2220C, as added Pub. L. 117–81, div. A, title XV, § 1548(a), Dec. 27, 2021, 135 Stat. 2061; amended Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(L), Dec. 23, 2022, 136 Stat. 3661.) Editorial Notes REFERENCES IN TEXT Section 1501 of the National Defense Authorization Act for Fiscal Year 2022, referred to in subsec. (b)(5), is section 1501 of Pub. L. 117–81, div. A, title XV, Dec. 27, 2021, 135 Stat. 2020, related to development of taxonomy of cyber capabilities, which is not classified to the Code. CODIFICATION Section 1548(a) of Pub. L. 117–81, which directed that this section be added at the end of title XXII of the Homeland Security Act of 2002, was executed by adding this section at the end of this part as if the directory language had added the section at the end of subtitle A of title XXII of the Act, to reflect the probable intent of Congress. AMENDMENTS 2022—Subsec. (f). Pub. L. 117–263 added subsec. (f) and struck out former subsec. (f) which defined cybersecurity risk, industrial control system, and in- formation system. § 665j. Ransomware threat mitigation activities (a) Joint Ransomware Task Force (1) In general Not later than 180 days after March 15, 2022, the Director, in consultation with the Na- tional Cyber Director, the Attorney General, and the Director of the Federal Bureau of In- vestigation, shall establish and chair the Joint Ransomware Task Force to coordinate an on- going nationwide campaign against ransomware attacks, and identify and pursue opportunities for international cooperation. (2) Composition The Joint Ransomware Task Force shall consist of participants from Federal agencies, as determined appropriate by the National Cyber Director in consultation with the Sec- retary of Homeland Security. (3) Responsibilities The Joint Ransomware Task Force, utilizing only existing authorities of each participating Federal agency, shall coordinate across the Federal Government the following activities: (A) Prioritization of intelligence-driven operations to disrupt specific ransomware actors. (B) Consult with relevant private sector, State, local, Tribal, and territorial govern- ments and international stakeholders to identify needs and establish mechanisms for providing input into the Joint Ransomware Task Force. (C) Identifying, in consultation with rel- evant entities, a list of highest threat ransomware entities updated on an ongoing basis, in order to facilitate— (i) prioritization for Federal action by appropriate Federal agencies; and (ii) identify 1 metrics for success of said actions. (D) Disrupting ransomware criminal ac- tors, associated infrastructure, and their fi- nances. (E) Facilitating coordination and collabo- ration between Federal entities and relevant entities, including the private sector, to im- prove Federal actions against ransomware threats. (F) Collection, sharing, and analysis of ransomware trends to inform Federal ac- tions. (G) Creation of after-action reports and other lessons learned from Federal actions that identify successes and failures to im- prove subsequent actions. (H) Any other activities determined appro- priate by the Joint Ransomware Task Force to mitigate the threat of ransomware at- tacks. (b) Rule of construction Nothing in this section shall be construed to provide any additional authority to any Federal agency. (Pub. L. 117–103, div. Y, § 106, Mar. 15, 2022, 136 Stat. 1056.) Editorial Notes CODIFICATION Section was enacted as part of the Cyber Incident Re- porting for Critical Infrastructure Act of 2022 and also