6 U.S.C. § 681c — Voluntary reporting of other cyber inci-

Page 390 TITLE 6—DOMESTIC SECURITY § 681c service to customers to make or facilitate ran- som payments on behalf of covered entities impacted by ransomware attacks and other appropriate entities of the requirements of paragraphs (1), (2), and (3) of subsection (a). (2) Elements The outreach and education campaign under paragraph (1) shall include the following: (A) An overview of the final rule issued pursuant to subsection (b). (B) An overview of mechanisms to submit to the Agency covered cyber incident re- ports, ransom payment reports, and informa- tion relating to the disclosure, retention, and use of covered cyber incident reports and ransom payment reports under this sec- tion. (C) An overview of the protections afforded to covered entities for complying with the requirements under paragraphs (1), (2), and (3) of subsection (a). (D) An overview of the steps taken under section 681d of this title when a covered en- tity is not in compliance with the reporting requirements under subsection (a). (E) Specific outreach to cybersecurity ven- dors, cyber incident response providers, cybersecurity insurance entities, and other entities that may support covered entities. (F) An overview of the privacy and civil liberties requirements in this part. (3) Coordination In conducting the outreach and education campaign required under paragraph (1), the Agency may coordinate with— (A) the Critical Infrastructure Partnership Advisory Council established under section 451 of this title; (B) Information Sharing and Analysis Or- ganizations; (C) trade associations; (D) information sharing and analysis cen- ters; (E) sector coordinating councils; and (F) any other entity as determined appro- priate by the Director. (f) Exemption Sections 3506(c), 3507, 3508, and 3509 of title 44 shall not apply to any action to carry out this section. (g) Rule of construction Nothing in this section shall affect the au- thorities of the Federal Government to imple- ment the requirements of Executive Order 14028 (86 Fed. Reg. 26633; relating to improving the na- tion’s cybersecurity), including changes to the Federal Acquisition Regulations and remedies to include suspension and debarment. (h) Savings provision Nothing in this section shall be construed to supersede or to abrogate, modify, or otherwise limit the authority that is vested in any officer or any agency of the United States Government to regulate or take action with respect to the cybersecurity of an entity. (Pub. L. 107–296, title XXII, § 2242, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1042.) Editorial Notes REFERENCES IN TEXT Section 681(14)(A) of this title, referred to in subsec. (c)(2)(C)(ii), was repealed by section 7143(b)(2)(N)(v) of Pub. L. 117–263. See section 650(22)(A) of this title. Ref- erences to terms defined in this chapter deemed to be references to those terms as defined in section 650 of this title, see section 7143(f)(2) of Pub. L. 117–263, set out as a Rule of Construction note under section 650 of this title. Executive Order 14028, referred to in subsec. (g), is Ex. Ord. No. 14028, May 12, 2021, 86 F.R. 26633, which is set out as a note under section 3551 of Title 44, Public Printing and Documents. § 681c. Voluntary reporting of other cyber inci- dents (a) In general Entities may voluntarily report cyber inci- dents or ransom payments to the Agency that are not required under paragraph (1), (2), or (3) of section 681b(a) of this title, but may enhance the situational awareness of cyber threats. (b) Voluntary provision of additional informa- tion in required reports Covered entities may voluntarily include in reports required under paragraph (1), (2), or (3) of section 681b(a) of this title information that is not required to be included, but may enhance the situational awareness of cyber threats. (c) Application of section 681e of this title Section 681e of this title shall apply in the same manner and to the same extent to reports and information submitted under subsections (a) and (b) as it applies to reports and information submitted under section 681b of this title. (Pub. L. 107–296, title XXII, § 2243, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1049; amended Pub. L. 117–263, div. G, title LXXI, § 7143(e)(1), Dec. 23, 2022, 136 Stat. 3664.) Editorial Notes AMENDMENTS 2022—Subsec. (c). Pub. L. 117–263 added subsec. (c) and struck out former subsec. (c). Prior to amendment, text read as follows: ‘‘The protections under section 681e of this title applicable to reports made under section 681b of this title shall apply in the same manner and to the same extent to reports and information submitted under subsections (a) and (b).’’ § 681d. Noncompliance with required reporting (a) Purpose In the event that a covered entity that is re- quired to submit a report under section 681b(a) of this title fails to comply with the require- ment to report, the Director may obtain infor- mation about the cyber incident or ransom pay- ment by engaging the covered entity directly to request information about the cyber incident or ransom payment, and if the Director is unable to obtain information through such engage- ment, by issuing a subpoena to the covered enti- ty, pursuant to subsection (c), to gather infor- mation sufficient to determine whether a cov- ered cyber incident or ransom payment has oc- curred.