6 U.S.C. § 650 — Definitions

Page 321 TITLE 6—DOMESTIC SECURITY § 650 Homeland Security Act of 2002 which comprises this chapter. SUBCHAPTER XVIII—CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY § 650. Definitions Except as otherwise specifically provided, in this subchapter: (1) Agency The term ‘‘Agency’’ means the Cybersecurity and Infrastructure Security Agency. (2) Appropriate congressional committees The term ‘‘appropriate congressional com- mittees’’ means— (A) the Committee on Homeland Security and Governmental Affairs of the Senate; and (B) the Committee on Homeland Security of the House of Representatives. (3) Cloud service provider The term ‘‘cloud service provider’’ means an entity offering products or services related to cloud computing, as defined by the National Institute of Standards and Technology in NIST Special Publication 800–145 and any amendatory or superseding document relating thereto. (4) Critical infrastructure information The term ‘‘critical infrastructure informa- tion’’ means information not customarily in the public domain and related to the security of critical infrastructure or protected sys- tems— (A) actual, potential, or threatened inter- ference with, attack on, compromise of, or incapacitation of critical infrastructure or protected systems by either physical or com- puter-based attack or other similar conduct (including the misuse of or unauthorized ac- cess to all types of communications and data transmission systems) that violates Federal, State, or local law, harms interstate com- merce of the United States, or threatens public health or safety; (B) the ability of any critical infrastruc- ture or protected system to resist such in- terference, compromise, or incapacitation, including any planned or past assessment, projection, or estimate of the vulnerability of critical infrastructure or a protected sys- tem, including security testing, risk evalua- tion thereto, risk management planning, or risk audit; or (C) any planned or past operational prob- lem or solution regarding critical infrastruc- ture or protected systems, including repair, recovery, reconstruction, insurance, or con- tinuity, to the extent it is related to such in- terference, compromise, or incapacitation. (5) Cyber threat indicator The term ‘‘cyber threat indicator’’ means in- formation that is necessary to describe or identify— (A) malicious reconnaissance, including anomalous patterns of communications that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat or security vulner- ability; (B) a method of defeating a security con- trol or exploitation of a security vulner- ability; (C) a security vulnerability, including anomalous activity that appears to indicate the existence of a security vulnerability; (D) a method of causing a user with legiti- mate access to an information system or in- formation that is stored on, processed by, or transiting an information system to unwit- tingly enable the defeat of a security control or exploitation of a security vulnerability; (E) malicious cyber command and control; (F) the actual or potential harm caused by an incident, including a description of the information exfiltrated as a result of a par- ticular cybersecurity threat; (G) any other attribute of a cybersecurity threat, if disclosure of such attribute is not otherwise prohibited by law; or (H) any combination thereof. (6) Cybersecurity purpose The term ‘‘cybersecurity purpose’’ means the purpose of protecting an information sys- tem or information that is stored on, proc- essed by, or transiting an information system from a cybersecurity threat or security vul- nerability. (7) Cybersecurity risk The term ‘‘cybersecurity risk’’— (A) means threats to and vulnerabilities of information or information systems and any related consequences caused by or resulting from unauthorized access, use, disclosure, degradation, disruption, modification, or de- struction of such information or information systems, including such related con- sequences caused by an act of terrorism; and (B) does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement. (8) Cybersecurity threat (A) In general Except as provided in subparagraph (B), the term ‘‘cybersecurity threat’’ means an action, not protected by the First Amend- ment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an informa- tion system or information that is stored on, processed by, or transiting an information system. (B) Exclusion The term ‘‘cybersecurity threat’’ does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement. (9) Defensive measure (A) In general Except as provided in subparagraph (B), the term ‘‘defensive measure’’ means an ac- tion, device, procedure, signature, tech- nique, or other measure applied to an infor- Page 322 TITLE 6—DOMESTIC SECURITY § 650 1 So in original. Probably should be followed by ‘‘means’’. mation system or information that is stored on, processed by, or transiting an informa- tion system that detects, prevents, or miti- gates a known or suspected cybersecurity threat or security vulnerability. (B) Exclusion The term ‘‘defensive measure’’ does not in- clude a measure that destroys, renders unus- able, provides unauthorized access to, or substantially harms an information system or information stored on, processed by, or transiting such information system not owned by— (i) the private entity, as defined in sec- tion 1501 of this title, operating the meas- ure; or (ii) another entity or Federal entity that is authorized to provide consent and has provided consent to that private entity for operation of such measure. (10) Director The term ‘‘Director’’ means the Director of the Cybersecurity and Infrastructure Security Agency. (11) Homeland Security Enterprise The term ‘‘Homeland Security Enterprise’’ means relevant governmental and nongovern- mental entities involved in homeland security, including Federal, State, local, and Tribal government officials, private sector represent- atives, academics, and other policy experts. (12) Incident The term ‘‘incident’’ means an occurrence that actually or imminently jeopardizes, with- out lawful authority, the integrity, confiden- tiality, or availability of information on an in- formation system, or actually or imminently jeopardizes, without lawful authority, an in- formation system. (13) Information Sharing and Analysis Organi- zation The term ‘‘Information Sharing and Anal- ysis Organization’’ means any formal or infor- mal entity or collaboration created or em- ployed by public or private sector organiza- tions, for purposes of— (A) gathering and analyzing critical infra- structure information, including informa- tion related to cybersecurity risks and inci- dents, in order to better understand security problems and interdependencies related to critical infrastructure, including cybersecurity risks and incidents, and pro- tected systems, so as to ensure the avail- ability, integrity, and reliability thereof; (B) communicating or disclosing critical infrastructure information, including cybersecurity risks and incidents, to help prevent, detect, mitigate, or recover from the effects of an interference, a compromise, or an incapacitation problem related to crit- ical infrastructure, including cybersecurity risks and incidents, or protected systems; and (C) voluntarily disseminating critical in- frastructure information, including cybersecurity risks and incidents, to its members, State, local, and Federal Govern- ments, or any other entities that may be of assistance in carrying out the purposes spec- ified in subparagraphs (A) and (B). (14) Information system The term ‘‘information system’’— (A) has the meaning given the term in sec- tion 3502 of title 44; and (B) includes industrial control systems, such as supervisory control and data acquisi- tion systems, distributed control systems, and programmable logic controllers. (15) Intelligence community The term ‘‘intelligence community’’ has the meaning given the term in section 3003(4) of title 50. (16) Malicious cyber command and control The term ‘‘malicious cyber command and control’’ means a method for unauthorized re- mote identification of, access to, or use of, an information system or information that is stored on, processed by, or transiting an infor- mation system. (17) Malicious reconnaissance The term ‘‘malicious reconnaissance’’ 1 a method for actively probing or passively moni- toring an information system for the purpose of discerning security vulnerabilities of the in- formation system, if such method is associ- ated with a known or suspected cybersecurity threat. (18) Managed service provider The term ‘‘managed service provider’’ means an entity that delivers services, such as net- work, application, infrastructure, or security services, via ongoing and regular support and active administration on the premises of a customer, in the data center of the entity (such as hosting), or in a third party data cen- ter. (19) Monitor The term ‘‘monitor’’ means to acquire, iden- tify, or scan, or to possess, information that is stored on, processed by, or transiting an infor- mation system. (20) National cybersecurity asset response ac- tivities The term ‘‘national cybersecurity asset re- sponse activities’’ means— (A) furnishing cybersecurity technical as- sistance to entities affected by cybersecurity risks to protect assets, miti- gate vulnerabilities, and reduce impacts of cyber incidents; (B) identifying other entities that may be at risk of an incident and assessing risk to the same or similar vulnerabilities; (C) assessing potential cybersecurity risks to a sector or region, including potential cascading effects, and developing courses of action to mitigate such risks; (D) facilitating information sharing and operational coordination with threat re- sponse; and (E) providing guidance on how best to uti- lize Federal resources and capabilities in a Page 323 TITLE 6—DOMESTIC SECURITY § 651 timely, effective manner to speed recovery from cybersecurity risks. (21) National security system The term ‘‘national security system’’ has the meaning given the term in section 11103 of title 40. (22) Ransomware attack The term ‘‘ransomware attack’’— (A) means an incident that includes the use or threat of use of unauthorized or mali- cious code on an information system, or the use or threat of use of another digital mech- anism such as a denial of service attack, to interrupt or disrupt the operations of an in- formation system or compromise the con- fidentiality, availability, or integrity of electronic data stored on, processed by, or transiting an information system to extort a demand for a ransom payment; and (B) does not include any such event in which the demand for payment is— (i) not genuine; or (ii) made in good faith by an entity in re- sponse to a specific request by the owner or operator of the information system. (23) Sector Risk Management Agency The term ‘‘Sector Risk Management Agen- cy’’ means a Federal department or agency, designated by law or Presidential directive, with responsibility for providing institutional knowledge and specialized expertise of a sec- tor, as well as leading, facilitating, or sup- porting programs and associated activities of its designated critical infrastructure sector in the all hazards environment in coordination with the Department. (24) Security control The term ‘‘security control’’ means the man- agement, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integ- rity, and availability of an information sys- tem or its information. (25) Security vulnerability The term ‘‘security vulnerability’’ means any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of a security control. (26) Sharing The term ‘‘sharing’’ (including all conjuga- tions thereof) means providing, receiving, and disseminating (including all conjugations of each such terms). (27) SLTT entity The term ‘‘SLTT entity’’ means a domestic government entity that is a State govern- ment, local government, Tribal government, territorial government, or any subdivision thereof. (28) Supply chain compromise The term ‘‘supply chain compromise’’ means an incident within the supply chain of an in- formation system that an adversary can lever- age, or does leverage, to jeopardize the con- fidentiality, integrity, or availability of the information system or the information the system processes, stores, or transmits, and can occur at any point during the life cycle. (Pub. L. 107–296, title XXII, § 2200, as added Pub. L. 117–263, div. G, title LXXI, § 7143(b)(1), Dec. 23, 2022, 136 Stat. 3654.) Statutory Notes and Related Subsidiaries RULE OF CONSTRUCTION Pub. L. 117–263, div. G, title LXXI, § 7143(f), Dec. 23, 2022, 136 Stat. 3664, provided that: ‘‘(1) INTERPRETATION OF TECHNICAL CORRECTIONS.— Nothing in the amendments made by subsections (a) through (d) [enacting this section and amending sec- tions 195f, 321l, 464, 571, 624, 651 to 652a, 655, 656, 659 to 663, 665, 665b, 665d, 665g, 665i, 671, 681, 1501, 1521, and 1524 of this title, sections 278g–3a and 648 of Title 15, Com- merce and Trade, section 824s–1 of Title 16, Conserva- tion, sections 300hh–10 and 18723 of Title 42, The Public Health and Welfare, section 70101 of Title 46, Shipping, and sections 3049a and 3371a of Title 50, War and Na- tional Defense] shall be construed to alter the authori- ties, responsibilities, functions, or activities of any agency (as such term is defined in section 3502 of title 44, United States Code) or officer or employee of the United States on or before the date of enactment of this Act [Dec. 23, 2022]. ‘‘(2) INTERPRETATION OF REFERENCES TO DEFINITIONS.— Any reference to a term defined in the Homeland Secu- rity Act of 2002 (6 U.S.C. 101 et seq.) on the day before the date of enactment of this Act that is defined in sec- tion 2200 of that Act [6 U.S.C. 650] pursuant to the amendments made under this Act [Pub. L. 117–263, see Tables for classification] shall be deemed to be a ref- erence to that term as defined in section 2200 of the Homeland Security Act of 2002, as added by this Act.’’ PART A—CYBERSECURITY AND INFRASTRUCTURE SECURITY § 651. Definition In this part, the term ‘‘Cybersecurity Advisory Committee’’ means the advisory committee es- tablished under section 665e(a) of this title. (Pub. L. 107–296, title XXII, § 2201, as added Pub. L. 115–278, § 2(a), Nov. 16, 2018, 132 Stat. 4168; amended Pub. L. 116–283, div. H, title XC, § 9002(c)(2)(C), Jan. 1, 2021, 134 Stat. 4772; Pub. L. 117–150, § 2(1), June 21, 2022, 136 Stat. 1295; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(B), Dec. 23, 2022, 136 Stat. 3659.) Editorial Notes AMENDMENTS 2022—Pub. L. 117–263 amended section generally. Prior to amendment, section defined critical infrastructure information, cybersecurity risk, cybersecurity threat, national cybersecurity asset response activities, Sector Risk Management Agency, sharing, and SLTT entity. Par. (7). Pub. L. 117–150 added par. (7). 2021—Par. (5). Pub. L. 116–283 substituted ‘‘Sector Risk Management Agency’’ for ‘‘Sector-Specific Agen- cy’’ in heading and ‘‘Sector Risk Management Agency’’ for ‘‘Sector-Specific Agency’’ in text. Statutory Notes and Related Subsidiaries RULE OF CONSTRUCTION Nothing in amendment made by Pub. L. 117–263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, and references to terms defined in the Homeland Security Act of 2002