6 U.S.C. § 659 — National cybersecurity and communica-

Page 340 TITLE 6—DOMESTIC SECURITY § 659 Capital Region (as defined in section 2674 of title 10) to serve the Federal and national need to— (1) the Subcommittee on Homeland Security of the Committee on Appropriations and the Committee on Homeland Security and Govern- mental Affairs of the Senate; and (2) the Subcommittee on Homeland Security of the Committee on Appropriations and the Committee on Homeland Security of the House of Representatives. (Pub. L. 107–296, title XXII, § 2208, formerly title II, § 226, as added Pub. L. 113–277, § 3(a), Dec. 18, 2014, 128 Stat. 3005; renumbered title XXII, § 2208, Pub. L. 115–278, § 2(g)(2)(I), Nov. 16, 2018, 132 Stat. 4178.) Editorial Notes CODIFICATION Section was formerly classified to section 147 of this title prior to renumbering by Pub. L. 115–278. Statutory Notes and Related Subsidiaries CHANGE OF NAME Reference to National Protection and Programs Di- rectorate of the Department of Homeland Security deemed to be a reference to the Cybersecurity and In- frastructure Security Agency of the Department, see section 652(a)(2) of this title, enacted Nov. 16, 2018. § 659. National cybersecurity and communica- tions integration center (a) Definition The term ‘‘cybersecurity vulnerability’’ has the meaning given the term ‘‘security vulner- ability’’ in section 650 of this title. (b) Center There is in the Department a national cybersecurity and communications integration center (referred to in this section as the ‘‘Cen- ter’’) to carry out certain responsibilities of the Director. The Center shall be located in the Cybersecurity and Infrastructure Security Agency. The head of the Center shall report to the Executive Assistant Director for Cybersecurity. (c) Functions The cybersecurity functions of the Center shall include— (1) being a Federal civilian interface for the multi-directional and cross-sector sharing of information related to cyber threat indicators, defensive measures, cybersecurity risks, inci- dents, analysis, and warnings for Federal and non-Federal entities, including the implemen- tation of title I of the Cybersecurity Act of 2015 [6 U.S.C. 1501 et seq.]; (2) providing shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government and non-Federal entities to address cybersecurity risks and incidents to Federal and non-Federal entities; (3) coordinating the sharing of information related to cyber threat indicators, defensive measures, cybersecurity risks, and incidents across the Federal Government; (4) facilitating cross-sector coordination to address cybersecurity risks and incidents, in- cluding cybersecurity risks and incidents that may be related or could have consequential impacts across multiple sectors; (5)(A) conducting integration and analysis, including cross-sector integration and anal- ysis, of cyber threat indicators, defensive measures, cybersecurity risks, and incidents; (B) sharing mitigation protocols to counter cybersecurity vulnerabilities pursuant to sub- section (n), as appropriate; and (C) sharing the analysis conducted under subparagraph (A) and mitigation protocols to counter cybersecurity vulnerabilities in ac- cordance with subparagraph (B), as appro- priate, with Federal and non-Federal entities; (6) upon request, providing operational and timely technical assistance, risk management support, and incident response capabilities to Federal and non-Federal entities with respect to cyber threat indicators, defensive measures, cybersecurity risks, and incidents, which may include attribution, mitigation, and remedi- ation, which may take the form of continuous monitoring and detection of cybersecurity risks to critical infrastructure entities that own or operate industrial control systems that support national critical functions; (7) providing information and recommenda- tions on security and resilience measures to Federal and non-Federal entities, including in- formation and recommendations to— (A) facilitate information security; (B) strengthen information systems against cybersecurity risks and incidents; and (C) share cyber threat indicators and de- fensive measures; (8) engaging with international partners, in consultation with other appropriate agencies, to— (A) collaborate on cyber threat indicators, defensive measures, and information related to cybersecurity risks and incidents; and (B) enhance the security and resilience of global cybersecurity; (9) sharing cyber threat indicators, defensive measures, mitigation protocols to counter cybersecurity vulnerabilities, as appropriate, and other information related to cybersecurity risks and incidents with Federal and non-Federal entities, including across sec- tors of critical infrastructure and with State and major urban area fusion centers, as appro- priate; (10) participating, as appropriate, in na- tional exercises run by the Department; (11) in coordination with the Emergency Communications Division of the Department, assessing and evaluating consequence, vulner- ability, and threat information regarding cyber incidents to public safety communica- tions to help facilitate continuous improve- ments to the security and resiliency of such communications; (12) detecting, identifying, and receiving in- formation for a cybersecurity purpose about security vulnerabilities relating to critical in- frastructure in information systems and de- vices; and (13) receiving, aggregating, and analyzing re- ports related to covered cyber incidents (as de- Page 341 TITLE 6—DOMESTIC SECURITY § 659 fined in section 681 of this title) submitted by covered entities (as defined in section 681 of this title) and reports related to ransom pay- ments (as defined in section 681 of this title) submitted by covered entities (as defined in section 681 of this title) in furtherance of the activities specified in sections 652(e), 653, and 681a of this title, this subsection, and any other authorized activity of the Director, to enhance the situational awareness of cybersecurity threats across critical infra- structure sectors. (d) Composition (1) In general The Center shall be composed of— (A) appropriate representatives of Federal entities, such as— (i) sector-specific agencies; (ii) civilian and law enforcement agen- cies; and (iii) elements of the intelligence commu- nity; (B) appropriate representatives of non- Federal entities, such as— (i) State, local, and tribal governments; (ii) Information Sharing and Analysis Organizations, including information shar- ing and analysis centers; (iii) owners and operators of critical in- formation systems; and (iv) private entities, including cybersecurity specialists; (C) components within the Center that carry out cybersecurity and communica- tions activities; (D) a designated Federal official for oper- ational coordination with and across each sector; (E) an entity that collaborates with State and local governments, including an entity that collaborates with election officials, on cybersecurity risks and incidents, and has entered into a voluntary information shar- ing relationship with the Center; and (F) other appropriate representatives or entities, as determined by the Secretary. (2) Incidents In the event of an incident, during exigent circumstances the Secretary may grant a Fed- eral or non-Federal entity immediate tem- porary access to the Center. (e) Principles In carrying out the functions under subsection (c), the Center shall ensure— (1) to the extent practicable, that— (A) timely, actionable, and relevant cyber threat indicators, defensive measures, and information related to cybersecurity risks, incidents, and analysis is shared; (B) when appropriate, cyber threat indica- tors, defensive measures, and information related to cybersecurity risks, incidents, and analysis is integrated with other relevant information and tailored to the specific characteristics of a sector; (C) activities are prioritized and conducted based on the level of risk; (D) industry sector-specific, academic, and national laboratory expertise is sought and receives appropriate consideration; (E) continuous, collaborative, and inclu- sive coordination occurs— (i) across sectors; and (ii) with— (I) sector coordinating councils; (II) Information Sharing and Analysis Organizations; and (III) other appropriate non-Federal partners; (F) as appropriate, the Center works to de- velop and use mechanisms for sharing infor- mation related to cyber threat indicators, defensive measures, cybersecurity risks, and incidents that are technology-neutral, inter- operable, real-time, cost-effective, and resil- ient; (G) the Center works with other agencies to reduce unnecessarily duplicative sharing of information related to cyber threat indi- cators, defensive measures, cybersecurity risks, and incidents; (H) the Center designates an agency con- tact for non-Federal entities; and (I) activities of the Center address the se- curity of both information technology and operational technology, including industrial control systems; (2) that information related to cyber threat indicators, defensive measures, cybersecurity risks, and incidents is appropriately safe- guarded against unauthorized access or disclo- sure; and (3) that activities conducted by the Center comply with all policies, regulations, and laws that protect the privacy and civil liberties of United States persons, including by working with the Privacy Officer appointed under sec- tion 142 of this title to ensure that the Center follows the policies and procedures specified in subsections (b) and (d)(5)(C) of section 105 of the Cybersecurity Act of 2015 [6 U.S.C. 1504]. (f) Cyber hunt and incident response teams (1) In general The Center shall maintain cyber hunt and incident response teams for the purpose of leading Federal asset response activities and providing timely technical assistance to Fed- eral and non-Federal entities, including across all critical infrastructure sectors, regarding actual or potential security incidents, as ap- propriate and upon request, including— (A) assistance to asset owners and opera- tors in restoring services following a cyber incident; (B) identification and analysis of cybersecurity risk and unauthorized cyber activity; (C) mitigation strategies to prevent, deter, and protect against cybersecurity risks; (D) recommendations to asset owners and operators for improving overall network and control systems security to lower cybersecurity risks, and other recommenda- tions, as appropriate; and (E) such other capabilities as the Sec- retary determines appropriate. (2) Associated metrics The Center shall— Page 342 TITLE 6—DOMESTIC SECURITY § 659 (A) define the goals and desired outcomes for each cyber hunt and incident response team; and (B) develop metrics— (i) to measure the effectiveness and effi- ciency of each cyber hunt and incident re- sponse team in achieving the goals and de- sired outcomes defined under subpara- graph (A); and (ii) that— (I) are quantifiable and actionable; and (II) the Center shall use to improve the effectiveness and accountability of, and service delivery by, cyber hunt and inci- dent response teams. (3) Cybersecurity specialists After notice to, and with the approval of, the entity requesting action by or technical as- sistance from the Center, the Secretary may include cybersecurity specialists from the pri- vate sector on a cyber hunt and incident re- sponse team. (g) No right or benefit (1) In general The provision of assistance or information to, and inclusion in the Center, or any team or activity of the Center, of, governmental or pri- vate entities under this section shall be at the sole and unreviewable discretion of the Direc- tor. (2) Certain assistance or information The provision of certain assistance or infor- mation to, or inclusion in the Center, or any team or activity of the Center, of, one govern- mental or private entity pursuant to this sec- tion shall not create a right or benefit, sub- stantive or procedural, to similar assistance or information for any other governmental or private entity. (h) Automated information sharing (1) In general The Director, in coordination with industry and other stakeholders, shall develop capabili- ties making use of existing information tech- nology industry standards and best practices, as appropriate, that support and rapidly ad- vance the development, adoption, and imple- mentation of automated mechanisms for the sharing of cyber threat indicators and defen- sive measures in accordance with title I of the Cybersecurity Act of 2015 [6 U.S.C. 1501 et seq.]. (2) Annual report The Director shall submit to the Committee on Homeland Security and Governmental Af- fairs of the Senate and the Committee on Homeland Security of the House of Represent- atives an annual report on the status and progress of the development of the capabilities described in paragraph (1). Such reports shall be required until such capabilities are fully implemented. (i) Voluntary information sharing procedures (1) Procedures (A) In general The Center may enter into a voluntary in- formation sharing relationship with any consenting non-Federal entity for the shar- ing of cyber threat indicators and defensive measures for cybersecurity purposes in ac- cordance with this section. Nothing in this subsection may be construed to require any non-Federal entity to enter into any such in- formation sharing relationship with the Cen- ter or any other entity. The Center may ter- minate a voluntary information sharing re- lationship under this subsection, at the sole and unreviewable discretion of the Sec- retary, acting through the Director, for any reason, including if the Center determines that the non-Federal entity with which the Center has entered into such a relationship has violated the terms of this subsection. (B) National security The Secretary may decline to enter into a voluntary information sharing relationship under this subsection, at the sole and unreviewable discretion of the Secretary, acting through the Director, for any reason, including if the Secretary determines that such is appropriate for national security. (2) Voluntary information sharing relation- ships A voluntary information sharing relation- ship under this subsection may be character- ized as an agreement described in this para- graph. (A) Standard agreement For the use of a non-Federal entity, the Center shall make available a standard agreement, consistent with this section, on the Department’s website. (B) Negotiated agreement At the request of a non-Federal entity, and if determined appropriate by the Center, at the sole and unreviewable discretion of the Secretary, acting through the Director, the Department shall negotiate a non-standard agreement, consistent with this section. (C) Existing agreements An agreement between the Center and a non-Federal entity that is entered into be- fore December 18, 2015, or such an agreement that is in effect before such date, shall be deemed in compliance with the requirements of this subsection, notwithstanding any other provision or requirement of this sub- section. An agreement under this subsection shall include the relevant privacy protec- tions as in effect under the Cooperative Re- search and Development Agreement for Cybersecurity Information Sharing and Col- laboration, as of December 31, 2014. Nothing in this subsection may be construed to re- quire a non-Federal entity to enter into ei- ther a standard or negotiated agreement to be in compliance with this subsection. (j) Direct reporting The Secretary shall develop policies and pro- cedures for direct reporting to the Secretary by the Director of the Center regarding significant cybersecurity risks and incidents. (k) Reports on international cooperation Not later than 180 days after December 18, 2015, and periodically thereafter, the Secretary Page 343 TITLE 6—DOMESTIC SECURITY § 659 of Homeland Security shall submit to the Com- mittee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representa- tives a report on the range of efforts underway to bolster cybersecurity collaboration with rel- evant international partners in accordance with subsection (c)(8). (l) Outreach Not later than 60 days after December 18, 2015, the Secretary, acting through the Director, shall— (1) disseminate to the public information about how to voluntarily share cyber threat indicators and defensive measures with the Center; and (2) enhance outreach to critical infrastruc- ture owners and operators for purposes of such sharing. (m) Cybersecurity outreach (1) In general The Secretary may leverage small business development centers to provide assistance to small business concerns by disseminating in- formation on cyber threat indicators, defense measures, cybersecurity risks, incidents, anal- yses, and warnings to help small business con- cerns in developing or enhancing cybersecurity infrastructure, awareness of cyber threat indicators, and cyber training programs for employees. (2) Definitions For purposes of this subsection, the terms ‘‘small business concern’’ and ‘‘small business development center’’ have the meaning given such terms, respectively, under section 632 of title 15. (n) Coordinated vulnerability disclosure The Secretary, in coordination with industry and other stakeholders, may develop and adhere to Department policies and procedures for co- ordinating vulnerability disclosures. (o) Protocols to counter certain cybersecurity vulnerabilities The Director may, as appropriate, identify, de- velop, and disseminate actionable protocols to mitigate cybersecurity vulnerabilities to infor- mation systems and industrial control systems, including in circumstances in which such vulnerabilities exist because software or hard- ware is no longer supported by a vendor. (p) Subpoena authority (1) Definition In this subsection, the term ‘‘covered device or system’’— (A) means a device or system commonly used to perform industrial, commercial, sci- entific, or governmental functions or proc- esses that relate to critical infrastructure, including operational and industrial control systems, distributed control systems, and programmable logic controllers; and (B) does not include personal devices and systems, such as consumer mobile devices, home computers, residential wireless rout- ers, or residential internet enabled consumer devices. (2) Authority (A) In general If the Director identifies a system con- nected to the internet with a specific secu- rity vulnerability and has reason to believe such security vulnerability relates to crit- ical infrastructure and affects a covered de- vice or system, and the Director is unable to identify the entity at risk that owns or oper- ates such covered device or system, the Di- rector may issue a subpoena for the produc- tion of information necessary to identify and notify such entity at risk, in order to carry out a function authorized under sub- section (c)(12). (B) Limit on information A subpoena issued pursuant to subpara- graph (A) may seek information— (i) only in the categories set forth in sub- paragraphs (A), (B), (D), and (E) of section 2703(c)(2) of title 18; and (ii) for not more than 20 covered devices or systems. (C) Liability protections for disclosing pro- viders The provisions of section 2703(e) of title 18, shall apply to any subpoena issued pursuant to subparagraph (A). (3) Coordination (A) In general If the Director exercises the subpoena au- thority under this subsection, and in the in- terest of avoiding interference with ongoing law enforcement investigations, the Director shall coordinate the issuance of any such subpoena with the Department of Justice, including the Federal Bureau of Investiga- tion, pursuant to interagency procedures which the Director, in coordination with the Attorney General, shall develop not later than 60 days after January 1, 2021. (B) Contents The inter-agency procedures developed under this paragraph shall provide that a subpoena issued by the Director under this subsection shall be— (i) issued to carry out a function de- scribed in subsection (c)(12); and (ii) subject to the limitations specified in this subsection. (4) Noncompliance If any person, partnership, corporation, asso- ciation, or entity fails to comply with any duly served subpoena issued pursuant to this subsection, the Director may request that the Attorney General seek enforcement of such subpoena in any judicial district in which such person, partnership, corporation, association, or entity resides, is found, or transacts busi- ness. (5) Notice Not later than seven days after the date on which the Director receives information ob- tained through a subpoena issued pursuant to this subsection, the Director shall notify any entity identified by information obtained pur- Page 344 TITLE 6—DOMESTIC SECURITY § 659 suant to such subpoena regarding such sub- poena and the identified vulnerability. (6) Authentication (A) In general Any subpoena issued pursuant to this sub- section shall be authenticated with a cryp- tographic digital signature of an authorized representative of the Agency, or other com- parable successor technology, that allows the Agency to demonstrate that such sub- poena was issued by the Agency and has not been altered or modified since such issuance. (B) Invalid if not authenticated Any subpoena issued pursuant to this sub- section that is not authenticated in accord- ance with subparagraph (A) shall not be con- sidered to be valid by the recipient of such subpoena. (7) Procedures Not later than 90 days after January 1, 2021, the Director shall establish internal proce- dures and associated training, applicable to employees and operations of the Agency, re- garding subpoenas issued pursuant to this sub- section, which shall address the following: (A) The protection of and restriction on dissemination of nonpublic information ob- tained through such a subpoena, including a requirement that the Agency not dissemi- nate nonpublic information obtained through such a subpoena that identifies the party that is subject to such subpoena or the entity at risk identified by information ob- tained, except that the Agency may share the nonpublic information with the Depart- ment of Justice for the purpose of enforcing such subpoena in accordance with paragraph (4), and may share with a Federal agency the nonpublic information of the entity at risk if— (i) the Agency identifies or is notified of a cybersecurity incident involving such entity, which relates to the vulnerability which led to the issuance of such sub- poena; (ii) the Director determines that sharing the nonpublic information with another Federal department or agency is necessary to allow such department or agency to take a law enforcement or national secu- rity action, consistent with the inter- agency procedures under paragraph (3)(A), or actions related to mitigating or other- wise resolving such incident; (iii) the entity to which the information pertains is notified of the Director’s deter- mination, to the extent practicable con- sistent with national security or law en- forcement interests, consistent with such interagency procedures; and (iv) the entity consents, except that the entity’s consent shall not be required if another Federal department or agency identifies the entity to the Agency in con- nection with a suspected cybersecurity in- cident. (B) The restriction on the use of informa- tion obtained through such a subpoena for a cybersecurity purpose. (C) The retention and destruction of non- public information obtained through such a subpoena, including— (i) destruction of such information that the Director determines is unrelated to critical infrastructure immediately upon providing notice to the entity pursuant to paragraph (5); and (ii) destruction of any personally identi- fiable information not later than 6 months after the date on which the Director re- ceives information obtained through such a subpoena, unless otherwise agreed to by the individual identified by the subpoena respondent. (D) The processes for providing notice to each party that is subject to such a sub- poena and each entity identified by informa- tion obtained under such a subpoena. (E) The processes and criteria for con- ducting critical infrastructure security risk assessments to determine whether a sub- poena is necessary prior to being issued pur- suant to this subsection. (F) The information to be provided to an entity at risk at the time of the notice of the vulnerability, which shall include— (i) a discussion or statement that re- sponding to, or subsequent engagement with, the Agency, is voluntary; and (ii) to the extent practicable, informa- tion regarding the process through which the Director identifies security vulnerabilities. (8) Limitation on procedures The internal procedures established pursu- ant to paragraph (7) may not require an owner or operator of critical infrastructure to take any action as a result of a notice of vulner- ability made pursuant to this chapter. (9) Review of procedures Not later than 1 year after January 1, 2021, the Privacy Officer of the Agency shall— (A) review the internal procedures estab- lished pursuant to paragraph (7) to ensure that— (i) such procedures are consistent with fair information practices; and (ii) the operations of the Agency comply with such procedures; and (B) notify the Committee on Homeland Se- curity and Governmental Affairs of the Sen- ate and the Committee on Homeland Secu- rity of the House of Representatives of the results of the review under subparagraph (A). (10) Publication of information Not later than 120 days after establishing the internal procedures under paragraph (7), the Director shall publish information on the website of the Agency regarding the subpoena process under this subsection, including infor- mation regarding the following: (A) Such internal procedures. (B) The purpose for subpoenas issued pur- suant to this subsection. (C) The subpoena process. (D) The criteria for the critical infrastruc- ture security risk assessment conducted prior to issuing a subpoena. Page 345 TITLE 6—DOMESTIC SECURITY § 659 1 So in original. There is no par. (2). (E) Policies and procedures on retention and sharing of data obtained by subpoenas. (F) Guidelines on how entities contacted by the Director may respond to notice of a subpoena. (11) Annual reports The Director shall annually submit to the Committee on Homeland Security and Govern- mental Affairs of the Senate and the Com- mittee on Homeland Security of the House of Representatives a report (which may include a classified annex but with the presumption of declassification) on the use of subpoenas issued pursuant to this subsection, which shall include the following: (A) A discussion of the following: (i) The effectiveness of the use of such subpoenas to mitigate critical infrastruc- ture security vulnerabilities. (ii) The critical infrastructure security risk assessment process conducted for sub- poenas issued under this subsection. (iii) The number of subpoenas so issued during the preceding year. (iv) To the extent practicable, the num- ber of vulnerable covered devices or sys- tems mitigated under this subsection by the Agency during the preceding year. (v) The number of entities notified by the Director under this subsection, and their responses, during the preceding year. (B) For each subpoena issued pursuant to this subsection, the following: (i) Information relating to the source of the security vulnerability detected, identi- fied, or received by the Director. (ii) Information relating to the steps taken to identify the entity at risk prior to issuing the subpoena. (iii) A description of the outcome of the subpoena, including discussion on the reso- lution or mitigation of the critical infra- structure security vulnerability. (12) Publication of the annual reports The Director shall publish a version of the annual report required under paragraph (11) on the website of the Agency, which shall, at a minimum, include the findings described in clauses (iii), (iv), and (v) of subparagraph (A) of such paragraph. (13) Prohibition on use of information for un- authorized purposes Any information obtained pursuant to a sub- poena issued under this subsection may not be provided to any other Federal department or agency for any purpose other than a cybersecurity purpose or for the purpose of en- forcing a subpoena issued pursuant to this sub- section. (q) Industrial control systems The Director shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes. In carrying out this subsection, the Director shall— (1) lead Federal Government efforts, in con- sultation with Sector Risk Management Agen- cies, as appropriate, to identify and mitigate cybersecurity threats to industrial control systems, including supervisory control and data acquisition systems; (2) maintain threat hunting and incident re- sponse capabilities to respond to industrial control system cybersecurity risks and inci- dents; (3) provide cybersecurity technical assist- ance to industry end-users, product manufac- turers, Sector Risk Management Agencies, other Federal agencies, and other industrial control system stakeholders to identify, evaluate, assess, and mitigate vulnerabilities; (4) collect, coordinate, and provide vulner- ability information to the industrial control systems community by, as appropriate, work- ing closely with security researchers, industry end-users, product manufacturers, Sector Risk Management Agencies, other Federal agencies, and other industrial control systems stake- holders; and (5) conduct such other efforts and assistance as the Secretary determines appropriate. (r) Coordination on cybersecurity for SLTT enti- ties (1) 1 Coordination The Center shall, upon request and to the ex- tent practicable, and in coordination as appro- priate with Federal and non-Federal entities, such as the Multi-State Information Sharing and Analysis Center— (A) conduct exercises with SLTT entities; (B) provide operational and technical cybersecurity training to SLTT entities to address cybersecurity risks or incidents, with or without reimbursement, related to— (i) cyber threat indicators; (ii) defensive measures; (iii) cybersecurity risks; (iv) vulnerabilities; and (v) incident response and management; (C) in order to increase situational aware- ness and help prevent incidents, assist SLTT entities in sharing, in real time, with the Federal Government as well as among SLTT entities, actionable— (i) cyber threat indicators; (ii) defensive measures; (iii) information about cybersecurity risks; and (iv) information about incidents; (D) provide SLTT entities notifications containing specific incident and malware in- formation that may affect them or their residents; (E) provide to, and periodically update, SLTT entities via an easily accessible plat- form and other means— (i) information about tools; (ii) information about products; (iii) resources; (iv) policies; (v) guidelines; (vi) controls; and (vii) other cybersecurity standards and best practices and procedures related to Page 346 TITLE 6—DOMESTIC SECURITY § 659 information security, including, as appro- priate, information produced by other Fed- eral agencies; (F) work with senior SLTT entity officials, including chief information officers and sen- ior election officials and through national associations, to coordinate the effective im- plementation by SLTT entities of tools, products, resources, policies, guidelines, con- trols, and procedures related to information security to secure the information systems, including election systems, of SLTT enti- ties; (G) provide operational and technical as- sistance to SLTT entities to implement tools, products, resources, policies, guide- lines, controls, and procedures on informa- tion security; (H) assist SLTT entities in developing policies and procedures for coordinating vul- nerability disclosures consistent with inter- national and national standards in the infor- mation technology industry; and (I) promote cybersecurity education and awareness through engagements with Fed- eral agencies and non-Federal entities. (s) Report Not later than 1 year after June 21, 2022, and every 2 years thereafter, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the services and capabilities that the Agency directly and indi- rectly provides to SLTT entities. (Pub. L. 107–296, title XXII, § 2209, formerly title II, § 227, formerly § 226, as added Pub. L. 113–282, § 3(a), Dec. 18, 2014, 128 Stat. 3066; renumbered § 227 and amended Pub. L. 114–113, div. N, title II, §§ 203, 223(a)(3), Dec. 18, 2015, 129 Stat. 2957, 2963; Pub. L. 114–328, div. A, title XVIII, § 1841(b), Dec. 23, 2016, 130 Stat. 2663; renumbered title XXII, § 2209, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(iii), Nov. 16, 2018, 132 Stat. 4178, 4180; Pub. L. 116–94, div. L, § 102(a), Dec. 20, 2019, 133 Stat. 3089; Pub. L. 116–283, div. A, title XVII, § 1716(a), Jan. 1, 2021, 134 Stat. 4094; Pub. L. 117–81, div. A, title XV, §§ 1541(a), 1542, 1548(c), Dec. 27, 2021, 135 Stat. 2054, 2056, 2063; Pub. L. 117–103, div. Y, § 103(a)(1), Mar. 15, 2022, 136 Stat. 1038; Pub. L. 117–150, § 2(2), June 21, 2022, 136 Stat. 1295; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(D), Dec. 23, 2022, 136 Stat. 3659.) Editorial Notes REFERENCES IN TEXT Title I of the Cybersecurity Act of 2015, referred to in subsecs. (c)(1) and (h)(1), is title I of Pub. L. 114–113, div. N, Dec. 18, 2015, 129 Stat. 2936, also known as the Cybersecurity Information Sharing Act of 2015, which is classified generally to subchapter I of chapter 6 of this title. For complete classification of title I to the Code, see Short Title note set out under section 1501 of this title and Tables. This chapter, referred to in subsec. (p)(8), was in the original ‘‘this Act’’, meaning Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2135, known as the Homeland Security Act of 2002, which is classified principally to this chap- ter. For complete classification of this Act to the Code, see Short Title note set out below and Tables. CODIFICATION Section was formerly classified to section 148 of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Subsec. (a). Pub. L. 117–263, § 7143(b)(2)(D)(i), added subsec. (a) and struck out former subsec. (a) which defined cybersecurity purpose, cybersecurity risk, cyber threat indicator, defensive measure, cybersecurity vulnerability, incident, information sharing and analysis organization, information system, security vulnerability, and sharing. Subsec. (b). Pub. L. 117–263, § 7143(b)(2)(D)(ii), inserted ‘‘Executive’’ before ‘‘Assistant Director for Cybersecurity’’. Subsec. (c)(6). Pub. L. 117–150, § 2(2)(A), inserted ‘‘operational and’’ before ‘‘timely’’. Subsec. (c)(13). Pub. L. 117–103 added par. (13). Subsec. (d)(1)(A)(iii). Pub. L. 117–263, § 7143(b)(2)(D)(iii)(I), struck out ‘‘, as that term is de- fined under section 3003(4) of title 50’’ after ‘‘intel- ligence community’’. Subsec. (d)(1)(B)(ii). Pub. L. 117–263, § 7143(b)(2)(D)(iii)(II), substituted ‘‘Information Sharing and Analysis Organizations’’ for ‘‘information sharing and analysis organizations’’. Subsec. (d)(1)(E). Pub. L. 117–150, § 2(2)(B), inserted ‘‘, including an entity that collaborates with election officials,’’ after ‘‘governments’’. Subsec. (e)(1)(E)(ii)(II). Pub. L. 117–263, § 7143(b)(2)(D)(iv), substituted ‘‘Information Sharing and Analysis Organizations’’ for ‘‘information sharing and analysis organizations’’. Subsec. (p). Pub. L. 117–263, § 7143(b)(2)(D)(v), redesig- nated subsec. (p) relating to coordination on cybersecurity for SLTT entities as (r). Pub. L. 117–150, § 2(2)(C), added subsec. (p) relating to coordination on cybersecurity for SLTT entities. Subsec. (q). Pub. L. 117–263, § 7143(b)(2)(D)(vi), redesig- nated subsec. (q) relating to report as (s). Pub. L. 117–150, § 2(2)(C), added subsec. (q) relating to report. Subsec. (r). Pub. L. 117–263, § 7143(b)(2)(D)(v), redesig- nated subsec. (p) relating to coordination on cybersecurity for SLTT entities as (r). Subsec. (s). Pub. L. 117–263, § 7143(b)(2)(D)(vi), redesig- nated subsec. (q) relating to report as (s). 2021—Subsec. (a). Pub. L. 117–81, § 1542(1), added par. (4) and redesignated former pars. (4) to (8) (as pre- viously added or redesignated by Pub. L. 116–283) as (5) to (9), respectively. Pub. L. 116–283, § 1716(a)(1), added pars. (1) and (7) and redesignated former pars. (1) to (5) as (2) to (6), respec- tively, and former par. (6) as (8). Subsec. (c)(5)(B), (C). Pub. L. 117–81, § 1542(2)(A), added subpar. (B), redesignated former subpar. (B) as (C), and inserted in subpar. (C) as redesignated ‘‘and mitigation protocols to counter cybersecurity vulnerabilities in accordance with subparagraph (B), as appropriate,’’ be- fore ‘‘with Federal’’. Subsec. (c)(6). Pub. L. 117–81, § 1548(c), inserted ‘‘, which may take the form of continuous monitoring and detection of cybersecurity risks to critical infra- structure entities that own or operate industrial con- trol systems that support national critical functions’’ after ‘‘mitigation, and remediation’’. Subsec. (c)(7)(C). Pub. L. 117–81, § 1542(2)(B), sub- stituted ‘‘share’’ for ‘‘sharing’’. Subsec. (c)(9). Pub. L. 117–81, § 1542(2)(C), inserted ‘‘mitigation protocols to counter cybersecurity vulnerabilities, as appropriate,’’ after ‘‘measures,’’. Subsec. (c)(12). Pub. L. 116–283, § 1716(a)(2), added par. (12). Subsec. (e)(1)(I). Pub. L. 117–81, § 1541(a)(1), added sub- par. (I). Subsec. (o). Pub. L. 117–81, § 1542(4), added subsec. (o). Former subsec. (o) redesignated (p) relating to sub- poena authority. Pub. L. 116–283, § 1716(a)(3), added subsec. (o). Page 347 TITLE 6—DOMESTIC SECURITY § 659 Subsec. (p). Pub. L. 117–81, § 1542(3), redesignated sub- sec. (o) as (p) relating to subpoena authority. Subsec. (q). Pub. L. 117–81, § 1541(a)(2), added subsec. (q) relating to industrial control systems. 2019—Subsec. (d)(1)(B)(iv). Pub. L. 116–94, § 102(a)(1), inserted ‘‘, including cybersecurity specialists’’ after ‘‘entities’’. Subsec. (f). Pub. L. 116–94, § 102(a)(3), added subsec. (f). Former subsec. (f) redesignated (g). Subsec. (g). Pub. L. 116–94, § 102(a)(2), redesignated subsec. (f) as (g). Former subsec. (g) redesignated (h). Subsec. (g)(1), (2). Pub. L. 116–94, § 102(a)(4), inserted ‘‘, or any team or activity of the Center,’’ after ‘‘Cen- ter’’. Subsecs. (h) to (n). Pub. L. 116–94, § 102(a)(2), redesig- nated subsecs. (g) to (m) as (h) to (n), respectively. 2018—Pub. L. 115–278, § 2(g)(9)(A)(iii)(I), substituted ‘‘Director’’ for ‘‘Under Secretary appointed under sec- tion 113(a)(1)(H) of this title’’ wherever appearing. Subsec. (a)(4). Pub. L. 115–278, § 2(g)(9)(A)(iii)(II), sub- stituted ‘‘section 671(5) of this title’’ for ‘‘section 131(5) of this title’’. Subsec. (b). Pub. L. 115–278, § 2(g)(9)(A)(iii)(III), in- serted at end ‘‘The Center shall be located in the Cybersecurity and Infrastructure Security Agency. The head of the Center shall report to the Assistant Direc- tor for Cybersecurity.’’ Subsec. (c)(11). Pub. L. 115–278, § 2(g)(9)(A)(iii)(IV), substituted ‘‘Emergency Communications Division’’ for ‘‘Office of Emergency Communications’’. 2016—Subsecs. (l), (m). Pub. L. 114–328 added subsec. (l) and redesignated former subsec. (l) as (m). 2015—Subsec. (a)(1) to (5). Pub. L. 114–113, § 203(1)(A), (B), added pars. (1) to (3), redesignated former pars. (3) and (4) as (4) and (5), respectively, and struck out former pars. (1) and (2), which defined ‘‘cybersecurity risk’’ and ‘‘incident’’, respectively. Subsec. (a)(6). Pub. L. 114–113, § 203(1)(C)–(E), added par. (6). Subsec. (c)(1). Pub. L. 114–113, § 203(2)(A), inserted ‘‘cyber threat indicators, defensive measures,’’ before ‘‘cybersecurity risks’’ and ‘‘, including the implemen- tation of title I of the Cybersecurity Act of 2015’’ before semicolon at end. Subsec. (c)(3). Pub. L. 114–113, § 203(2)(B), substituted ‘‘cyber threat indicators, defensive measures, cybersecurity risks,’’ for ‘‘cybersecurity risks’’. Subsec. (c)(5)(A). Pub. L. 114–113, § 203(2)(C), sub- stituted ‘‘cyber threat indicators, defensive measures, cybersecurity risks,’’ for ‘‘cybersecurity risks’’. Subsec. (c)(6). Pub. L. 114–113, § 203(2)(D), substituted ‘‘cyber threat indicators, defensive measures, cybersecurity risks,’’ for ‘‘cybersecurity risks’’ and struck out ‘‘and’’ at end. Subsec. (c)(7)(C). Pub. L. 114–113, § 203(2)(E), added subpar. (C). Subsec. (c)(8) to (11). Pub. L. 114–113, § 203(2)(F), added pars. (8) to (11). Subsec. (d)(1)(B)(i). Pub. L. 114–113, § 203(3)(A)(i), sub- stituted ‘‘, local, and tribal’’ for ‘‘and local’’. Subsec. (d)(1)(B)(ii). Pub. L. 114–113, § 203(3)(A)(ii), substituted ‘‘, including information sharing and anal- ysis centers;’’ for ‘‘; and’’. Subsec. (d)(1)(B)(iv). Pub. L. 114–113, § 203(3)(A)(iii), (iv), added cl. (iv). Subsec. (d)(1)(E), (F). Pub. L. 114–113, § 203(3)(B)–(D), added subpar. (E) and redesignated former subpar. (E) as (F). Subsec. (e)(1)(A). Pub. L. 114–113, § 203(4)(A)(i), in- serted ‘‘cyber threat indicators, defensive measures, and’’ before ‘‘information’’. Subsec. (e)(1)(B). Pub. L. 114–113, § 203(4)(A)(ii), in- serted ‘‘cyber threat indicators, defensive measures, and’’ before ‘‘information related’’. Subsec. (e)(1)(F). Pub. L. 114–113, § 203(4)(A)(iii), sub- stituted ‘‘cyber threat indicators, defensive measures, cybersecurity risks,’’ for ‘‘cybersecurity risks’’ and struck out ‘‘and’’ at end. Subsec. (e)(1)(G). Pub. L. 114–113, § 203(4)(A)(iv), sub- stituted ‘‘cyber threat indicators, defensive measures, cybersecurity risks, and incidents; and’’ for ‘‘cybersecurity risks and incidents’’. Subsec. (e)(1)(H). Pub. L. 114–113, § 203(4)(A)(v), added subpar. (H). Subsec. (e)(2). Pub. L. 114–113, § 203(4)(B), substituted ‘‘cyber threat indicators, defensive measures, cybersecurity risks,’’ for ‘‘cybersecurity risks’’ and in- serted ‘‘or disclosure’’ after ‘‘access’’. Subsec. (e)(3). Pub. L. 114–113, § 203(4)(C), inserted ‘‘, including by working with the Privacy Officer ap- pointed under section 142 of this title to ensure that the Center follows the policies and procedures specified in subsections (b) and (d)(5)(C) of section 105 of the Cybersecurity Act of 2015’’ before period at end. Subsecs. (g) to (l). Pub. L. 114–113, § 203(5), added sub- secs. (g) to (l). Statutory Notes and Related Subsidiaries RULES OF CONSTRUCTION Nothing in amendment made by Pub. L. 117–263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, see section 7143(f)(1) of Pub. L. 117–263, set out as a note under sec- tion 650 of this title. Pub. L. 116–283, div. A, title XVII, § 1716(b), Jan. 1, 2021, 134 Stat. 4098, provided that: ‘‘(1) PROHIBITION ON NEW REGULATORY AUTHORITY.— Nothing in this section or the amendments made by this section [amending this section] may be construed to grant the Secretary of Homeland Security, or the head of any another Federal agency or department, any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of the enactment of this Act [Jan. 1, 2021]. ‘‘(2) PRIVATE ENTITIES.—Nothing in this section or the amendments made by this section [amending this sec- tion] may be construed to require any private entity to— ‘‘(A) request assistance from the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security; or ‘‘(B) implement any measure or recommendation suggested by the Director.’’ Pub. L. 113–282, § 8, Dec. 18, 2014, 128 Stat. 3072, pro- vided that: ‘‘(a) PROHIBITION ON NEW REGULATORY AUTHORITY.— Nothing in this Act [see section 1 of Pub. L. 113–282, set out as a Short Title of 2014 Amendment note under sec- tion 101 of this title] or the amendments made by this Act shall be construed to grant the Secretary [of Home- land Security] any authority to promulgate regulations or set standards relating to the cybersecurity of pri- vate sector critical infrastructure that was not in ef- fect on the day before the date of enactment of this Act [Dec. 18, 2014]. ‘‘(b) PRIVATE ENTITIES.—Nothing in this Act or the amendments made by this Act shall be construed to re- quire any private entity— ‘‘(1) to request assistance from the Secretary; or ‘‘(2) that requested such assistance from the Sec- retary to implement any measure or recommendation suggested by the Secretary.’’ DEFINITIONS Pub. L. 113–282, § 2, Dec. 18, 2014, 128 Stat. 3066, pro- vided that: ‘‘In this Act [see section 1 of Pub. L. 113–282, set out as a Short Title of 2014 Amendment note under section 101 of this title]— ‘‘(1) the term ‘Center’ means the national cybersecurity and communications integration cen- ter under section 226 [renumbered 227 by section 223(a)(3) of Pub. L. 114–113 and renumbered 2209 by section 2(g)(2)(I) of Pub. L. 115–278] of the Homeland Security Act of 2002 [6 U.S.C. 659], as added by section 3; Page 348 TITLE 6—DOMESTIC SECURITY § 660 ‘‘(2) the term ‘critical infrastructure’ has the mean- ing given that term in section 2 of the Homeland Se- curity Act of 2002 (6 U.S.C. 101); ‘‘(3) the term ‘cybersecurity risk’ has the meaning given that term in section 226 [2209] of the Homeland Security Act of 2002, as added by section 3; ‘‘(4) the term ‘information sharing and analysis or- ganization’ has the meaning given that term in sec- tion 212(5) [renumbered 2222(5) by section 2(g)(2)(H) of Pub. L. 115–278] of the Homeland Security Act of 2002 ([former] 6 U.S.C. 131(5)) [now 6 U.S.C. 671(5); see 6 U.S.C. 650(13)]; ‘‘(5) the term ‘information system’ has the meaning given that term in section 3502(8) of title 44, United States Code; and ‘‘(6) the term ‘Secretary’ means the Secretary of Homeland Security.’’ § 660. Cybersecurity plans (a) Definitions In this section, the term ‘‘agency information system’’ means an information system used or operated by an agency or by another entity on behalf of an agency. (b) Intrusion assessment plan (1) Requirement The Secretary, in coordination with the Di- rector of the Office of Management and Budg- et, shall— (A) develop and implement an intrusion assessment plan to proactively detect, iden- tify, and remove intruders in agency infor- mation systems on a routine basis; and (B) update such plan as necessary. (2) Exception The intrusion assessment plan required under paragraph (1) shall not apply to the De- partment of Defense, a national security sys- tem, or an element of the intelligence commu- nity. (c) Cyber incident response plan The Director of the Cybersecurity and Infra- structure Security Agency shall, in coordination with appropriate Federal departments and agen- cies, State and local governments, sector coordi- nating councils, Information Sharing and Anal- ysis Organizations, owners and operators of crit- ical infrastructure, and other appropriate enti- ties and individuals, develop, update not less often than biennially, maintain, and exercise adaptable cyber incident response plans to ad- dress cybersecurity risks to critical infrastruc- ture. The Director, in consultation with rel- evant Sector Risk Management Agencies and the National Cyber Director, shall develop mechanisms to engage with stakeholders to edu- cate such stakeholders regarding Federal Gov- ernment cybersecurity roles and responsibilities for cyber incident response. (d) National Response Framework The Secretary, in coordination with the heads of other appropriate Federal departments and agencies, and in accordance with the National Cybersecurity Incident Response Plan required under subsection (c), shall regularly update, maintain, and exercise the Cyber Incident Annex to the National Response Framework of the Department. (e) Homeland Security Strategy to Improve the Cybersecurity of State, Local, Tribal, and Territorial Governments (1) In general (A) Requirement Not later than one year after December 27, 2021, the Secretary, acting through the Di- rector, shall, in coordination with the heads of appropriate Federal agencies, State, local, Tribal, and territorial governments, and other stakeholders, as appropriate, develop and make publicly available a Homeland Se- curity Strategy to Improve the Cybersecurity of State, Local, Tribal, and Territorial Governments. (B) Recommendations and requirements The strategy required under subparagraph (A) shall provide recommendations relating to the ways in which the Federal Govern- ment should support and promote the ability of State, local, Tribal, and territorial gov- ernments to identify, mitigate against, pro- tect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, and incidents. (2) Contents The strategy required under paragraph (1) shall— (A) identify capability gaps in the ability of State, local, Tribal, and territorial gov- ernments to identify, protect against, de- tect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; (B) identify Federal resources and capa- bilities that are available or could be made available to State, local, Tribal, and terri- torial governments to help those govern- ments identify, protect against, detect, re- spond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; (C) identify and assess the limitations of Federal resources and capabilities available to State, local, Tribal, and territorial gov- ernments to help those governments iden- tify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents and make rec- ommendations to address such limitations; (D) identify opportunities to improve the coordination of the Agency with Federal and non-Federal entities, such as the Multi- State Information Sharing and Analysis Center, to improve— (i) incident exercises, information shar- ing and incident notification procedures; (ii) the ability for State, local, Tribal, and territorial governments to voluntarily adapt and implement guidance in Federal binding operational directives; and (iii) opportunities to leverage Federal schedules for cybersecurity investments under section 502 of title 40; (E) recommend new initiatives the Federal Government should undertake to improve the ability of State, local, Tribal, and terri-