6 U.S.C. § 681b — Required reporting of certain cyber inci-

Page 387 TITLE 6—DOMESTIC SECURITY § 681b 1 So in original. Probably should be ‘‘subparagraph’’. § 681b. Required reporting of certain cyber inci- dents (a) In general (1) Covered cyber incident reports (A) In general A covered entity that experiences a cov- ered cyber incident shall report the covered cyber incident to the Agency not later than 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred. (B) Limitation The Director may not require reporting under subparagraph (A) any earlier than 72 hours after the covered entity reasonably believes that a covered cyber incident has occurred. (2) Ransom payment reports (A) In general A covered entity that makes a ransom payment as the result of a ransomware at- tack against the covered entity shall report the payment to the Agency not later than 24 hours after the ransom payment has been made. (B) Application The requirements under subparagraph (A) shall apply even if the ransomware attack is not a covered cyber incident subject to the reporting requirements under paragraph (1). (3) Supplemental reports A covered entity shall promptly submit to the Agency an update or supplement to a pre- viously submitted covered cyber incident re- port if substantial new or different informa- tion becomes available or if the covered entity makes a ransom payment after submitting a covered cyber incident report required under paragraph (1), until such date that such cov- ered entity notifies the Agency that the cov- ered cyber incident at issue has concluded and has been fully mitigated and resolved. (4) Preservation of information Any covered entity subject to requirements of paragraph (1), (2), or (3) shall preserve data relevant to the covered cyber incident or ran- som payment in accordance with procedures established in the final rule issued pursuant to subsection (b). (5) Exceptions (A) Reporting of covered cyber incident with ransom payment If a covered entity is the victim of a cov- ered cyber incident and makes a ransom payment prior to the 72 hour requirement under paragraph (1), such that the reporting requirements under paragraphs (1) and (2) both apply, the covered entity may submit a single report to satisfy the requirements of both paragraphs in accordance with proce- dures established in the final rule issued pursuant to subsection (b). (B) Substantially similar reported informa- tion (i) In general Subject to the limitation described in clause (ii), where the Agency has an agree- ment in place that satisfies the require- ments of section 681g(a) of this title, the requirements under paragraphs (1), (2), and (3) shall not apply to a covered entity re- quired by law, regulation, or contract to report substantially similar information to another Federal agency within a sub- stantially similar timeframe. (ii) Limitation The exemption in clause (i) shall take ef- fect with respect to a covered entity once an agency agreement and sharing mecha- nism is in place between the Agency and the respective Federal agency, pursuant to section 681g(a) of this title. (iii) Rules of construction Nothing in this paragraph shall be con- strued to— (I) exempt a covered entity from the reporting requirements under paragraph (3) unless the supplemental report also meets the requirements of clauses (i) and (ii) of this paragraph; 1 (II) prevent the Agency from con- tacting an entity submitting informa- tion to another Federal agency that is provided to the Agency pursuant to sec- tion 681g of this title; or (III) prevent an entity from commu- nicating with the Agency. (C) Domain name system The requirements under paragraphs (1), (2) and (3) shall not apply to a covered entity or the functions of a covered entity that the Director determines constitute critical in- frastructure owned, operated, or governed by multi-stakeholder organizations that de- velop, implement, and enforce policies con- cerning the Domain Name System, such as the Internet Corporation for Assigned Names and Numbers or the Internet Assigned Num- bers Authority. (6) Manner, timing, and form of reports Reports made under paragraphs (1), (2), and (3) shall be made in the manner and form, and within the time period in the case of reports made under paragraph (3), prescribed in the final rule issued pursuant to subsection (b). (7) Effective date Paragraphs (1) through (4) shall take effect on the dates prescribed in the final rule issued pursuant to subsection (b). (b) Rulemaking (1) Notice of proposed rulemaking Not later than 24 months after March 15, 2022, the Director, in consultation with Sector Risk Management Agencies, the Department of Justice, and other Federal agencies, shall publish in the Federal Register a notice of pro- posed rulemaking to implement subsection (a). (2) Final rule Not later than 18 months after publication of the notice of proposed rulemaking under para- graph (1), the Director shall issue a final rule to implement subsection (a). Page 388 TITLE 6—DOMESTIC SECURITY § 681b 2 So in original. Probably should be followed by a dash. 3 See References in Text note below. (3) Subsequent rulemakings (A) In general The Director is authorized to issue regula- tions to amend or revise the final rule issued pursuant to paragraph (2). (B) Procedures Any subsequent rules issued under sub- paragraph (A) shall comply with the require- ments under chapter 5 of title 5, including the issuance of a notice of proposed rule- making under section 553 of such title. (c) Elements The final rule issued pursuant to subsection (b) shall be composed of the following elements: (1) A clear description of the types of enti- ties that constitute covered entities, based on— (A) the consequences that disruption to or compromise of such an entity could cause to national security, economic security, or public health and safety; (B) the likelihood that such an entity may be targeted by a malicious cyber actor, in- cluding a foreign country; and (C) the extent to which damage, disrup- tion, or unauthorized access to such an enti- ty, including the accessing of sensitive cybersecurity vulnerability information or penetration testing tools or techniques, will likely enable the disruption of the reliable operation of critical infrastructure. (2) A clear description of the types of sub- stantial cyber incidents that constitute cov- ered cyber incidents, which shall— (A) at a minimum, require the occurrence of— (i) a cyber incident that leads to sub- stantial loss of confidentiality, integrity, or availability of such information system or network, or a serious impact on the safety and resiliency of operational sys- tems and processes; (ii) a disruption of business or industrial operations, including due to a denial of service attack, ransomware attack, or ex- ploitation of a zero day vulnerability, against 2 (I) an information system or network; or (II) an operational technology system or process; or (iii) unauthorized access or disruption of business or industrial operations due to loss of service facilitated through, or caused by, a compromise of a cloud service provider, managed service provider, or other third-party data hosting provider or by a supply chain compromise; (B) consider— (i) the sophistication or novelty of the tactics used to perpetrate such a cyber in- cident, as well as the type, volume, and sensitivity of the data at issue; (ii) the number of individuals directly or indirectly affected or potentially affected by such a cyber incident; and (iii) potential impacts on industrial con- trol systems, such as supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers; and (C) exclude— (i) any event where the cyber incident is perpetrated in good faith by an entity in response to a specific request by the owner or operator of the information system; and (ii) the threat of disruption as extortion, as described in section 681(14)(A) 3 of this title. (3) A requirement that, if a covered cyber in- cident or a ransom payment occurs following an exempted threat described in paragraph (2)(C)(ii), the covered entity shall comply with the requirements in this part in reporting the covered cyber incident or ransom payment. (4) A clear description of the specific re- quired contents of a report pursuant to sub- section (a)(1), which shall include the fol- lowing information, to the extent applicable and available, with respect to a covered cyber incident: (A) A description of the covered cyber inci- dent, including— (i) identification and a description of the function of the affected information sys- tems, networks, or devices that were, or are reasonably believed to have been, af- fected by such cyber incident; (ii) a description of the unauthorized ac- cess with substantial loss of confiden- tiality, integrity, or availability of the af- fected information system or network or disruption of business or industrial oper- ations; (iii) the estimated date range of such in- cident; and (iv) the impact to the operations of the covered entity. (B) Where applicable, a description of the vulnerabilities exploited and the security de- fenses that were in place, as well as the tac- tics, techniques, and procedures used to per- petrate the covered cyber incident. (C) Where applicable, any identifying or contact information related to each actor reasonably believed to be responsible for such cyber incident. (D) Where applicable, identification of the category or categories of information that were, or are reasonably believed to have been, accessed or acquired by an unauthor- ized person. (E) The name and other information that clearly identifies the covered entity im- pacted by the covered cyber incident, includ- ing, as applicable, the State of incorporation or formation of the covered entity, trade names, legal names, or other identifiers. (F) Contact information, such as telephone number or electronic mail address, that the Agency may use to contact the covered enti- ty or an authorized agent of such covered en- tity, or, where applicable, the service pro- vider of such covered entity acting with the Page 389 TITLE 6—DOMESTIC SECURITY § 681b 4 So in original. Probably should be ‘‘subsection’’. express permission of, and at the direction of, the covered entity to assist with compli- ance with the requirements of this part. (5) A clear description of the specific re- quired contents of a report pursuant to sub- section (a)(2), which shall be the following in- formation, to the extent applicable and avail- able, with respect to a ransom payment: (A) A description of the ransomware at- tack, including the estimated date range of the attack. (B) Where applicable, a description of the vulnerabilities, tactics, techniques, and pro- cedures used to perpetrate the ransomware attack. (C) Where applicable, any identifying or contact information related to the actor or actors reasonably believed to be responsible for the ransomware attack. (D) The name and other information that clearly identifies the covered entity that made the ransom payment or on whose be- half the payment was made. (E) Contact information, such as telephone number or electronic mail address, that the Agency may use to contact the covered enti- ty that made the ransom payment or an au- thorized agent of such covered entity, or, where applicable, the service provider of such covered entity acting with the express permission of, and at the direction of, that covered entity to assist with compliance with the requirements of this part. (F) The date of the ransom payment. (G) The ransom payment demand, includ- ing the type of virtual currency or other commodity requested, if applicable. (H) The ransom payment instructions, in- cluding information regarding where to send the payment, such as the virtual currency address or physical address the funds were requested to be sent to, if applicable. (I) The amount of the ransom payment. (6) A clear description of the types of data required to be preserved pursuant to sub- section (a)(4), the period of time for which the data is required to be preserved, and allowable uses, processes, and procedures. (7) Deadlines and criteria for submitting supplemental reports to the Agency required under subsection (a)(3), which shall— (A) be established by the Director in con- sultation with the Council; (B) consider any existing regulatory re- porting requirements similar in scope, pur- pose, and timing to the reporting require- ments to which such a covered entity may also be subject, and make efforts to har- monize the timing and contents of any such reports to the maximum extent practicable; (C) balance the need for situational aware- ness with the ability of the covered entity to conduct cyber incident response and inves- tigations; and (D) provide a clear description of what constitutes substantial new or different in- formation. (8) Procedures for— (A) entities, including third parties pursu- ant to subsection (d)(1), to submit reports re- quired by paragraphs (1), (2), and (3) of sub- section (a), including the manner and form thereof, which shall include, at a minimum, a concise, user-friendly web-based form; (B) the Agency to carry out— (i) the enforcement provisions of section 681d of this title, including with respect to the issuance, service, withdrawal, referral process, and enforcement of subpoenas, ap- peals and due process procedures; (ii) other available enforcement mecha- nisms including acquisition, suspension and debarment procedures; and (iii) other aspects of noncompliance; (C) implementing the exceptions provided in subsection (a)(5); and (D) protecting privacy and civil liberties consistent with processes adopted pursuant to section 1504(b) of this title and anonymizing and safeguarding, or no longer retaining, information received and dis- closed through covered cyber incident re- ports and ransom payment reports that is known to be personal information of a spe- cific individual or information that identi- fies a specific individual that is not directly related to a cybersecurity threat. (9) Other procedural measures directly nec- essary to implement subsection (a). (d) Third party report submission and ransom payment (1) Report submission A covered entity that is required to submit a covered cyber incident report or a ransom payment report may use a third party, such as an incident response company, insurance pro- vider, service provider, Information Sharing and Analysis Organization, or law firm, to sub- mit the required report under subsection (a). (2) Ransom payment If a covered entity impacted by a ransomware attack uses a third party to make a ransom payment, the third party shall not be required to submit a ransom payment re- port for itself under subsection (a)(2). (3) Duty to report Third-party reporting under this subpara- graph 4 does not relieve a covered entity from the duty to comply with the requirements for covered cyber incident report or ransom pay- ment report submission. (4) Responsibility to advise Any third party used by a covered entity that knowingly makes a ransom payment on behalf of a covered entity impacted by a ransomware attack shall advise the impacted covered entity of the responsibilities of the impacted covered entity regarding reporting ransom payments under this section. (e) Outreach to covered entities (1) In general The Agency shall conduct an outreach and education campaign to inform likely covered entities, entities that offer or advertise as a Page 390 TITLE 6—DOMESTIC SECURITY § 681c service to customers to make or facilitate ran- som payments on behalf of covered entities impacted by ransomware attacks and other appropriate entities of the requirements of paragraphs (1), (2), and (3) of subsection (a). (2) Elements The outreach and education campaign under paragraph (1) shall include the following: (A) An overview of the final rule issued pursuant to subsection (b). (B) An overview of mechanisms to submit to the Agency covered cyber incident re- ports, ransom payment reports, and informa- tion relating to the disclosure, retention, and use of covered cyber incident reports and ransom payment reports under this sec- tion. (C) An overview of the protections afforded to covered entities for complying with the requirements under paragraphs (1), (2), and (3) of subsection (a). (D) An overview of the steps taken under section 681d of this title when a covered en- tity is not in compliance with the reporting requirements under subsection (a). (E) Specific outreach to cybersecurity ven- dors, cyber incident response providers, cybersecurity insurance entities, and other entities that may support covered entities. (F) An overview of the privacy and civil liberties requirements in this part. (3) Coordination In conducting the outreach and education campaign required under paragraph (1), the Agency may coordinate with— (A) the Critical Infrastructure Partnership Advisory Council established under section 451 of this title; (B) Information Sharing and Analysis Or- ganizations; (C) trade associations; (D) information sharing and analysis cen- ters; (E) sector coordinating councils; and (F) any other entity as determined appro- priate by the Director. (f) Exemption Sections 3506(c), 3507, 3508, and 3509 of title 44 shall not apply to any action to carry out this section. (g) Rule of construction Nothing in this section shall affect the au- thorities of the Federal Government to imple- ment the requirements of Executive Order 14028 (86 Fed. Reg. 26633; relating to improving the na- tion’s cybersecurity), including changes to the Federal Acquisition Regulations and remedies to include suspension and debarment. (h) Savings provision Nothing in this section shall be construed to supersede or to abrogate, modify, or otherwise limit the authority that is vested in any officer or any agency of the United States Government to regulate or take action with respect to the cybersecurity of an entity. (Pub. L. 107–296, title XXII, § 2242, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1042.) Editorial Notes REFERENCES IN TEXT Section 681(14)(A) of this title, referred to in subsec. (c)(2)(C)(ii), was repealed by section 7143(b)(2)(N)(v) of Pub. L. 117–263. See section 650(22)(A) of this title. Ref- erences to terms defined in this chapter deemed to be references to those terms as defined in section 650 of this title, see section 7143(f)(2) of Pub. L. 117–263, set out as a Rule of Construction note under section 650 of this title. Executive Order 14028, referred to in subsec. (g), is Ex. Ord. No. 14028, May 12, 2021, 86 F.R. 26633, which is set out as a note under section 3551 of Title 44, Public Printing and Documents. § 681c. Voluntary reporting of other cyber inci- dents (a) In general Entities may voluntarily report cyber inci- dents or ransom payments to the Agency that are not required under paragraph (1), (2), or (3) of section 681b(a) of this title, but may enhance the situational awareness of cyber threats. (b) Voluntary provision of additional informa- tion in required reports Covered entities may voluntarily include in reports required under paragraph (1), (2), or (3) of section 681b(a) of this title information that is not required to be included, but may enhance the situational awareness of cyber threats. (c) Application of section 681e of this title Section 681e of this title shall apply in the same manner and to the same extent to reports and information submitted under subsections (a) and (b) as it applies to reports and information submitted under section 681b of this title. (Pub. L. 107–296, title XXII, § 2243, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1049; amended Pub. L. 117–263, div. G, title LXXI, § 7143(e)(1), Dec. 23, 2022, 136 Stat. 3664.) Editorial Notes AMENDMENTS 2022—Subsec. (c). Pub. L. 117–263 added subsec. (c) and struck out former subsec. (c). Prior to amendment, text read as follows: ‘‘The protections under section 681e of this title applicable to reports made under section 681b of this title shall apply in the same manner and to the same extent to reports and information submitted under subsections (a) and (b).’’ § 681d. Noncompliance with required reporting (a) Purpose In the event that a covered entity that is re- quired to submit a report under section 681b(a) of this title fails to comply with the require- ment to report, the Director may obtain infor- mation about the cyber incident or ransom pay- ment by engaging the covered entity directly to request information about the cyber incident or ransom payment, and if the Director is unable to obtain information through such engage- ment, by issuing a subpoena to the covered enti- ty, pursuant to subsection (c), to gather infor- mation sufficient to determine whether a cov- ered cyber incident or ransom payment has oc- curred.