Amendments to SA 3867 on H.R. 4350 — Congressional Record, Senate, November 18, 2021
Summary
Congressional Record, Senate, November 18, 2021, pages S8456 and S8457, listing amendments submitted to amendment SA 3867 on the bill authorizing fiscal year 2022 military activities of the Department of Defense. Mr. Hagerty, Mr. Scott of Florida, Ms. Murkowski, Mr. Sanders, Mr. Coons, and others are named as submitters, and the amendments are ordered to lie on the table. Printed text includes sections authorizing the President to use the Armed Forces of the United States against ISIS and associated forces in Iraq and to protect United States diplomats in Iraq. Other text, titled the Defense of United States Infrastructure Act of 2021, would establish a national risk management cycle for critical infrastructure.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Amendments to SA 3867 on H.R. 4350 — Congressional Record, Senate, November 18, 2021.”
Original at www.govinfo.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/crec-crec-2021-11-18-crec-2021-11-18-pt1-pgs8456-f610d94fe2/
, SHA-256 c152df44c19dc3b8d38c45b2defb5877f2685e22eef09f1ff324c8fcd5471a63.Full text
S8456 CONGRESSIONAL RECORD — SENATE November 18, 2021
and intended to be proposed to the bill H.R. tended to be proposed to amendment SA 3867 SEC. 1285. RULE OF CONSTRUCTION REGARDING
4350, supra; which was ordered to lie on the submitted by Mr. REED and intended to be THE CONSTITUTIONAL POWERS OF
table. proposed to the bill H.R. 4350, supra; which THE PRESIDENT AS COMMANDER-IN-
CHIEF.
SA 4813. Mr. SCOTT of Florida submitted was ordered to lie on the table.
an amendment intended to be proposed to Nothing in this Act shall be construed to
SA 4828. Mr. BLUMENTHAL submitted an
amendment SA 3867 submitted by Mr. REED infringe upon the constitutional powers of
amendment intended to be proposed to
and intended to be proposed to the bill H.R. the President as Commander-in-Chief under
amendment SA 3867 submitted by Mr. REED
4350, supra; which was ordered to lie on the Article II of the Constitution of the United
and intended to be proposed to the bill H.R.
table. States.
4350, supra; which was ordered to lie on the
SA 4814. Ms. MURKOWSKI submitted an table. ---
amendment intended to be proposed to SA 4829. Mr. LEE submitted an amendment
SA 4784. Mr. KING (for himself, Mr.
amendment SA 3867 submitted by Mr. REED intended to be proposed to amendment SA ROUNDS, Mr. SASSE, Ms. ROSEN, Ms.
and intended to be proposed to the bill H.R. 3867 submitted by Mr. REED and intended to HASSAN, and Mr. OSSOFF) submitted an
4350, supra; which was ordered to lie on the be proposed to the bill H.R. 4350, supra; amendment intended to be proposed to
table. which was ordered to lie on the table. amendment SA 3867 submitted by Mr.
SA 4815. Mr. SANDERS submitted an SA 4830. Mr. MANCHIN (for himself, Mrs. REED and intended to be proposed to
amendment intended to be proposed to CAPITO, Mrs. HYDE-SMITH, Mr. ROMNEY, Mr.
amendment SA 3867 submitted by Mr. REED
the bill H.R. 4350, to authorize appro-
COTTON, Mrs. BLACKBURN, and Mr. TESTER) priations for fiscal year 2022 for mili-
and intended to be proposed to the bill H.R. submitted an amendment intended to be pro-
4350, supra; which was ordered to lie on the tary activities of the Department of
posed to amendment SA 3867 submitted by
table. Mr. REED and intended to be proposed to the Defense, for military construction, and
SA 4816. Mr. COONS submitted an amend- bill H.R. 4350, supra; which was ordered to lie for defense activities of the Depart-
ment intended to be proposed to amendment on the table. ment of Energy, to prescribe military
SA 3867 submitted by Mr. REED and intended personnel strengths for such fiscal
SA 4831. Mr. SCOTT of Florida submitted
to be proposed to the bill H.R. 4350, supra;
an amendment intended to be proposed to year, and for other purposes; which was
which was ordered to lie on the table.
amendment SA 3867 submitted by Mr. REED ordered to lie on the table; as follows:
SA 4817. Ms. SINEMA submitted an amend-
and intended to be proposed to the bill H.R. At the end, add the following:
ment intended to be proposed to amendment
4350, supra; which was ordered to lie on the
SA 3867 submitted by Mr. REED and intended DIVISION E—DEFENSE OF UNITED STATES
table.
to be proposed to the bill H.R. 4350, supra; INFRASTRUCTURE
SA 4832. Mr. MENENDEZ submitted an
which was ordered to lie on the table. SEC. 5001. SHORT TITLE.
SA 4818. Mr. BENNET submitted an amendment intended to be proposed to
amendment SA 3867 submitted by Mr. REED This division may be cited as the ‘‘Defense
amendment intended to be proposed to
and intended to be proposed to the bill H.R. of United States Infrastructure Act of 2021’’.
amendment SA 3867 submitted by Mr. REED
and intended to be proposed to the bill H.R. 4350, supra; which was ordered to lie on the SEC. 5002. DEFINITIONS.
4350, supra; which was ordered to lie on the table. In this division:
table. SA 4833. Mr. BARRASSO (for himself, Mr. (1) CRITICAL INFRASTRUCTURE.—The term
SA 4819. Mr. SULLIVAN (for himself and CRUZ, and Mr. JOHNSON) submitted an ‘‘critical infrastructure’’ has the meaning
Mr. WHITEHOUSE) submitted an amendment amendment intended to be proposed to given such term in section 1016(e) of the Crit-
intended to be proposed to amendment SA amendment SA 3867 submitted by Mr. REED ical Infrastructure Protection Act of 2001 (42
3867 submitted by Mr. REED and intended to and intended to be proposed to the bill H.R. U.S.C. 5195c(e)).
be proposed to the bill H.R. 4350, supra; 4350, supra; which was ordered to lie on the (2) CYBERSECURITY RISK.—The term ‘‘cyber-
which was ordered to lie on the table. table. security risk’’ has the meaning given such
SA 4820. Mr. COTTON (for himself, Mr. term in section 2209 of the Homeland Secu-
MANCHIN, Mr. TUBERVILLE, and Mr. KELLY) f rity Act of 2002 (6 U.S.C. 659).
submitted an amendment intended to be pro- (3) DEPARTMENT.—The term ‘‘Department’’
posed to amendment SA 3867 submitted by means the Department of Homeland Secu-
Mr. REED and intended to be proposed to the TEXT OF AMENDMENTS rity.
bill H.R. 4350, supra; which was ordered to lie SA 4783. Mr. HAGERTY submitted an (4) SECRETARY.—The term ‘‘Secretary’’
on the table. amendment intended to be proposed to means the Secretary of Homeland Security.
SA 4821. Mr. BROWN (for himself and Mr. TITLE LI—INVESTING IN CYBER RESIL-
amendment SA 3867 submitted by Mr.
WARNER) submitted an amendment intended IENCY IN CRITICAL INFRASTRUCTURE
to be proposed to amendment SA 3867 sub- REED and intended to be proposed to
the bill H.R. 4350, to authorize appro- SEC. 5101. NATIONAL RISK MANAGEMENT CYCLE.
mitted by Mr. REED and intended to be pro-
posed to the bill H.R. 4350, supra; which was priations for fiscal year 2022 for mili- (a) AMENDMENTS.—Subtitle A of title XXII
ordered to lie on the table. tary activities of the Department of of the Homeland Security Act of 2002 (6
SA 4822. Mrs. BLACKBURN submitted an U.S.C. 651 et seq.) is amended—
Defense, for military construction, and
amendment intended to be proposed to (1) in section 2202(c) (6 U.S.C. 652(c))—
for defense activities of the Depart- (A) in paragraph (11), by striking ‘‘and’’ at
amendment SA 3867 submitted by Mr. REED ment of Energy, to prescribe military
and intended to be proposed to the bill H.R. the end;
personnel strengths for such fiscal (B) in the first paragraph designated as
4350, supra; which was ordered to lie on the
table. year, and for other purposes; which was paragraph (12), relating to the Cybersecurity
SA 4823. Mr. MARKEY submitted an ordered to lie on the table; as follows: State Coordinator—
amendment intended to be proposed to At the end of subtitle G of title XII, add (i) by striking ‘‘section 2215’’ and inserting
amendment SA 3867 submitted by Mr. REED the following: ‘‘section 2217’’; and
and intended to be proposed to the bill H.R. (ii) by striking ‘‘and’’ at the end; and
SEC. 1283. AUTHORIZATION FOR USE OF UNITED
4350, supra; which was ordered to lie on the (C) by redesignating the second and third
STATES ARMED FORCES AGAINST
table. ISIS AND ASSOCIATED FORCES IN paragraphs designated as paragraph (12) as
SA 4824. Mr. BARRASSO submitted an IRAQ. paragraphs (13) and (14), respectively;
amendment intended to be proposed to The President is authorized to use the (2) by redesignating section 2217 (6 U.S.C.
amendment SA 3867 submitted by Mr. REED Armed Forces of the United States as the 665f) as section 2220;
and intended to be proposed to the bill H.R. President determines to be necessary and ap- (3) by redesignating section 2216 (6 U.S.C.
4350, supra; which was ordered to lie on the propriate in order to defend the national se- 665e) as section 2219;
table. curity of the United States against the (4) by redesignating the fourth section 2215
SA 4825. Mr. BARRASSO submitted an threat posed by the Islamic State of Iraq and (relating to Sector Risk Management Agen-
amendment intended to be proposed to Syria (ISIS) and associated forces in Iraq. cies) (6 U.S.C. 665d) as section 2218;
amendment SA 3867 submitted by Mr. REED (5) by redesignating the third section 2215
SEC. 1284. AUTHORIZATION FOR USE OF UNITED
and intended to be proposed to the bill H.R. (relating to the Cybersecurity State Coordi-
STATES ARMED FORCES TO PRO-
4350, supra; which was ordered to lie on the TECT UNITED STATES DIPLOMATS nator) (6 U.S.C. 665c) as section 2217;
table. AND UNITED STATES DIPLOMATIC (6) by redesignating the second section 2215
SA 4826. Mr. TOOMEY submitted an FACILITIES IN IRAQ AGAINST TER- (relating to the Joint Cyber Planning Office)
ctelli on DSK11ZRN23PROD with SENATE
amendment intended to be proposed to RORIST ATTACKS. (6 U.S.C. 665b) as section 2216; and
amendment SA 3867 submitted by Mr. REED The President is authorized to use the (7) by adding at the end the following:
and intended to be proposed to the bill H.R. Armed Forces of the United States as the ‘‘SEC. 2220A. NATIONAL RISK MANAGEMENT
4350, supra; which was ordered to lie on the President determines to be necessary and ap- CYCLE.
table. propriate in order to protect United States ‘‘(a) NATIONAL CRITICAL FUNCTIONS DE-
SA 4827. Mr. ROUNDS (for himself and Mr. diplomats and United States diplomatic fa- FINED.—In this section, the term ‘national
VAN HOLLEN) submitted an amendment in- cilities in Iraq against terrorist attacks. critical functions’ means the functions of
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00050 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.042 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8457
government and the private sector so vital ‘‘(C) FORM.—Each strategy delivered under (3) CYBERSECURITY THREAT.—The term ‘‘cy-
to the United States that their disruption, subparagraph (A) shall be unclassified, but bersecurity threat’’ has the meaning given
corruption, or dysfunction would have a de- may contain a classified annex. such term in section 102 of the Cybersecurity
bilitating effect on security, national eco- ‘‘(3) CONGRESSIONAL BRIEFING.—Not later Act of 2015 (6 U.S.C. 1501).
nomic security, national public health or than 1 year after the date on which the (4) ENVIRONMENT.—The term ‘‘environ-
safety, or any combination thereof. President delivers a strategy under this sec- ment’’ means the information collaboration
‘‘(b) NATIONAL RISK MANAGEMENT CYCLE.— tion, and every year thereafter, the Sec- environment established under subsection
‘‘(1) RISK IDENTIFICATION AND ASSESS- retary, in coordination with Sector Risk (b).
MENT.— Management Agencies, shall brief the appro- (5) INFORMATION SHARING AND ANALYSIS OR-
‘‘(A) IN GENERAL.—The Secretary, acting priate committees of Congress on— GANIZATION.—The term ‘‘information sharing
through the Director, shall establish a recur- ‘‘(A) the national risk management cycle and analysis organization’’ has the meaning
ring process by which to identify, assess, and activities undertaken pursuant to the strat- given such term in section 2222 of the Home-
prioritize risks to critical infrastructure, egy; and land Security Act of 2002 (6 U.S.C. 671).
considering both cyber and physical threats, ‘‘(B) the amounts and timeline for funding (6) NON-FEDERAL ENTITY.—The term ‘‘non-
the associated likelihoods, vulnerabilities, that the Secretary has determined would be Federal entity’’ has the meaning given such
and consequences, and the resources nec- necessary to address risks and successfully term in section 102 of the Cybersecurity Act
essary to address them. execute the full range of activities proposed of 2015 (6 U.S.C. 1501).
‘‘(B) CONSULTATION.—In establishing the by the strategy.’’. (b) PROGRAM.—The Secretary, in consulta-
process required under subparagraph (A), the (b) TECHNICAL AND CONFORMING AMEND-
tion with the Secretary of Defense, the Di-
Secretary shall consult with, and request MENTS.—
rector of National Intelligence, and the At-
and collect information to support analysis (1) TABLE OF CONTENTS.—The table of con-
torney General, shall carry out a program
from, Sector Risk Management Agencies, tents in section 1(b) of the Homeland Secu-
rity Act of 2002 (Public Law 107–296; 116 Stat. under which the Secretary shall develop an
critical infrastructure owners and operators, information collaboration environment con-
the Assistant to the President for National 2135) is amended by striking the item relat-
ing to section 2214 and all that follows sisting of a digital environment containing
Security Affairs, the Assistant to the Presi- technical tools for information analytics and
dent for Homeland Security, and the Na- through the item relating to section 2217 and
inserting the following: a portal through which relevant parties may
tional Cyber Director.
submit and automate information inputs and
‘‘(C) PUBLICATION.—Not later than 180 days ‘‘Sec. 2214. National Asset Database.
access the environment in order to enable
after the date of enactment of this section, ‘‘Sec. 2215. Duties and authorities relating
to .gov internet domain. interoperable data flow that enable Federal
the Secretary shall publish in the Federal
‘‘Sec. 2216. Joint Cyber Planning Office. and non-Federal entities to identify, miti-
Register procedures for the process estab-
‘‘Sec. 2217. Cybersecurity State Coordinator. gate, and prevent malicious cyber activity
lished under subparagraph (A), subject to
any redactions the Secretary determines are ‘‘Sec. 2218. Sector Risk Management Agen- to—
necessary to protect classified or other sen- cies. (1) provide limited access to appropriate
sitive information. ‘‘Sec. 2219. Cybersecurity Advisory Com- and operationally relevant data from unclas-
‘‘(D) REPORT.—The Secretary shall submit mittee. sified and classified intelligence about cyber-
to the President, the Committee on Home- ‘‘Sec. 2220. Cybersecurity education and security risks and cybersecurity threats, as
land Security and Governmental Affairs of training programs. well as malware forensics and data from net-
the Senate, and the Committee on Homeland ‘‘Sec. 2220A. National risk management work sensor programs, on a platform that
Security of the House of Representatives a cycle.’’. enables query and analysis;
report on the risks identified by the process (2) ADDITIONAL TECHNICAL AMENDMENT.— (2) enable cross-correlation of data on cy-
established under subparagraph (A)— (A) AMENDMENT.—Section 904(b)(1) of the bersecurity risks and cybersecurity threats
‘‘(i) not later than 1 year after the date of DOTGOV Act of 2020 (title IX of division U of at the speed and scale necessary for rapid de-
enactment of this section; and Public Law 116–260) is amended, in the mat- tection and identification;
‘‘(ii) not later than 1 year after the date on ter preceding subparagraph (A), by striking (3) facilitate a comprehensive under-
which the Secretary submits a periodic eval- ‘‘Homeland Security Act’’ and inserting standing of cybersecurity risks and cyberse-
uation described in section 9002(b)(2) of title ‘‘Homeland Security Act of 2002’’. curity threats; and
XC of division H of the William M. (Mac) (B) EFFECTIVE DATE.—The amendment (4) facilitate collaborative analysis be-
Thornberry National Defense Authorization made by subparagraph (A) shall take effect tween the Federal Government and public
Act for Fiscal Year 2021 (Public Law 116–283). as if enacted as part of the DOTGOV Act of and private sector critical infrastructure en-
‘‘(2) NATIONAL CRITICAL INFRASTRUCTURE 2020 (title IX of division U of Public Law 116– tities and information and analysis organiza-
RESILIENCE STRATEGY.— 260). tions.
‘‘(A) IN GENERAL.—Not later than 1 year TITLE LII—IMPROVING THE ABILITY OF (c) IMPLEMENTATION OF INFORMATION COL-
after the date on which the Secretary deliv- THE FEDERAL GOVERNMENT TO ASSIST LABORATION ENVIRONMENT.—
ers each report required under paragraph (1), IN ENHANCING CRITICAL INFRASTRUC- (1) EVALUATION.—Not later than 180 days
the President shall deliver to majority and TURE CYBER RESILIENCE after the date of enactment of this Act, the
minority leaders of the Senate, the Speaker SEC. 5201. INSTITUTE A 5-YEAR TERM FOR THE Secretary, acting through the Director of
and minority leader of the House of Rep- DIRECTOR OF THE CYBERSECURITY the Cybersecurity and Infrastructure Secu-
resentatives, the Committee on Homeland AND INFRASTRUCTURE SECURITY rity Agency, and in coordination with the
Security and Governmental Affairs of the AGENCY. Secretary of Defense, the Director of Na-
Senate, and the Committee on Homeland Se- (a) IN GENERAL.—Subsection (b)(1) of sec- tional Intelligence, and the Attorney Gen-
curity of the House of Representatives a na- tion 2202 of the Homeland Security Act of eral, shall—
tional critical infrastructure resilience 2002 (6 U.S.C. 652), is amended by inserting (A) identify, inventory, and evaluate exist-
strategy designed to address the risks identi- ‘‘The term of office of an individual serving ing Federal sources of classified and unclas-
fied by the Secretary. as Director shall be 5 years.’’ after ‘‘who sified information on cybersecurity threats;
‘‘(B) ELEMENTS.—Each strategy delivered shall report to the Secretary.’’. (B) evaluate current programs, applica-
under subparagraph (A) shall— (b) TRANSITION RULES.—The amendment tions, or platforms intended to detect, iden-
‘‘(i) identify, assess, and prioritize areas of made by subsection (a) shall take effect on tify, analyze, and monitor cybersecurity
risk to critical infrastructure that would the first appointment of an individual to the risks and cybersecurity threats;
compromise or disrupt national critical position of Director of the Cybersecurity and (C) consult with public and private sector
functions impacting national security, eco- Infrastructure Security Agency, by and with critical infrastructure entities to identify
nomic security, or public health and safety; the advice and consent of the Senate, that is public and private critical infrastructure
‘‘(ii) assess the implementation of the pre- made on or after the date of enactment of cyber threat capabilities, needs, and gaps;
vious national critical infrastructure resil- this Act. and
ience strategy, as applicable; SEC. 5202. CYBER THREAT INFORMATION COL- (D) identify existing tools, capabilities,
‘‘(iii) identify and outline current and pro- LABORATION ENVIRONMENT PRO- and systems that may be adapted to achieve
posed national-level actions, programs, and GRAM. the purposes of the environment in order to
efforts to be taken to address the risks iden- (a) DEFINITIONS.—In this section: maximize return on investment and mini-
tified; (1) CRITICAL INFRASTRUCTURE INFORMA- mize cost.
‘‘(iv) identify the Federal departments or TION.—The term ‘‘critical infrastructure in- (2) IMPLEMENTATION.—
ctelli on DSK11ZRN23PROD with SENATE
agencies responsible for leading each na- formation’’ has the meaning given such term (A) IN GENERAL.—Not later than 1 year
tional-level action, program, or effort and in section 2222 of the Homeland Security Act after completing the evaluation required
the relevant critical infrastructure sectors of 2002 (6 U.S.C. 671). under paragraph (1)(B), the Secretary, acting
for each; and (2) CYBER THREAT INDICATOR.—The term through the Director of the Cybersecurity
‘‘(v) request any additional authorities ‘‘cyber threat indicator’’ has the meaning and Infrastructure Security Agency, and in
necessary to successfully execute the strat- given such term in section 102 of the Cyber- consultation with the Secretary of Defense,
egy. security Act of 2015 (6 U.S.C. 1501). the Director of National Intelligence, and
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00051 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.047 S18NOPT1
S8458 CONGRESSIONAL RECORD — SENATE November 18, 2021
the Attorney General, shall begin implemen- (E) additional authorities or resources nec- which the individual occupying such position
tation of the environment to enable partici- essary to successfully execute the environ- performs, manages, or supervises functions
pants in the environment to develop and run ment; and that execute the responsibilities of the Of-
analytic tools referred to in subsection (b) on (F) identified shortcomings or risks to data fice.
specified data sets for the purpose of identi- security and privacy, and the steps necessary (b) HIRING PLAN.—The Director shall, for
fying, mitigating, and preventing malicious to improve the mitigation of the short- purposes of carrying out the functions of the
cyber activity that is a threat to public and comings or risks. Office—
private critical infrastructure. (d) CYBER THREAT DATA INTEROPERABILITY (1) craft an implementation plan for posi-
(B) REQUIREMENTS.—The environment and REQUIREMENTS.— tions in the excepted service in the Office,
the use of analytic tools referred to in sub- (1) ESTABLISHMENT.—The Secretary, in co- which shall propose—
section (b) shall— ordination with the Secretary of Defense, (A) qualified positions in the Office, as the
(i) operate in a manner consistent with rel- the Director of National Intelligence, and Director determines necessary to carry out
evant privacy, civil rights, and civil liberties the Attorney General, shall identify or es- the responsibilities of the Office; and
policies and protections, including such poli- tablish data interoperability requirements (B) subject to the requirements of para-
for non-Federal entities to participate in the graph (2), rates of compensation for an indi-
cies and protections established pursuant to
environment. vidual serving in a qualified position;
section 1016 of the Intelligence Reform and
(2) DATA STREAMS.—The Secretary, in co- (2) propose rates of basic pay for qualified
Terrorism Prevention Act of 2004 (6 U.S.C.
ordination with the heads of appropriate de- positions, which shall—
485);
partments and agencies, shall identify, des- (A) be determined in relation to the rates
(ii) account for appropriate data interoper- of pay provided for employees in comparable
ability requirements; ignate, and periodically update programs
that shall participate in or be interoperable positions in the Office, in which the em-
(iii) enable integration of current applica- ployee occupying the comparable position
tions, platforms, data, and information, in- with the environment, in a manner con-
sistent with data security standards under performs, manages, or supervises functions
cluding classified information, in a manner that execute the mission of the Office; and
that supports the voluntary integration of Federal law, which may include—
(A) network-monitoring and intrusion de- (B) subject to the same limitations on
unclassified and classified information on maximum rates of pay and consistent with
cybersecurity risks and cybersecurity tection programs;
(B) cyber threat indicator sharing pro- section 5341 of title 5, United States Code,
threats; adopt such provisions of that title to provide
(iv) incorporate tools to manage access to grams;
(C) certain government-sponsored network for prevailing rate systems of basic pay and
classified and unclassified data, as appro- apply those provisions to qualified positions
priate; sensors or network-monitoring programs;
for employees in or under which the Office
(v) ensure accessibility by entities the Sec- (D) incident response and cybersecurity
may employ individuals described by section
retary, in consultation with the Secretary of technical assistance programs; or
5342(a)(2)(A) of such title; and
Defense, the Director of National Intel- (E) malware forensics and reverse-engi-
(3) craft proposals to provide—
ligence, and the Attorney General, deter- neering programs.
(A) employees in qualified positions com-
mines appropriate; (3) DATA GOVERNANCE.—The Secretary, in
pensation (in addition to basic pay), includ-
(vi) allow for access by critical infrastruc- coordination with the Secretary of Defense,
ing benefits, incentives, and allowances, con-
ture stakeholders and other private sector the Director of National Intelligence, and
sistent with, and not in excess of the level
partners, at the discretion of the Secretary, the Attorney General, shall establish proce-
authorized for, comparable positions author-
in consultation with the Secretary of De- dures and data governance structures, as ized by title 5, United States Code; and
fense, the Director of National Intelligence, necessary, to protect data shared in the envi- (B) employees in a qualified position for
and the Attorney General; ronment, comply with Federal regulations which the Director proposes a rate of basic
(vii) deploy analytic tools across classifica- and statutes, and respect existing consent pay under paragraph (2) an allowance under
tion levels to leverage all relevant data sets, agreements with private sector critical in- section 5941 of title 5, United States Code, on
as appropriate; frastructure entities that apply to critical the same basis and to the same extent as if
(viii) identify tools and analytical software infrastructure information. the employee was an employee covered by
that can be applied and shared to manipu- (4) RULE OF CONSTRUCTION.—Nothing in this such section, including eligibility condi-
late, transform, and display data and other subsection shall change existing ownership tions, allowance rates, and all other terms
identified needs; and or protection of, or policies and processes for and conditions in law or regulation.
(ix) anticipate the integration of new tech- access to, agency data. ---
nologies and data streams, including data (e) NATIONAL SECURITY SYSTEMS.—Nothing SA 4785. Mr. OSSOFF (for himself,
from government-sponsored network sensors in this section shall apply to national secu- Mr. KING, Ms. CORTEZ MASTO, Mr.
or network-monitoring programs deployed in rity systems, as defined in section 3552 of ROUNDS, and Mr. KELLY) submitted an
support of non-Federal entities. title 44, United States Code, or to cybersecu-
amendment intended to be proposed to
(3) ANNUAL REPORT REQUIREMENT ON THE IM- rity threat intelligence related to such sys-
tems, without the consent of the relevant amendment SA 3867 submitted by Mr.
PLEMENTATION, EXECUTION, AND EFFECTIVE-
element of the intelligence community, as REED and intended to be proposed to
NESS OF THE PROGRAM.—Not later than 1 year
defined in section 3 of the National Security the bill H.R. 4350, to authorize appro-
after the date of enactment of this Act, and
every year thereafter until the date that is 1 Act of 1947 (50 U.S.C. 3003). priations for fiscal year 2022 for mili-
year after the program under this section (f) PROTECTION OF INTELLIGENCE SOURCES tary activities of the Department of
terminates under subsection (g), the Sec- AND METHODS.—The Director of National In- Defense, for military construction, and
retary shall submit to the Committee on telligence shall ensure that any information for defense activities of the Depart-
Homeland Security and Governmental Af- sharing conducted under this section shall ment of Energy, to prescribe military
fairs, the Committee on the Judiciary, the protect intelligence sources and methods personnel strengths for such fiscal
Committee on Armed Services, and the Se- from unauthorized disclosure in accordance
with section 102A(i) of the National Security
year, and for other purposes; which was
lect Committee on Intelligence of the Senate ordered to lie on the table; as follows:
and the Committee on Homeland Security, Act (50 U.S.C. 3024(i)).
(g) DURATION.—The program under this At the appropriate place, insert the fol-
the Committee on the Judiciary, the Com- lowing:
mittee on Armed Services, and the Perma- section shall terminate on the date that is 5
years after the date of enactment of this SEC. ll. DR. DAVID SATCHER CYBERSECURITY
nent Select Committee on Intelligence of the EDUCATION GRANT PROGRAM.
House of Representatives a report that de- Act.
(a) SHORT TITLE.—This section may be
tails— TITLE LIII—ENABLING THE NATIONAL cited as the ‘‘Cybersecurity Opportunity
(A) Federal Government participation in CYBER DIRECTOR Act’’.
the environment, including the Federal enti- SEC. 5401. ESTABLISHMENT OF HIRING AUTHORI- (b) DEFINITIONS.—In this section:
ties participating in the environment and TIES FOR THE OFFICE OF THE NA- (1) DIRECTOR.—The term ‘‘Director’’ means
the volume of information shared by Federal TIONAL CYBER DIRECTOR. the Director of the National Institute of
entities into the environment; (a) DEFINITIONS.—In this section: Standards and Technology.
(B) non-Federal entities’ participation in (1) DIRECTOR.—The term ‘‘Director’’ means (2) ENROLLMENT OF NEEDY STUDENTS.—The
the environment, including the non-Federal the National Cyber Director. term ‘‘enrollment of needy students’’ has the
entities participating in the environment (2) EXCEPTED SERVICE.—The term ‘‘ex- meaning given the term in section 312(d) of
and the volume of information shared by cepted service’’ has the meaning given such the Higher Education Act of 1965 (20 U.S.C.
ctelli on DSK11ZRN23PROD with SENATE
non-Federal entities into the environment; term in section 2103 of title 5, United States 1058(d)).
(C) the impact of the environment on posi- Code. (3) HISTORICALLY BLACK COLLEGE OR UNI-
tive security outcomes for the Federal Gov- (3) OFFICE.—The term ‘‘Office’’ means the VERSITY.—The term ‘‘historically Black col-
ernment and non-Federal entities; Office of the National Cyber Director. lege or university’’ has the meaning given
(D) barriers identified to fully realizing the (4) QUALIFIED POSITION.—The term ‘‘quali- the term ‘‘part B institution’’ as defined in
benefit of the environment both for the Fed- fied position’’ means a position identified by section 322 of the Higher Education Act of
eral Government and non-Federal entities; the Director under subsection (b)(1)(A), in 1965 (20 U.S.C. 1061).
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00052 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.047 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8459
(4) INSTITUTION OF HIGHER EDUCATION.—The a report on the status and progress of imple- priations for fiscal year 2022 for mili-
term ‘‘institution of higher education’’ has mentation of the grant program under this tary activities of the Department of
the meaning given the term in section 101(a) section, including on the number and nature Defense, for military construction, and
of the Higher Education Act of 1965 (20 U.S.C. of institutions participating, the number and for defense activities of the Depart-
1001(a)). nature of students served by institutions re-
(5) MINORITY-SERVING INSTITUTION.—The ceiving grants, the level of funding provided
ment of Energy, to prescribe military
term ‘‘minority-serving institution’’ means to grant recipients, the types of activities personnel strengths for such fiscal
an institution listed in section 371(a) of the being funded by the grants program, and year, and for other purposes; which was
Higher Education Act of 1965 (20 U.S.C. plans for future implementation and devel- ordered to lie on the table; as follows:
1067q(a)). opment; and At the end of title VII, add the following:
(c) AUTHORIZATION OF GRANTS.— (2) 5 years after the effective date of this Subtitle D—Access to Contraception
(1) IN GENERAL.—Subject to the avail- section, as provided in subsection (h), the Di- SEC. 761. SHORT TITLE.
ability of appropriations, the Director shall rector shall prepare and submit to Congress This subtitle may be cited as the ‘‘Access
carry out the Dr. David Satcher Cybersecu- a report on the status of cybersecurity edu- to Contraception for Servicemembers and
rity Education Grant Program by— cation programming and capacity-building Dependents Act of 2021’’.
(A) awarding grants to assist institutions at institutions receiving grants under this SEC. 762. FINDINGS.
of higher education that have an enrollment section, including changes in the scale and Congress finds the following:
of needy students, historically Black col- scope of these programs, associated facili- (1) Women are serving in the Armed Forces
leges and universities, and minority-serving ties, or in accreditation status, and on the at increasing rates, playing a critical role in
institutions, to establish or expand cyberse- educational and employment outcomes of the national security of the United States.
curity programs, to build and upgrade insti- students participating in cybersecurity pro- Women comprise more than 18 percent of
tutional capacity to better support new or grams that have received support under this members of the Armed Forces, and as of fis-
existing cybersecurity programs, including section. cal year 2019, more than 390,000 women serve
cybersecurity partnerships with public and (g) PERFORMANCE METRICS.—The Director on active duty in the Armed Forces or in the
private entities, and to support such institu- shall establish performance metrics for reserve components. An estimated several
tions on the path to producing qualified en- grants awarded under this section. thousand transgender men also serve on ac-
trants in the cybersecurity workforce or be- (h) EFFECTIVE DATE.—This section shall tive duty in the Armed Forces and in the re-
coming a National Center of Academic Ex- take effect 1 year after the date of enact- serve components, in addition to non-binary
cellence in Cybersecurity; and ment of this Act. members and those who identify with a dif-
(B) awarding grants to build capacity at ferent gender.
institutions of higher education that have an SA 4786. Mr. MENENDEZ (for him-
(2) Ninety-five percent of women serving in
enrollment of needy students, historically self, Mr. SCHUMER, Mr. BOOKER, Mrs. the Armed Forces are of reproductive age
Black colleges and universities, and minor- GILLIBRAND, Mr. BLUMENTHAL, and Mr. and as of 2019, more than 700,000 female
ity-serving institutions, to expand cyberse- MURPHY) submitted an amendment in- spouses and dependents of members of the
curity education opportunities, cybersecu- tended to be proposed to amendment Armed Forces on active duty are of repro-
rity programs, cybersecurity research, and SA 3867 submitted by Mr. REED and in- ductive age.
cybersecurity partnerships with public and (3) The TRICARE program covered more
private entities.
tended to be proposed to the bill H.R.
4350, to authorize appropriations for than 1,570,000 women of reproductive age in
(2) RESERVATION.—The Director shall 2019, including spouses and dependents of
award not less than 50 percent of the amount fiscal year 2022 for military activities
members of the Armed Forces on active
available for grants under this section to his- of the Department of Defense, for mili- duty. Additionally, thousands of transgender
torically Black colleges and universities and tary construction, and for defense ac- dependents of members of the Armed Forces
minority-serving institutions. tivities of the Department of Energy, are covered by the TRICARE program.
(3) COORDINATION.—The Director shall to prescribe military personnel (4) The right to access contraception is
carry out this section in consultation with strengths for such fiscal year, and for grounded in the principle that contraception
appropriate Federal agencies. and the ability to determine if and when to
(4) SUNSET.—The Director’s authority to
other purposes; which was ordered to
lie on the table; as follows: have children are inextricably tied to one’s
award grants under paragraph (1) shall ter- wellbeing, equality, and ability to determine
minate on the date that is 5 years after the At the appropriate place, insert the fol-
the course of one’s life. These protections
date the Director first awards a grant under lowing:
have helped access to contraception become
paragraph (1). SEC. lllll. APPROPRIATIONS FOR CATCH-UP
PAYMENTS.
a driving force in improving the health and
(d) APPLICATIONS.—An eligible institution
financial security of individuals and their
seeking a grant under subsection (a) shall Section 404(d)(4)(C) of the Justice for
families.
submit an application to the Director at United States Victims of State Sponsored
(5) Access to contraception is critical to
such time, in such manner, and containing Terrorism Act (34 U.S.C. 20144(d)(4)(C)) is
the health of every individual capable of be-
such information as the Director may rea- amended by adding at the end the following:
sonably require, including a statement of coming pregnant. This subtitle is intended to
‘‘(iv) FUNDING.—
how the institution will use the funds award- apply to all individuals with the capacity for
‘‘(I) APPROPRIATIONS.—
ed through the grant to expand cybersecu- pregnancy, including cisgender women,
‘‘(aa) IN GENERAL.—There are authorized to
rity education opportunities at the eligible transgender men, non-binary individuals,
be appropriated and there are appropriated
institution. those who identify with a different gender,
to the Fund such sums as may be necessary
(e) ACTIVITIES.—An eligible institution and others.
to carry out this subparagraph, to remain
that receives a grant under this section may (6) Studies have shown that when cost bar-
available until expended.
use the funds awarded through such grant for riers to the full range of methods of contra-
‘‘(bb) EMERGENCY DESIGNATION.—The
increasing research, education, technical, ception are eliminated, patients are more
amounts provided under this subclause are
partnership, and innovation capacity, includ- likely to use the contraceptive method that
designated as an emergency requirement
ing for— meets their needs, and therefore use contra-
pursuant to section 4(g) of the Statutory
(1) building and upgrading institutional ca- ception correctly and more consistently, re-
Pay-As-You-Go Act of 2010 (2 U.S.C. 933(g)).
pacity to better support new or existing cy- ducing the risk of unintended pregnancy.
‘‘(cc) DESIGNATION IN THE HOUSE AND SEN-
bersecurity programs, including cybersecu- (7) Under the TRICARE program, members
ATE.—This subclause is designated by the
rity partnerships with public and private en- of the Armed Forces on active duty have full
Congress as being for an emergency require-
tities; coverage of all prescription drugs, including
ment pursuant to section 4001(a)(1) and sec-
(2) building and upgrading institutional ca- contraception, without cost-sharing require-
tion 4001(b) of S. Con. Res. 14 (117th Con-
pacity to provide hands-on research and ments, in line with the Patient Protection
gress), the concurrent resolution on the
training experiences for undergraduate and and Affordable Care Act (Public Law 111–148),
budget for fiscal year 2022.
graduate students; and which requires coverage of all contraceptive
‘‘(II) LIMITATION.—Amounts appropriated
(3) outreach and recruitment to ensure stu- methods approved by the Food and Drug Ad-
pursuant to subclause (I) may not be used for
dents are aware of such new or existing cy- ministration for women and related services
a purpose other than to make lump sum
bersecurity programs, including cybersecu- and education and counseling. However,
catch-up payments under this subpara-
rity partnerships with public and private en- members not on active duty and dependents
graph.’’.
tities. of members do not have similar coverage of
ctelli on DSK11ZRN23PROD with SENATE
(f) REPORTING REQUIREMENTS.—Not later SA 4787. Mrs. SHAHEEN (for herself all methods of contraception approved by the
than— Food and Drug Administration without cost-
and Ms. COLLINS) submitted an amend-
(1) 1 year after the effective date of this sharing when they obtain the contraceptive
section, as provided in subsection (h), and ment intended to be proposed to outside of a military medical treatment fa-
annually thereafter until the Director sub- amendment SA 3867 submitted by Mr. cility.
mits the report under paragraph (2), the Di- REED and intended to be proposed to (8) In order to fill gaps in coverage and ac-
rector shall prepare and submit to Congress the bill H.R. 4350, to authorize appro- cess to preventive care critical for women’s
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00053 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.045 S18NOPT1
S8460 CONGRESSIONAL RECORD — SENATE November 18, 2021
health, the Patient Protection and Afford- sharing amounts may not be collected with (B) At such other times as each Secretary
able Care Act (Public Law 111–148) requires respect to any beneficiary enrolled in of a military department determines appro-
all non-grandfathered individual and group TRICARE Prime for a service described in priate with respect to members of the Armed
health plans to cover without cost-sharing paragraph (2) that is provided under Forces under the jurisdiction of such Sec-
preventive services, including a set of evi- TRICARE Prime. retary.
dence-based preventive services for women ‘‘(2) A service described in this paragraph (3) SENSE OF CONGRESS.—It is the sense of
supported by the Health Resources and Serv- is any method of contraception approved by Congress that the education programs under
ices Administration of the Department of the Food and Drug Administration, any con- paragraph (1) should be evidence-informed
Health and Human Services. These women’s traceptive care (including with respect to in- and use the latest technology available to ef-
preventive services include the full range of sertion, removal, and follow up), any steri- ficiently and effectively deliver information
female-controlled contraceptive methods, ef- lization procedure, or any patient education to members of the Armed Forces.
fective family planning practices, and steri- or counseling service provided in connection (b) ELEMENTS.—The uniform standard cur-
lization procedures, approved by the Food with any such method, care, or procedure.’’. riculum for education programs under sub-
and Drug Administration. The Health Re- SEC. 764. PREGNANCY PREVENTION ASSISTANCE section (a) shall include the following:
sources and Services Administration has af- AT MILITARY MEDICAL TREATMENT (1) Information for members of the Armed
firmed that contraceptive care includes con- FACILITIES FOR SEXUAL ASSAULT Forces on active duty to make informed de-
traceptive counseling, initiation of contra- SURVIVORS. cisions regarding family planning.
ceptive use, and follow-up care (such as man- (a) IN GENERAL.—Chapter 55 of title 10, (2) Information about the prevention of un-
agement, evaluation, and changes to and re- United States Code, is amended by inserting intended pregnancy and sexually trans-
moval or discontinuation of the contracep- after section 1074o the following new section: mitted infections, including human immuno-
tive method). ‘‘§ 1074p. Provision of pregnancy prevention deficiency virus (commonly known as
(9) The Defense Advisory Committee on assistance at military medical treatment fa- ‘‘HIV’’).
Women in the Services has recommended cilities (3) Information on—
that all the Armed Forces, to the extent that ‘‘(a) INFORMATION AND ASSISTANCE.—The (A) the importance of providing com-
they have not already, implement initiatives Secretary of Defense shall promptly furnish prehensive family planning for members of
that inform members of the Armed Forces of to sexual assault survivors at each military the Armed Forces, including commanding of-
the importance of family planning, educate medical treatment facility the following: ficers; and
them on methods of contraception, and make ‘‘(1) Comprehensive, medically and factu- (B) the positive impact family planning
various methods of contraception available, ally accurate, and unbiased written and oral can have on the health and readiness of the
based on the finding that family planning information about all methods of emergency Armed Forces.
can increase the overall readiness and qual- contraception approved by the Food and (4) Current, medically accurate informa-
ity of life of all members of the Armed Drug Administration. tion.
Forces. ‘‘(2) Upon request by the sexual assault (5) Clear, user-friendly information on—
(10) The military departments received survivor, emergency contraception or, if ap- (A) the full range of methods of contracep-
more than 7,800 reports of sexual assaults in- plicable, a prescription for emergency con- tion approved by the Food and Drug Admin-
volving members of the Armed Forces as vic- traception. istration; and
tims or subjects during fiscal year 2019. ‘‘(3) Notification of the right of the sexual (B) where members of the Armed Forces
Through regulations, the Department of De- assault survivor to confidentiality with re- can access their chosen method of contracep-
fense already supports a policy of ensuring spect to the information and care and serv- tion.
that members of the Armed Forces who are ices furnished under this section. (6) Information on all applicable laws and
sexually assaulted have access to emergency ‘‘(b) INFORMATION.—The Secretary shall en- policies so that members of the Armed
contraception, and the initiation of contra- sure that information provided pursuant to Forces are informed of their rights and obli-
ception if desired and medically appropriate. subsection (a) is provided in language that— gations.
SEC. 763. CONTRACEPTION COVERAGE PARITY ‘‘(1) is clear and concise; (7) Information on the rights of patients to
UNDER THE TRICARE PROGRAM. ‘‘(2) is readily comprehensible; and confidentiality.
(a) PHARMACY BENEFITS PROGRAM.—Sec- ‘‘(3) meets such conditions (including con- (8) Information on the unique cir-
tion 1074g(a)(6) of title 10, United States ditions regarding the provision of informa- cumstances encountered by members of the
Code, is amended by adding at the end the tion in languages other than English) as the Armed Forces and the effects of such cir-
following new subparagraph: Secretary may prescribe in regulations to cumstances on the use of contraception.
‘‘(D) Notwithstanding subparagraphs (A), carry out this section.
(B), and (C), cost-sharing requirements may ‘‘(c) DEFINITIONS.—In this section: SA 4788. Mr. LEE submitted an
not be imposed and cost-sharing amounts ‘‘(1) The term ‘sexual assault survivor’ amendment intended to be proposed to
may not be collected with respect to any eli- means any individual who presents at a mili- amendment SA 3867 submitted by Mr.
gible covered beneficiary for any prescrip- tary medical treatment facility and— REED and intended to be proposed to
tion contraceptive on the uniform formulary ‘‘(A) states to personnel of the facility that the bill H.R. 4350, to authorize appro-
provided through a retail pharmacy de- the individual experienced a sexual assault;
scribed in paragraph (2)(E)(ii) or through the
priations for fiscal year 2022 for mili-
‘‘(B) is accompanied by another person who tary activities of the Department of
national mail-order pharmacy program.’’. states that the individual experienced a sex-
(b) TRICARE SELECT.—Section 1075 of such Defense, for military construction, and
ual assault; or
title is amended— for defense activities of the Depart-
‘‘(C) whom the personnel of the facility
(1) in subsection (c), by adding at the end
reasonably believes to be a survivor of sexual ment of Energy, to prescribe military
the following new paragraph: personnel strengths for such fiscal
assault.
‘‘(4)(A) Notwithstanding any other provi- year, and for other purposes; which was
‘‘(2) The term ‘sexual assault’ means the
sion of this section, cost-sharing require- ordered to lie on the table; as follows:
conduct described in section 1565b(c) of this
ments may not be imposed and cost-sharing
title that may result in pregnancy.’’. On page 621, strike lines 14 through 24 and
amounts may not be collected with respect
(b) CLERICAL AMENDMENT.—The table of insert the following:
to any beneficiary under this section for a
sections at the beginning of such chapter is cross-strait relations;
service described in subparagraph (B) that is
amended by inserting after the item relating (7) reinforcing the status of the Republic of
provided by a network provider.
to section 1074o the following new item: Singapore as a Major Security Cooperation
‘‘(B) A service described in this subpara-
graph is any method of contraception ap- ‘‘1074p. Provision of pregnancy prevention Partner of the United States and continuing
proved by the Food and Drug Administra- assistance at military medical to strengthen defense and security coopera-
tion, any contraceptive care (including with treatment facilities.’’. tion between the military forces of the Re-
respect to insertion, removal, and follow up), SEC. 765. EDUCATION ON FAMILY PLANNING FOR public of Singapore and the Armed Forces of
any sterilization procedure, or any patient MEMBERS OF THE ARMED FORCES. the United States, including through partici-
education or counseling service provided in (a) EDUCATION PROGRAMS.— pation in combined exercises and training,
connection with any such method, care, or (1) IN GENERAL.—Not later than one year including the use of the Foreign Military
procedure.’’; and after the date of the enactment of this Act, Sales Training Center at Ebbing Air Na-
(2) in subsection (f), by striking ‘‘cal- the Secretary of Defense shall establish a tional Guard Base in Fort Smith, Arkansas;
culated as’’ and inserting ‘‘calculated (ex- uniform standard curriculum to be used in and
cept as provided in subsection (c)(4)) as’’. education programs on family planning for (8) ensuring that the allies and partners re-
ctelli on DSK11ZRN23PROD with SENATE
(c) TRICARE PRIME.—Section 1075a of such all members of the Armed Forces, including ferred to in paragraphs (1) through (7) con-
title is amended by adding at the end the fol- both men and women members. tribute more than 50 percent of the total
lowing new subsection: (2) TIMING.—Education programs under cost of mutual defense efforts in the Indo-Pa-
‘‘(d) PROHIBITION ON COST-SHARING FOR paragraph (1) shall be provided to members cific region.
CERTAIN SERVICES.—(1) Notwithstanding sub- of the Armed Forces as follows:
sections (a), (b), and (c), cost-sharing re- (A) During the first year of service of the SA 4789. Mr. LEE submitted an
quirements may not be imposed and cost- member. amendment intended to be proposed to
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00054 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.045 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8461
amendment SA 3867 submitted by Mr. (E) Our ally Israel, under constant attack tary activities of the Department of
REED and intended to be proposed to from terrorist groups, experiences similar Defense, for military construction, and
the bill H.R. 4350, to authorize appro- issues with Israeli veterans facing symptoms for defense activities of the Depart-
priations for fiscal year 2022 for mili- of PTSD. The National Center for Traumatic
ment of Energy, to prescribe military
Stress and Resilience at Tel Aviv University
tary activities of the Department of found that five to eight percent of combat personnel strengths for such fiscal
Defense, for military construction, and soldiers experience some form of PTSD, and year, and for other purposes; which was
for defense activities of the Depart- during wartime, that figure rises to 15 to 20 ordered to lie on the table; as follows:
ment of Energy, to prescribe military percent. At the end of title XXXI, add the fol-
personnel strengths for such fiscal (F) Current treatment options in the lowing:
year, and for other purposes; which was United States focus on cognitive therapy, ex- Subtitle F—Toxic Exposure Safety
ordered to lie on the table; as follows: posure therapy, or eye movement desen-
SEC. 3161. SHORT TITLE.
On page 578, strike lines 14 through 19 and sitization and reprocessing, but the United
This subtitle may be cited as the ‘‘Toxic
insert the following: States must continue to look for more effec-
Exposure Safety Act of 2021’’.
(1) by striking ‘‘fiscal year 2021’’ and in- tive treatments. Several leading hospitals,
SEC. 3162. PROVIDING INFORMATION REGARD-
serting ‘‘fiscal year 2022’’; and academic institutions, and nonprofit organi-
ING DEPARTMENT OF ENERGY FA-
(2) by striking ‘‘, as specified in the fund- zations in Israel dedicate research and serv- CILITIES.
ing tables in division D of this Act’’. ices to treating PTSD.
Subtitle E of the Energy Employees Occu-
(2) SENSE OF CONGRESS.—It is the sense of
pational Illness Compensation Program Act
SA 4790. Mr. LEE submitted an Congress that the Secretary of Defense, act-
of 2000 (42 U.S.C. 7385s et seq.) is amended by
amendment intended to be proposed to ing through the Psychological Health and
inserting after section 3681 the following:
amendment SA 3867 submitted by Mr. Traumatic Brain Injury Research Program,
‘‘SEC. 3681A. COMPLETION AND UPDATES OF SITE
REED and intended to be proposed to should seek to explore scientific collabora- EXPOSURE MATRICES.
tion between academic institutions and non-
the bill H.R. 4350, to authorize appro- ‘‘(a) DEFINITION.—In this section, the term
profit research entities in the United States
priations for fiscal year 2022 for mili- and institutions in Israel with expertise in
‘site exposure matrices’ means an exposure
tary activities of the Department of assessment of a Department of Energy facil-
researching, diagnosing, and treating post-
Defense, for military construction, and ity that identifies the toxic substances or
traumatic stress disorder.
for defense activities of the Depart- processes that were used in each building or
(b) GRANT PROGRAM.—
process of the facility, including the trade
ment of Energy, to prescribe military (1) IN GENERAL.—The Secretary of Defense,
name (if any) of the substance.
personnel strengths for such fiscal in coordination with the Secretary of Vet-
‘‘(b) IN GENERAL.—Not later than 180 days
year, and for other purposes; which was erans Affairs and the Secretary of State,
after the date of enactment of the Toxic Ex-
ordered to lie on the table; as follows: shall award grants to eligible entities to
posure Safety Act of 2021, the Secretary of
carry out collaborative research between the
Strike section 1061. Labor shall, in coordination with the Sec-
United States and Israel with respect to
retary of Energy, create or update site expo-
SA 4791. Mr. MORAN (for himself and post-traumatic stress disorders.
sure matrices for each Department of Energy
Ms. ROSEN) submitted an amendment (2) AGREEMENT.—The Secretary of Defense
facility based on the records, files, and other
shall carry out the grant program under this
intended to be proposed to amendment section in accordance with the Agreement on
data provided by the Secretary of Energy
SA 3867 submitted by Mr. REED and in- and such other information as is available,
the United States-Israel binational science
tended to be proposed to the bill H.R. including information available from the
foundation with exchange of letters, signed
4350, to authorize appropriations for former worker medical screening programs
at New York September 27, 1972, and entered
fiscal year 2022 for military activities of the Department of Energy.
into force on September 27, 1972.
‘‘(c) PERIODIC UPDATE.—Beginning 90 days
of the Department of Defense, for mili- (c) ELIGIBLE ENTITIES.—To be eligible to
after the initial creation or update described
tary construction, and for defense ac- receive a grant under this section, an entity
in subsection (b), and each 90 days there-
tivities of the Department of Energy, shall be an academic institution or a non-
after, the Secretary shall update the site ex-
to prescribe military personnel profit entity located in the United States.
(d) AWARD.—The Secretary shall award posure matrices with all information avail-
strengths for such fiscal year, and for grants under this section to eligible entities able as of such time from the Secretary of
other purposes; which was ordered to that— Energy.
lie on the table; as follows: ‘‘(d) INFORMATION.—The Secretary of En-
(1) carry out a research project that—
At the end of subtitle C of title VII, add ergy shall furnish to the Secretary of Labor
(A) addresses a requirement in the area of
the following: any information that the Secretary of Labor
post-traumatic stress disorders that the Sec-
SEC. 744. GRANT PROGRAM FOR INCREASED CO- finds necessary or useful for the production
retary determines appropriate to research
OPERATION ON POST-TRAUMATIC of the site exposure matrices under this sec-
using such grant; and
STRESS DISORDER RESEARCH BE- tion, including records from the Department
(B) is conducted by the eligible entity and
TWEEN UNITED STATES AND ISRAEL. of Energy former worker medical screening
an entity in Israel under a joint research
(a) FINDINGS AND SENSE OF CONGRESS.— program.
agreement; and
(1) FINDINGS.—Congress makes the fol- ‘‘(e) PUBLIC AVAILABILITY.—The Secretary
(2) meet such other criteria that the Sec-
lowing findings: of Labor shall make available to the public,
retary may establish.
(A) The Department of Veterans Affairs re- (e) APPLICATION.—To be eligible to receive on the primary website of the Department of
ports that between 11 and 20 percent of vet- a grant under this section, an eligible entity Labor—
erans who served in Operation Iraqi Freedom ‘‘(1) the site exposure matrices, as periodi-
shall submit an application to the Secretary
and Operation Enduring Freedom have post- cally updated under subsections (b) and (c);
at such time, in such manner, and con-
traumatic stress disorder (in this paragraph ‘‘(2) each site profile prepared under sec-
taining such commitments and information
referred to as ‘‘PTSD’’) in a given year. In tion 3633(a);
as the Secretary may require.
addition, that figure amounts to about 12 (f) REPORTS.—Not later than 180 days after ‘‘(3) any other database used by the Sec-
percent of Gulf War veterans and up to 30 the date on which an eligible entity com- retary of Labor to evaluate claims for com-
percent of Vietnam veterans. pletes a research project using a grant under pensation under this title; and
(B) The Department of Veterans Affairs re- this section, the Secretary shall submit to ‘‘(4) statistical data, in the aggregate and
ports that among women veterans of the Congress a report that contains— disaggregated by each Department of Energy
conflicts in Iraq and Afghanistan, almost 20 (1) a description of how the eligible entity facility, regarding—
percent have been diagnosed with PTSD. used the grant; and ‘‘(A) the number of claims filed under this
(C) It is thought that 70 percent of individ- (2) an evaluation of the level of success of subtitle;
uals in the United States have experienced the research project. ‘‘(B) the types of illnesses claimed;
at least one traumatic event in their life- (g) TERMINATION.—The authority to award ‘‘(C) the number of claims filed for each
time, and approximately 20 percent of those grants under this section shall terminate on type of illness and, for each claim, whether
individuals have struggled or continue to the date that is seven years after the date on the claim was approved or denied;
struggle with symptoms of PTSD. which the first such grant is awarded. ‘‘(D) the number of claimants receiving
(D) Studies show that PTSD has links to compensation; and
homelessness and substance abuse in the SA 4792. Mrs. MURRAY (for herself ‘‘(E) the length of time required to process
ctelli on DSK11ZRN23PROD with SENATE
United States. The Department of Veterans and Mr. MANCHIN) submitted an amend- each claim, as measured from the date on
Affairs estimates that approximately 11 per- which the claim is filed to the final disposi-
ment intended to be proposed to
cent of the homeless population are veterans tion of the claim.
and the Substance Abuse and Mental Health amendment SA 3867 submitted by Mr. ‘‘(f) AUTHORIZATION OF APPROPRIATIONS.—
Services Administration estimates that REED and intended to be proposed to There is authorized to be appropriated to the
about seven percent of veterans have a sub- the bill H.R. 4350, to authorize appro- Secretary of Energy, for fiscal year 2022 and
stance abuse disorder. priations for fiscal year 2022 for mili- each succeeding year, such sums as may be
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00055 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.046 S18NOPT1
S8462 CONGRESSIONAL RECORD — SENATE November 18, 2021
necessary to support the Secretary of Labor ‘‘(2) CHOICE OF FORMAT.—The Secretary of (2) the term ‘‘institution of higher edu-
in creating or updating the site exposure Labor shall provide the copy of records de- cation’’ has the meaning given such term in
matrices.’’. scribed in paragraph (1) to an employee in section 101 of the Higher Education Act of
SEC. 3163. ASSISTING CURRENT AND FORMER electronic or paper form, as selected by the 1965 (20 U.S.C. 1001); and
EMPLOYEES UNDER THE EEOICPA. employee. (3) the term ‘‘Secretary’’ means the Sec-
(a) PROVIDING INFORMATION AND OUT- ‘‘(e) CONTACT OF EMPLOYEES BY INDUSTRIAL retary of Health and Human Services.
REACH.—Subtitle A of the Energy Employees HYGIENISTS.—The Secretary of Labor shall (b) ESTABLISHMENT.—The Secretary, acting
Occupational Illness Compensation Program allow industrial hygienists to contact and through the Director of the National Insti-
Act of 2000 (42 U.S.C. 7384d et seq.) is amend- interview current or former employees or tute of Environmental Health Sciences and
ed— Department of Energy contractor employees in collaboration with the Director of the
(1) by redesignating section 3614 as section regarding the employee’s claim under sub- Centers for Disease Control and Prevention,
3616; and title B or E.’’. shall conduct or support research on the epi-
(2) by inserting after section 3613 the fol- (b) EXTENDING APPEAL PERIOD.—Section demiological impacts of exposures to toxic
lowing: 3677(a) of the Energy Employees Occupa- substances at Department of Energy facili-
‘‘SEC. 3614. INFORMATION AND OUTREACH. tional Illness Compensation Program Act of ties.
2000 (42 U.S.C. 7385s–6(a)) is amended by (c) USE OF FUNDS.—Research under sub-
‘‘(a) ESTABLISHMENT OF TOLL-FREE INFOR-
striking ‘‘60 days’’ and inserting ‘‘180 days’’. section (b) may include research on the epi-
MATION PHONE NUMBER.—By not later than
(c) FUNDING.—Section 3684 of the Energy demiological, clinical, or health impacts on
January 1, 2023, the Secretary of Labor shall
Employees Occupational Illness Compensa- individuals who were exposed to toxic sub-
establish a toll-free phone number that cur-
tion Program Act of 2000 (42 U.S.C. 7385s–13) stances in or near the tank or other storage
rent or former employees of the Department
is amended— farms and other relevant Department of En-
of Energy, or current or former Department
(1) by striking ‘‘There is authorized’’ and ergy facilities through their work at such
of Energy contractor employees, may use in
inserting the following: sites.
order to receive information regarding— ‘‘(a) IN GENERAL.—There is authorized’’;
‘‘(1) the compensation program under sub- (d) ELIGIBILITY AND APPLICATION.—Any in-
(2) by inserting before the period at the end
title B or E; stitution of higher education or the National
the following: ‘‘, including the amounts nec-
‘‘(2) information regarding the process of Academy of Sciences may apply for funding
essary to carry out the requirements of sec-
submitting a claim under either compensa- under this section by submitting to the Sec-
tion 3681A’’; and
tion program; retary an application at such time, in such
(3) by adding at the end the following:
‘‘(3) assistance in completing the occupa- ‘‘(b) ADMINISTRATIVE COSTS FOR DEPART- manner, and containing or accompanied by
tional health questionnaire required as part MENT OF ENERGY.—There is authorized to be
such information as the Secretary may re-
of a claim under subtitle B or E; appropriated to the Secretary of Energy for quire.
‘‘(4) the next steps to take if a claim under fiscal year 2022 and each succeeding year (e) RESEARCH COORDINATION.—The Sec-
subtitle B or E is accepted or denied; and such sums as may be necessary to support retary shall coordinate activities under this
‘‘(5) such other information as the Sec- the Secretary in carrying out the require- section with similar activities conducted by
retary determines necessary to further the ments of this title, including section 3681A.’’. the Department of Health and Human Serv-
purposes of this title. (d) ADVISORY BOARD ON TOXIC SUBSTANCES ices to the extent that other agencies have
‘‘(b) ESTABLISHMENT OF RESOURCE AND AD- AND WORKER HEALTH.—Section 3687 of the responsibilities that are related to the study
VOCACY CENTERS.— Energy Employees Occupational Illness of epidemiological, clinical, or health im-
‘‘(1) IN GENERAL.—By not later than Janu- Compensation Program Act of 2000 (42 U.S.C. pacts of exposures to toxic substances.
ary 1, 2024, the Secretary of Energy, in co- 7385s–16) is amended— (f) HEALTH STUDIES REPORT TO SEC-
ordination with the Secretary of Labor, shall (1) in subsection (b)— RETARY.—Not later than 1 year after the end
establish a resource and advocacy center at (A) in paragraph (1)(F), by striking ‘‘and’’ of the funding period for research under this
each Department of Energy facility where after the semicolon; section, the funding recipient shall prepare
cleanup operations are being carried out, or (B) in paragraph (2), by striking the period and submit to the Secretary a final report
have been carried out, under the environ- at the end and inserting a semicolon; and that—
mental management program of the Depart- (C) by adding at the end the following: (1) summarizes the findings of the re-
ment of Energy. Each such resource and ad- ‘‘(3) develop recommendations for the Sec- search;
vocacy center shall assist current or former retary of Health and Human Services regard- (2) includes recommendations for any addi-
Department of Energy employees and cur- ing whether there is a class of Department of tional studies;
rent or former Department of Energy con- Energy employees, Department of Energy (3) describes any classes of employees that,
tractor employees, by enabling the employ- contractor employees, or other employees at based on the results of the report, could war-
ees and contractor employees to— any Department of Energy facility who were rant the establishment of a Special Exposure
‘‘(A) receive information regarding all re- at least as likely as not exposed to toxic sub- Cohort under the Energy Employees Occupa-
lated programs available to them relating to stances at that facility but for whom it is tional Illness Compensation Program Act of
potential claims under this title, including— not feasible to estimate with sufficient accu- 2000 (42 U.S.C. 7384 et seq.) for toxic sub-
‘‘(i) programs under subtitles B and E; and racy the dose they received; and stances exposures; and
‘‘(ii) the former worker medical screening ‘‘(4) review all existing, as of the date of (4) describes any illnesses to be included as
program of the Department of Energy; and the review, rules and guidelines issued by the covered illnesses under such Act (42 U.S.C.
‘‘(B) navigate all such related programs. Secretary regarding presumption of causa- 7384 et seq.).
‘‘(2) COORDINATION.—The Secretary of En- tion and provide the Secretary with rec- (g) REPORT TO CONGRESS.—
ergy shall integrate other programs avail- ommendations for new rules and guidelines (1) IN GENERAL.—Not later than 120 days
able to current and former employees, and regarding presumption of causation.’’; after the date on which the reports under
current or former Department of Energy (2) in subsection (c)(3), by inserting ‘‘or the subsection (f) are due, the Secretary shall—
contractor employees, which are related to Board’’ after ‘‘The Secretary’’; (A) identify a list of cancers and other ill-
the purposes of this title, with the resource (3) by redesignating subsections (h), (i), nesses associated with toxic substances that
and advocacy centers established under para- and (j) as subsections (i), (j), and (k), respec- pose, or posed, a hazard in the work environ-
graph (1), as appropriate. tively; and ment at any Department of Energy facility;
‘‘(c) INFORMATION.—The Secretary of Labor (4) by inserting after subsection (g) the fol- and
shall develop and distribute, through the re- lowing: (B) prepare and submit to the relevant
source and advocacy centers established ‘‘(h) REQUIRED RESPONSES TO BOARD REC- committees of Congress a report—
under subsection (b) and other means, infor- OMMENDATIONS.—Not later than 90 days after (i) summarizing the findings from the re-
mation (which may include responses to fre- the date on which the Secretary of Labor ports required under subsection (f);
quently asked questions) for current or and the Secretary of Health and Human (ii) identifying any new illnesses that, as a
former employees or current or former De- Services receive recommendations in accord- result of the study, will be included as cov-
partment of Energy contractor employees ance with paragraph (1), (3), or (4) of sub- ered illnesses, pursuant to subsection (f)(4)
about the programs under subtitles B and E section (b), each such Secretary shall submit and section 3671(2) of the Energy Employees
and the claims process under such programs. formal responses to each recommendation to Occupational Illness Compensation Program
‘‘(d) COPY OF EMPLOYEE’S CLAIMS the Board and Congress.’’. Act of 2000 (42 U.S.C. 7385s(2)); and
RECORDS.— SEC. 3164. RESEARCH PROGRAM ON EPIDEMIO- (iii) including the Secretary’s rec-
‘‘(1) IN GENERAL.—The Secretary of Labor LOGICAL IMPACTS OF TOXIC EXPO- ommendations for additional health studies
ctelli on DSK11ZRN23PROD with SENATE
shall, upon the request of a current or SURES. relating to toxic substances, if the Secretary
former employee or Department of Energy (a) DEFINITIONS.—In this section— determines it necessary.
contractor employee, provide the employee (1) the term ‘‘Department of Energy facil- (2) RELEVANT COMMITTEES OF CONGRESS DE-
with a complete copy of all records or other ity’’ has the meaning given the term in sec- FINED.—In this subsection, the term ‘‘rel-
materials held by the Department of Labor tion 3621 of the Energy Employees Occupa- evant committees of Congress’’ means—
relating to the employee’s claim under sub- tional Illness Compensation Program Act of (A) the Committee on Armed Services,
title B or E. 2000 (42 U.S.C. 7384l); Committee on Appropriations, Committee on
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00056 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.048 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8463
Energy and Natural Resources, and Com- cleanup eras of the Department of Energy (1) in the table of contents—
mittee on Health, Education, Labor, and cleanup sites; (A) by redesignating the item relating to
Pensions of the Senate; and ‘‘(D) survey the impact to health of the section 3614 as the item relating to section
(B) the Committee on Armed Services, toxic substance, focusing on hematologic, 3616;
Committee on Appropriations, Committee on renal, urologic, hepatic, gastrointestinal, (B) by inserting after the item relating to
Energy and Commerce, and Committee on neurologic, dermatologic, respiratory, endo- section 3613 the following:
Education and Labor of the House of Rep- crine, ocular, ear, nasal, and oropharyngeal ‘‘Sec. 3614. Information and outreach.
resentatives. diseases, including dementia, leukemia, ‘‘Sec. 3615. National Academy of Sciences
(h) AUTHORIZATION OF APPROPRIATIONS.— chemical sensitivities, and chronic obstruc- review.’’;
There is authorized to be appropriated to tive pulmonary disease; and and
carry out this section $3,000,000 for each of ‘‘(E) determine whether a plausible biologi- (C) by inserting after the item relating to
fiscal years 2022 through 2026. cal mechanism or other evidence of a causal section 3681 the following:
SEC. 3165. NATIONAL ACADEMY OF SCIENCES RE- relationship exists between exposure to the ‘‘Sec. 3681A. Completion and updates of site
VIEW. toxic substance and disease. exposure matrices.’’;
Subtitle A of the Energy Employees Occu- ‘‘(e) ADDITIONAL SCIENTIFIC STUDIES.—If and
pational Illness Compensation Program Act the National Academy of Sciences deter- (2) in each of subsections (b)(1) and (c) of
of 2000 (42 U.S.C. 7384d et seq.), as amended mines, in the course of conducting the stud- section 3612, by striking ‘‘3614(b)’’ and insert-
by section 3163, is further amended by insert- ies under subsection (d), that additional ing ‘‘3616(b)’’.
ing after section 3614 the following: studies are needed to resolve areas of con-
tinuing scientific uncertainty relating to
---
‘‘SEC. 3615. NATIONAL ACADEMY OF SCIENCES SA 4793. Mr. LEE (for himself and
REVIEW. toxic exposure at Department of Energy
cleanup sites, the National Academy of
Mr. DAINES) submitted an amendment
‘‘(a) PURPOSE.—The purpose of this section intended to be proposed to amendment
is to enable the National Academy of Sciences shall include, in the next report
Sciences, a non-Federal entity with appro- submitted under subsection (f), recommenda- SA 3867 submitted by Mr. REED and in-
priate expertise, to review and evaluate the tions for areas of additional study, con- tended to be proposed to the bill H.R.
available scientific evidence regarding asso- sisting of— 4350, to authorize appropriations for
ciations between diseases and exposure to ‘‘(1) a list of diseases and toxins that re- fiscal year 2022 for military activities
toxic substances found at Department of En- quire further evaluation and study; of the Department of Defense, for mili-
ergy cleanup sites. ‘‘(2) a review the current information tary construction, and for defense ac-
‘‘(b) DEFINITIONS.—In this section: available, as of the date of the report, relat-
ing to such diseases and toxins;
tivities of the Department of Energy,
‘‘(1) DEPARTMENT OF ENERGY CLEANUP to prescribe military personnel
SITE.—The term ‘Department of Energy ‘‘(3) the value of the information that
cleanup site’ means a Department of Energy would result from the additional studies; and strengths for such fiscal year, and for
facility where cleanup operations are being ‘‘(4) the cost and feasibility of carrying out other purposes; which was ordered to
carried out, or have been carried out, under additional studies. lie on the table; as follows:
the environmental management program of ‘‘(f) REPORTS.— In section 511, beginning in subsection
the Department of Energy. ‘‘(1) IN GENERAL.—By not later than 18 (d)(4), strike the period at the end of sub-
‘‘(2) HEALTH STUDIES REPORT.—The term months after the date of the agreement paragraph (B)(ii) and all that follows
‘health studies report’ means the report sub- under subsection (c), and every 2 years there- through subsection (g) and insert the fol-
mitted under section 3164(f) of the Toxic Ex- after, the National Academy of Sciences lowing: ‘‘; and
posure Safety Act of 2021. shall under such agreement prepare and sub- (C) by adding at the end the following new
‘‘(c) AGREEMENT.—The Secretary of Health mit a report to— subsection:
and Human Services shall seek to enter into ‘‘(A) the Secretary; ‘‘(p) No person may be inducted for train-
an agreement with the National Academy of ‘‘(B) the Committee on Health, Education, ing and service under this title if such per-
Sciences, not later than 60 days after the Labor, and Pensions and the Committee on son—
issuance of the health studies report, to Energy and Natural Resources of the Senate; ‘‘(1) has a dependent child and the other
carry out the requirements of this section. and parent of the dependent child has been in-
‘‘(d) REVIEW OF SCIENTIFIC AND MEDICAL ‘‘(C) the Committee on Natural Resources, ducted for training or service under this title
EVIDENCE.— the Committee on Education and Labor, and unless the person volunteers for such induc-
‘‘(1) IN GENERAL.—Under the agreement de- the Committee on Energy and Commerce of tion; or
scribed in subsection (c), the National Acad- the House of Representatives. ‘‘(2) has a dependent child who has no other
emy of Sciences shall, for the period of the ‘‘(2) CONTENTS.—Each report submitted living parent.’’.
agreement— under paragraph (1) shall include, for the 18- (5) Section 10(b)(3) (50 U.S.C. 3809(b)(3)) is
‘‘(A) for each area recommended for addi- month or 2-year period covered by the re- amended by striking ‘‘the President is re-
tional study under the health studies report port— quested’’ and all that follows through ‘‘race
under section 3164(f)(2) of the Toxic Exposure ‘‘(A) a description of— or national origin’’ and inserting ‘‘the Presi-
Safety Act of 2021, review and summarize the ‘‘(i) the reviews and studies conducted dent is requested to appoint the membership
scientific evidence relating to the area, in- under this section; of each local board so that each board has
cluding— ‘‘(ii) the determinations and conclusions of both male and female members and, to the
‘‘(i) studies by the Department of Energy the National Academy of Sciences with re- maximum extent practicable, it is propor-
and Department of Labor; and spect to such reviews and studies; and tionately representative of those registrants
‘‘(ii) any other available and relevant sci- ‘‘(iii) the scientific evidence and reasoning within its jurisdiction in each applicable
entific studies, to the extent that such stud- that led to such conclusions; basis set forth in section 703(a) of the Civil
ies are relevant to the occupational expo- ‘‘(B) the recommendations for further Rights Act of 1964 (42 U.S.C. 2002e–2(a)), but
sures that have occurred at Department of areas of study made under subsection (e) for no action by any board shall be declared in-
Energy cleanup sites; and the reporting period; valid on the ground that such board failed to
‘‘(B) review and summarize the scientific ‘‘(C) a description of any classes of employ- conform to such representation quota’’.
and medical evidence concerning the associa- ees that, based on the results of the reviews (6) Section 16(a) (50 U.S.C. 3814(a)) is
tion between exposure to toxic substances and studies, could qualify as a Special Expo- amended by striking ‘‘men’’ and inserting
found at Department of Energy cleanup sites sure Cohort; and ‘‘persons’’.
and resultant diseases. ‘‘(D) the identification of any illness that (e) MAINTAINING THE HEALTH OF THE SELEC-
‘‘(2) SCIENTIFIC DETERMINATIONS CON- the National Academy of Sciences has deter- TIVE SERVICE SYSTEM.—Section 10(a) (50
CERNING DISEASES.—In conducting each re- mined, as a result of the reviews and studies, U.S.C. 3809(a)) is amended by adding at the
view of scientific evidence under subpara- should be a covered illness. end the following new paragraph:
graphs (A) and (B) of paragraph (1), the Na- ‘‘(g) LIMITATION ON AUTHORITY.—The au- ‘‘(5) The Selective Service System shall
tional Academy of Sciences shall— thority to enter into agreements under this conduct exercises periodically of all mobili-
‘‘(A) assess the strength of such evidence; section shall be effective for a fiscal year to zation plans, systems, and processes to
‘‘(B) assess whether a statistical associa- the extent that appropriations are available. evaluate and test the effectiveness of such
tion between exposure to a toxic substance ‘‘(h) SUNSET.—This section shall cease to plans, systems, and processes. Once every 4
and a disease exists, taking into account the be effective 10 years after the last day of the years, the exercise shall include the full
ctelli on DSK11ZRN23PROD with SENATE
strength of the scientific evidence and the fiscal year in which the National Academy of range of internal and interagency procedures
appropriateness of the statistical and epide- Sciences transmits to the Secretary the first to ensure functionality and interoperability
miological methods used to detect an asso- report under subsection (f).’’. and may take place as part of the Depart-
ciation; SEC. 3166. CONFORMING AMENDMENTS. ment of Defense mobilization exercise under
‘‘(C) assess the increased risk of disease The Energy Employees Occupational Ill- section 10208 of title 10, United States Code.
among those exposed to the toxic substance ness Compensation Program Act of 2000 (42 The Selective Service System shall conduct
during service during the production and U.S.C. 7384 et seq.) is amended— a public awareness campaign in conjunction
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00057 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.048 S18NOPT1
S8464 CONGRESSIONAL RECORD — SENATE November 18, 2021
with each exercise to communicate the pur- (C) by striking ‘‘his consent’’ and inserting 2022 for military activities of the De-
pose of the exercise to the public.’’. ‘‘such member’s consent’’; partment of Defense, for military con-
(f) TECHNICAL AND CONFORMING AMEND- (10) in section 22(b) (50 U.S.C. 3820(b)), in struction, and for defense activities of
MENTS.—The Military Selective Service Act paragraphs (1) and (2), by striking ‘‘his’’ each
the Department of Energy, to prescribe
is amended— place it appears and inserting ‘‘the reg-
istrant’s’’; and military personnel strengths for such
(1) in section 4 (50 U.S.C. 3803)—
(11) except as otherwise provided in this fiscal year, and for other purposes;
(A) in subsection (a) in the third undesig-
nated paragraph— section— which was ordered to lie on the table;
(i) by striking ‘‘his acceptability in all re- (A) by striking ‘‘he’’ each place it appears as follows:
spects, including his’’ and inserting ‘‘such and inserting ‘‘such person’’; At the end of subtitle D of title XII, add
person’s acceptability in all respects, includ- (B) by striking ‘‘his’’ each place it appears the following:
ing such person’s’’; and and inserting ‘‘such person’s’’;
(C) by striking ‘‘him’’ each place it appears SEC. 1237. IMPOSITION OF SANCTIONS WITH RE-
(ii) by striking ‘‘he may prescribe’’ and in- SPECT TO NORD STREAM 2.
serting ‘‘the President may prescribe’’; and inserting ‘‘such person’’; and
(B) in subsection (c)— (D) by striking ‘‘present himself’’ each (a) IN GENERAL.—Not later than 15 days
(i) in paragraph (2), by striking ‘‘any en- place it appears in section 12 (50 U.S.C. 3811) after the date of the enactment of this Act,
listed member’’ and inserting ‘‘any person and inserting ‘‘appear’’. the President shall—
who is an enlisted member’’; and (g) ENACTMENT OF AUTHORIZATION RE- (1) impose sanctions under subsection (b)
(ii) in paragraphs (3), (4), and (5), by strik- QUIRED FOR DRAFT.— with respect to any corporate officer of an
ing ‘‘in which he resides’’ and inserting ‘‘in (1) FINDINGS.—Congress makes the fol- entity established for or responsible for the
which such person resides’’; lowing findings: planning, construction, or operation of the
(C) in subsection (g), by striking ‘‘coordi- (A) Clause 12 of section 8 of article I of the Nord Stream 2 pipeline or a successor entity;
nate with him’’ and inserting ‘‘coordinate Constitution of the United States empowers and
with the Director’’; and Congress with the responsibility to ‘‘raise (2) impose sanctions under subsection (c)
(D) in subsection (k)(1), by striking ‘‘find- and support Armies’’. with respect to any entity described in para-
ing by him’’ and inserting ‘‘finding by the (B) The United States first required mili- graph (1).
President’’; tary conscription in the American Civil War (b) INELIGIBILITY FOR VISAS, ADMISSION, OR
(2) in section 5(d) (50 U.S.C. 3805(d)), by under the Civil War Military Draft Act of PAROLE OF IDENTIFIED PERSONS AND COR-
striking ‘‘he may prescribe’’ and inserting 1863. PORATE OFFICERS.—
‘‘the President may prescribe’’; (C) The Selective Services Act of 1917 au- (1) IN GENERAL.—
(3) in section 6 (50 U.S.C. 3806)— thorized the President to draft additional (A) VISAS, ADMISSION, OR PAROLE.—An alien
(A) in subsection (c)(2)(D), by striking ‘‘he forces beyond the volunteer force to support described in subsection (a)(1) is—
may prescribe’’ and inserting ‘‘the President exceedingly high demand for additional (i) inadmissible to the United States;
may prescribe’’; forces when the U.S. entered the first World (ii) ineligible to receive a visa or other doc-
(B) in subsection (d)(3), by striking ‘‘he War. umentation to enter the United States; and
may deem appropriate’’ and inserting ‘‘the (D) The Selective Training and Service Act (iii) otherwise ineligible to be admitted or
President considers appropriate’’; and of 1940 was the first authorization by Con- paroled into the United States or to receive
(C) in subsection (h), by striking ‘‘he may gress for conscription in peacetime but lim- any other benefit under the Immigration and
prescribe’’ each place it appears and insert- ited the President’s induction authority to Nationality Act (8 U.S.C. 1101 et seq.).
ing ‘‘the President may prescribe’’; ‘‘no greater number of men than the Con- (B) CURRENT VISAS REVOKED.—
(4) in section 10 (50 U.S.C. 3809)— gress shall hereafter make specific appro- (i) IN GENERAL.—The visa or other entry
(A) in subsection (b)— priation for from time to time’’. documentation of an alien described in sub-
(i) in paragraph (3)— (E) Congress allowed induction authority section (a)(1) shall be revoked, regardless of
(I) by striking ‘‘He shall create’’ and in- to lapse in 1947. when such visa or other entry documenta-
serting ‘‘The President shall create’’; and (F) Congress reinstated the President’s in- tion is or was issued.
(II) by striking ‘‘upon his own motion’’ and duction authority under the Selective Serv- (ii) IMMEDIATE EFFECT.—A revocation
inserting ‘‘upon the President’s own mo- ice Act of 1948 to raise troops for United under clause (i) shall—
tion’’; States participation in the Korean War. (I) take effect immediately; and
(ii) in paragraph (4), by striking ‘‘his sta- (G) Congress maintained the President’s (II) automatically cancel any other valid
tus’’ and inserting ‘‘such individual’s sta- induction authority under the Selective visa or entry documentation that is in the
tus’’; and Service Act of 1948 through the beginning of alien’s possession.
(iii) in paragraphs (4), (6), (8), and (9), by the Vietnam War. (c) BLOCKING OF PROPERTY OF IDENTIFIED
striking ‘‘he may deem’’ each place it ap- (H) Congress passed additional reforms to PERSONS.—The President shall exercise all
pears and inserting ‘‘the President con- the draft under the Military Selective Serv- powers granted to the President by the
siders’’; and ice Act of 1967 in response to issues arising International Emergency Economic Powers
(B) in subsection (c), by striking ‘‘vested in from United States engagement in the Viet- Act (50 U.S.C. 1701 et seq.) to the extent nec-
him’’ and inserting ‘‘vested in the Presi- nam War. essary to block and prohibit all transactions
dent’’; (I) Congress prohibited any further use of in all property and interests in property of
(5) in section 13(b) (50 U.S.C. 3812(b)), by the draft after July 1, 1973. an entity described in subsection (a)(1) if
striking ‘‘regulation if he’’ and inserting (J) If a president seeks to reactivate the such property and interests in property are
‘‘regulation if the President’’; use of the draft, Congress would have to in the United States, come within the United
(6) in section 15 (50 U.S.C. 3813)— enact a law providing authorization for this States, or are or come within the possession
(A) in subsection (b), by striking ‘‘his’’ purpose or control of a United States person.
each place it appears and inserting ‘‘the reg- (2) AMENDMENT.—Section 17 of the Military (d) EXCEPTIONS.—
istrant’s’’; and Selective Service Act (50 U.S.C. 3815) is (1) EXCEPTION FOR INTELLIGENCE, LAW EN-
(B) in subsection (d), by striking ‘‘he may amended by adding at the end the following FORCEMENT, AND NATIONAL SECURITY ACTIVI-
deem’’ and inserting ‘‘the President con- new subsection: TIES.—Sanctions under this section shall not
‘‘(d) No person shall be inducted for train-
siders’’; apply to any authorized intelligence, law en-
ing and service in the Armed Forces unless
(7) in section 16(g) (50 U.S.C. 3814(g))— forcement, or national security activities of
Congress first passes and there is enacted a
(A) in paragraph (1), by striking ‘‘who as the United States.
law expressly authorizing such induction
his regular and customary vocation’’ and in- (2) EXCEPTION TO COMPLY WITH UNITED NA-
into service.’’.
serting ‘‘who, as such person’s regular and TIONS HEADQUARTERS AGREEMENT.—Sanctions
(h) EFFECTIVE DATE.—The amendments
customary vocation,’’; and made by this section shall take effect on the under this section shall not apply with re-
(B) in paragraph (2)— date of the enactment of this Act, except spect to the admission of an alien to the
(i) by striking ‘‘one who as his customary that the amendments made by subsections United States if the admission of the alien is
vocation’’ and inserting ‘‘a person who, as (d) and (g) shall take effect 1 year after such necessary to permit the United States to
such person’s customary vocation,’’; and date of enactment. comply with the Agreement regarding the
(ii) by striking ‘‘he is a member’’ and in- --- Headquarters of the United Nations, signed
serting ‘‘such person is a member’’; SA 4794. Mr. RISCH (for himself, Mr. at Lake Success June 26, 1947, and entered
(8) in section 18(a) (50 U.S.C. 3816(a)), by PORTMAN, Mr. CRUZ, Mr. BARRASSO, Mr. into force November 21, 1947, between the
ctelli on DSK11ZRN23PROD with SENATE
striking ‘‘he is authorized’’ and inserting JOHNSON, Mr. COTTON, and Mr. DAINES) United Nations and the United States, the
‘‘the President is authorized’’; Convention on Consular Relations, done at
(9) in section 21 (50 U.S.C. 3819)—
submitted an amendment intended to Vienna April 24, 1963, and entered into force
(A) by striking ‘‘he is sooner’’ and insert- be proposed to amendment SA 3867 sub- March 19, 1967, or other applicable inter-
ing ‘‘sooner’’; mitted by Mr. REED and intended to be national obligations.
(B) by striking ‘‘he’’ each subsequent place proposed to the bill H.R. 4350, to au- (3) EXCEPTION RELATING TO IMPORTATION OF
it appears and inserting ‘‘such member’’; and thorize appropriations for fiscal year GOODS.—
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00058 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.049 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8465
(A) IN GENERAL.—Notwithstanding any SEC. 1239. APPLICATION OF CONGRESSIONAL RE- ration of the agreement described in para-
other provision of this section, the authori- VIEW UNDER COUNTERING AMER- graph (2); and
ties and requirements to impose sanctions ICA’S ADVERSARIES THROUGH
(4) an assessment of whether the United
SANCTIONS ACT.
under this section shall not include the au- States and Germany have agreed on a com-
Section 216(a)(2) of the Countering Amer-
thority or a requirement to impose sanctions mon definition for energy ‘‘weaponization’’
ica’s Adversaries Through Sanctions Act (22
on the importation of goods. and the associated triggers for sanctions and
U.S.C. 9511(a)(2)) is amended—
(B) GOOD DEFINED.—In this paragraph, the other enforcement actions, pursuant to the
(1) in subparagraph (A)—
term ‘‘good’’ means any article, natural or Joint Statement of the United States and
(A) in clause (i), by inserting ‘‘(other than
man-made substance, material, supply or Germany on support for Ukraine, European
sanctions described in clause (i)(IV) of that
manufactured product, including inspection energy security, and our climate goals, dated
subparagraph)’’ after ‘‘subparagraph (B)’’;
and test equipment, and excluding technical July 21, 2021; and
and
data. (5) a description of the consultations with
(B) in clause (ii), by inserting ‘‘or other-
(e) CONDITIONS FOR REMOVAL OF SANC- United States allies and partners in Europe,
wise remove’’ after ‘‘waive’’; and
including Ukraine, Poland, and the countries
TIONS.—Subject to review by Congress under (2) in subparagraph (B)(i)—
in Central and Eastern Europe most im-
section 216 of the Countering America’s Ad- (A) in subclause (II), by striking ‘‘; or’’ and
pacted by the Nord Stream 2 pipeline con-
versaries Through Sanctions Act (22 U.S.C. inserting a semicolon;
cerning the matters agreed to as described in
9511), the President may waive the applica- (B) in subclause (III), by striking ‘‘; and’’
paragraph (4).
tion of sanctions under this section if the and inserting a semicolon; and ---
President— (C) by adding at the end the following: SA 4795. Mr. SHELBY (for himself,
(1) determines that the waiver is in the na- ‘‘(IV) section 7503 of the Protecting Eu- Mr. INHOFE, Mr. WICKER, Mr. BLUNT,
tional security interest of the United States; rope’s Energy Security Act of 2019 (title
LXXV of Public Law 116–92; 22 U.S.C. 9526
Mrs. CAPITO, Mrs. HYDE-SMITH, Mr.
and
note); or COTTON, Mr. BOOZMAN, Ms. COLLINS,
(2) submits to the appropriate congres-
sional committees a report on the waiver ‘‘(V) section 1237 of the National Defense Mr. KENNEDY, Ms. MURKOWSKI, Mr.
and the reason for the waiver. Authorization Act for Fiscal Year 2022; and’’. CRAMER, Mr. TILLIS, and Mr. HOEVEN)
SEC. 1240. INCLUSION OF MATTER RELATING TO submitted an amendment intended to
(f) IMPLEMENTATION; PENALTIES.— NORD STREAM 2 IN REPORT UNDER
(1) IMPLEMENTATION.—The President may
be proposed to amendment SA 3867 sub-
COUNTERING AMERICA’S ADVER-
exercise all authorities provided to the SARIES THROUGH SANCTIONS ACT.
mitted by Mr. REED and intended to be
President under sections 203 and 205 of the Each report submitted under section proposed to the bill H.R. 4350, to au-
International Emergency Economic Powers 216(a)(1) of the Countering America’s Adver- thorize appropriations for fiscal year
Act (50 U.S.C. 1702 and 1704) to carry out this saries Through Sanctions Act (22 U.S.C. 2022 for military activities of the De-
section. 9511(a)(1)) relating to sanctions under section partment of Defense, for military con-
(2) PENALTIES.—A person that violates, at- 1237 of this Act or section 7503 of the Pro- struction, and for defense activities of
tempts to violate, conspires to violate, or tecting Europe’s Energy Security Act of 2019 the Department of Energy, to prescribe
causes a violation of this section or any reg- (title LXXV of Public Law 116–92; 22 U.S.C. military personnel strengths for such
ulation, license, or order issued to carry out 9526 note) shall include—
this section shall be subject to the penalties
fiscal year, and for other purposes;
(1) an assessment of the security risks
set forth in subsections (b) and (c) of section posed by Nord Stream 2, including—
which was ordered to lie on the table;
206 of the International Emergency Eco- (A) the presence along Nord Stream 2 or as follows:
nomic Powers Act (50 U.S.C. 1705) to the Nord Stream 1 infrastructure or pipeline cor- At the appropriate place, insert the fol-
same extent as a person that commits an un- ridors of undersea surveillance systems and lowing:
lawful act described in subsection (a) of that sensors, fiber optic terminals, or other sys- TITLE ll—AUTHORIZATION OF
section. tems that are capable of conducting military AMOUNTS FOR DEPARTMENT OF DE-
(g) SUNSET.—The authority to impose sanc- or intelligence activities unrelated to civil- FENSE INFRASTRUCTURE
tions under this section shall terminate on ian energy transmission, including those de- SEC. lll1. ESTABLISHMENT OF DEFENSE IN-
the date that is 5 years after the date of the signed to enhance Russian Federation anti- FRASTRUCTURE FUND.
submarine warfare, surveillance, espionage, There is established in the general fund of
enactment of this Act.
or sabotage capabilities; the Treasury an account to be known as the
(h) DEFINITIONS.—In this section: (B) the use of Nord Stream-affiliated infra- ‘‘Defense Infrastructure Fund’’ for the de-
(1) ADMISSION; ADMITTED; ALIEN.—The structure, equipment, personnel, vessels, fi- posit of amounts to be used for improvement
terms ‘‘admission’’ , ‘‘admitted’’ , and nancing, or other assets— of the infrastructure of the Department of
‘‘alien’’ have the meanings given those terms (i) to facilitate, carry out, or conceal Rus- Defense.
in section 101 of the Immigration and Na- sian Federation maritime surveillance, espi- SEC. lll2. AUTHORIZATION OF AMOUNTS FOR
tionality Act (8 U.S.C. 1101). onage, or sabotage activities; REDUCTION OF BACKLOG FOR FA-
(2) APPROPRIATE CONGRESSIONAL COMMIT- (ii) to justify the presence of Russian Fed- CILITY INFRASTRUCTURE
TEES.—The term ‘‘appropriate congressional PROJECTS.
eration naval vessels or military personnel
committees’’ means— or equipment in international waters or near (a) IN GENERAL.—There is authorized to be
(A) the Committee on Foreign Relations appropriated to the Department of Defense
North Atlantic Treaty Organization or part-
and the Committee on Banking, Housing, $4,000,000,000 for the Defense Infrastructure
ner countries;
and Urban Affairs of the Senate; and Fund, of which $1,300,000,000 shall be avail-
(iii) to disrupt freedom of navigation; or
(B) the Committee on Foreign Affairs and able for each of the Departments of the
(iv) to pressure or intimidate countries in
the Committee on Financial Services of the Army, the Navy, and the Air Force, and
the Baltic Sea;
House of Representatives. $100,000,000 shall be for the Defense Health
(C) the involvement in the Nord Stream 2
(3) UNITED STATES PERSON.—The term Agency, to reduce the backlog of facility in-
pipeline or its affiliated entities of current
‘‘United States person’’ means— frastructure maintenance projects of the De-
or former Russian, Soviet, or Warsaw Pact
(A) a United States citizen or an alien law- partment of Defense.
intelligence and military personnel and any (b) COMPLIANCE WITH REPAIR REQUIRE-
fully admitted for permanent residence to business dealings between Nord Stream 2 and MENTS.—Any project carried out with
the United States; entities affiliated with the intelligence or
(B) an entity organized under the laws of amounts authorized under subsection (a)
defense sector of the Russian Federation; shall comply with the requirements under
the United States or any jurisdiction within and
the United States, including a foreign branch section 2811 of title 10, United States Code.
(D) malign influence activities of the Gov- (c) AVAILABILITY OF AMOUNTS.—Amounts
of such an entity; or ernment of the Russian Federation, includ- authorized under subsection (a) shall be
(C) any person within the United States. ing strategic corruption and efforts to influ- available for obligation until September 30,
SEC. 1238. CONGRESSIONAL REVIEW OF WAIVER ence European decision-makers, supported or 2026.
UNDER PROTECTING EUROPE’S EN- financed through the Nord Stream 2 pipeline; SEC. lll3. AUTHORIZATION OF AMOUNTS FOR
ERGY SECURITY ACT OF 2019. (2) an assessment of whether the Russian MODERNIZATION OF TEST AND
Federation maintains gas transit through TRAINING RANGES OF DEPARTMENT
Section 7503(f) of the Protecting Europe’s Ukraine at levels consistent with the vol- OF DEFENSE.
Energy Security Act of 2019 (title LXXV of umes set forth in the Ukraine-Russian Fed- (a) IN GENERAL.—There is authorized to be
ctelli on DSK11ZRN23PROD with SENATE
Public Law 116–92; 22 U.S.C. 9526 note) is eration gas transit agreement of December appropriated to the Department of Defense
amended, in the matter preceding paragraph 2019 and continues to pay the transit fees $2,800,000,000 for the Defense Infrastructure
(1), by striking ‘‘The President’’ and insert- specified in that agreement; Fund to modernize the test and training
ing ‘‘Subject to review by Congress under (3) an assessment of the status of negotia- ranges of the Department of Defense, includ-
section 216 of the Countering America’s Ad- tions between the Russian Federation and ing projects included in the report required
versaries Through Sanctions Act (22 U.S.C. Ukraine to secure an agreement to extend under section 2806 of the Military Construc-
9511), the President’’. gas transit through Ukraine beyond the expi- tion Authorization Act for Fiscal Year 2018
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00059 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.049 S18NOPT1
S8466 CONGRESSIONAL RECORD — SENATE November 18, 2021
(Division B of Public Law 115–91; 10 U.S.C. from any military construction program au- (ii) in each of fiscal years 2022, 2023, and
222a note) for test and evaluation activities. thorized by any Act to authorize appropria- 2024, to account for costs incurred by the En-
(b) AVAILABILITY OF AMOUNTS.—Amounts tions for a fiscal year for military activities vironmental Protection Agency for such
authorized under subsection (a) shall be of the Department of Defense and for mili- cleanup in fiscal years 2021, 2022, and 2023, an
available for obligation until September 30, tary construction. amount not to exceed $600,000, after a spe-
2032. (c) NAVY PUBLIC SHIPYARD DEFINED.—In cific accounting is provided in accordance
SEC. lll4. AUTHORIZATION OF AMOUNTS FOR this section, the term ‘‘Navy public ship- with subparagraph (B).
REMEDIATION OF PERFLUORALKYL yard’’ means the following: (B) ACCOUNTING.—Prior to the payment of
SUBSTANCES AND (1) The Norfolk Naval Shipyard, Virginia. amounts under subparagraph (A), the Admin-
POLYFLUOROALKYL SUBSTANCES. (2) The Pearl Harbor Naval Shipyard, Ha- istrator of the Environmental Protection
(a) IN GENERAL.—There is authorized to be waii. Agency shall furnish to the Secretary of De-
appropriated to the Department of Defense (3) The Portsmouth Naval Shipyard, fense a specific accounting of costs for which
$700,000,000 for the Defense Infrastructure Maine. payment is requested.
Fund to remediate perfluoralkyl substances (4) The Puget Sound Naval Shipyard, (C) AUTHORIZED COSTS.—Payment of
and polyfluoroalkyl substances at installa- Washington. amounts under subparagraph (A) may be
tions owned by the Department of Defense. made only for those costs incurred by the
(b) AVAILABILITY OF AMOUNTS.—Amounts SA 4796. Mr. PAUL submitted an Environmental Protection Agency for fiscal
authorized under subsection (a) shall be amendment intended to be proposed to years 2015 through 2023—
available for obligation until September 30, amendment SA 3867 submitted by Mr. (i) for providing technical assistance in ac-
2026. REED and intended to be proposed to cordance with the document entitled ‘‘Set-
SEC. lll5. AUTHORIZATION OF AMOUNTS FOR the bill H.R. 4350, to authorize appro- tlement Agreement Between the United
DEPOT MODERNIZATION. States and Shell Oil Company Concerning
(a) IN GENERAL.—There is authorized to be
priations for fiscal year 2022 for mili-
the Rocky Mountain Arsenal’’, effective Feb-
appropriated to the Department of Defense tary activities of the Department of ruary 17, 1989, as incorporated into the con-
$4,325,000,000 for the Defense Infrastructure Defense, for military construction, and sent decree entered by the United States Dis-
Fund for depot modernization. for defense activities of the Depart- trict Court for the District of Colorado in
(b) AVAILABILITY OF AMOUNTS.—Amounts ment of Energy, to prescribe military United States v. Shell Oil Co., Civil Action
authorized under subsection (a) shall be personnel strengths for such fiscal No. 83-C-2379, dated February 12, 1992 (re-
available for obligation until September 30, year, and for other purposes; which was ferred to in this section as the ‘‘Settlement
2032. ordered to lie on the table; as follows: Agreement’’); and
SEC. lll6. AUTHORIZATION OF AMOUNTS FOR At the end of subtitle C of title VII, add (ii) that are not inconsistent with the Na-
AMMUNITION PLANT MODERNIZA-
the following: tional Oil and Hazardous Substances Pollu-
TION. tion Contingency Plan described in part 300
SEC. 744. PROHIBITION ON DISHONORABLE DIS-
(a) IN GENERAL.—There is authorized to be CHARGE OF MEMBERS OF THE of title 40, Code of Federal Regulations (or
appropriated to the Department of Defense ARMED FORCES FOR REFUSING TO successor regulations).
$2,350,000,000 for the Defense Infrastructure COMPLY WITH COVID–19 VACCINE (2) PURPOSE OF PAYMENT.—The amounts
Fund to modernize ammunition plants. MANDATE. authorized to be transferred under paragraph
(b) AVAILABILITY OF AMOUNTS.—Amounts The Secretary of Defense may not give a (1)(A) are—
authorized under subsection (a) shall be dishonorable discharge to a member of the (A) for payment to the Environmental Pro-
available for obligation until September 30, Armed Forces solely on the basis of the re- tection Agency for all costs that may be
2026. fusal of the member, for religious, medical, owed by the Department of the Army to the
SEC. lll7. AUTHORIZATION OF AMOUNTS FOR or personal reasons, to comply with any re- Environmental Protection Agency pursuant
FIFTH-GENERATION WIRELESS NET- quirement that the member receive a vac- to the Settlement Agreement; and
WORKING TECHNOLOGIES. cination for coronavirus disease 2019 (com- (B) for use at the former Rocky Mountain
(a) IN GENERAL.—There is authorized to be monly known as ‘‘COVID–19’’). Arsenal to allow the Environmental Protec-
appropriated to the Department of Defense tion Agency to proceed with review of clean-
$2,500,000,000 for the Defense Infrastructure SA 4797. Mr. BENNET submitted an up documents that the Agency had sus-
Fund to provide fifth-generation wireless amendment intended to be proposed to pended.
networking technologies to installations amendment SA 3867 submitted by Mr. (b) SOURCE OF FUNDS.—The transfer au-
owned by the Department of Defense. REED and intended to be proposed to thorized under subsection (a)(1)(A) shall be
(b) AVAILABILITY OF AMOUNTS.—Amounts the bill H.R. 4350, to authorize appro- made using funds authorized to be appro-
authorized under subsection (a) shall be priations for fiscal year 2022 for mili- priated for fiscal years 2022, 2023, and 2024 for
available for obligation until September 30, Operation and Maintenance, Army for Envi-
2026.
tary activities of the Department of ronmental Restoration.
SEC. lll8. AUTHORIZATION OF AMOUNTS FOR
Defense, for military construction, and (c) FINALITY OF PAYMENTS.—The transfer
NAVY SHIPYARD AND INFRASTRUC- for defense activities of the Depart- authorized under subsection (a)(1)(A) con-
TURE IMPROVEMENT. ment of Energy, to prescribe military stitutes final and complete payment for all
(a) AUTHORIZATION.— personnel strengths for such fiscal costs borne by the Environmental Protection
(1) IN GENERAL.—There is authorized to be year, and for other purposes; which was Agency arising from the Settlement Agree-
appropriated to the Department of Defense ordered to lie on the table; as follows: ment for fiscal years 2015 through 2023.
$10,325,000,000 for the Defense Infrastructure At the end of subtitle D of title XXVIII,
Fund to improve, in accordance with sub- SA 4798. Mr. CASSIDY (for himself,
add the following: Mr. WHITEHOUSE, and Ms. WARREN) sub-
section (b), the Navy shipyard infrastructure SEC. 2836. PAYMENT TO ENVIRONMENTAL PRO-
of the United States. TECTION AGENCY FOR CERTAIN
mitted an amendment intended to be
(2) AVAILABILITY OF AMOUNTS.—Amounts COSTS IN CONNECTION WITH proposed to amendment SA 3867 sub-
authorized under paragraph (1) shall be FORMER ROCKY MOUNTAIN ARSE- mitted by Mr. REED and intended to be
available until expended. NAL, COLORADO. proposed to the bill H.R. 4350, to au-
(3) SUPPLEMENT NOT SUPPLANT.—Amounts (a) AUTHORITY FOR PAYMENT.— thorize appropriations for fiscal year
authorized under paragraph (1) shall supple- (1) TRANSFER AMOUNT.— 2022 for military activities of the De-
ment and not supplant other amounts appro- (A) IN GENERAL.—Notwithstanding section
2215 of title 10, United States Code, chapter
partment of Defense, for military con-
priated or otherwise made available for the
purpose described in paragraph (1). 160 of such title, section 1367 of the National struction, and for defense activities of
(b) USE OF FUNDS.— Defense Authorization Act for Fiscal Year the Department of Energy, to prescribe
(1) IN GENERAL.—As soon as practicable 1987 (Public Law 99–661; 100 Stat. 4003), or any military personnel strengths for such
after the date of the enactment of this Act, other provision of law, using funds described fiscal year, and for other purposes;
the Secretary of Defense shall make in subsection (b), the Secretary of Defense which was ordered to lie on the table;
amounts appropriated pursuant to the au- may transfer to the Administrator of the En- as follows:
thorization under subsection (a)(1) directly vironmental Protection Agency for use at At the end of subtitle G of title X, add the
available to the Secretary of the Navy for the former Rocky Mountain Arsenal, Colo- following:
obligation and expenditure for Navy public rado— SEC. lll. POSTSECONDARY STUDENT DATA
shipyard facilities, dock, dry dock, capital (i) in fiscal year 2022, $4,805,000 for costs as- SYSTEM.
ctelli on DSK11ZRN23PROD with SENATE
equipment improvements, and dredging ef- sociated with the involvement of the Envi- (a) SHORT TITLE.—This section may be
forts needed by such shipyards. ronmental Protection Agency with the cited as the ‘‘College Transparency Act’’.
(2) PROJECTS IN ADDITION TO OTHER CON- cleanup by the Department of the Army of (b) POSTSECONDARY STUDENT DATA SYS-
STRUCTION PROJECTS.—Construction projects the former Rocky Mountain Arsenal from TEM.—Section 132 of the Higher Education
undertaken using amounts appropriated pur- fiscal years 2015 through 2020, after a specific Act of 1965 (20 U.S.C. 1015a) is amended—
suant to the authorization under subsection accounting is provided in accordance with (1) by redesignating subsection (l) as sub-
(a)(1) shall be in addition to and separate subparagraph (B); and section (m); and
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00060 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.053 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8467
(2) by inserting after subsection (k) the fol- tem’s goals, in accordance with Federal data tion measures for all credential levels sepa-
lowing: minimization standards and guidelines de- rately (including certificate, associate, bac-
‘‘(l) POSTSECONDARY STUDENT DATA SYS- veloped by the National Institute of Stand- calaureate, and advanced degree levels),
TEM.— ards and Technology; and within and across institutions of higher edu-
‘‘(1) IN GENERAL.— ‘‘(vi) provide notice to students outlining cation (including across all categories of in-
‘‘(A) ESTABLISHMENT OF SYSTEM.—Not later the data included in the system and how the stitution level, control, and predominant de-
than 4 years after the date of enactment of data are used. gree awarded). The data elements shall allow
the College Transparency Act, the Commis- ‘‘(2) DATA ELEMENTS.— for reporting about all such data
sioner of the National Center for Education ‘‘(A) IN GENERAL.—Not later than 4 years disaggregated by the following categories:
Statistics (referred to in this subsection as after the date of enactment of the College ‘‘(I) Enrollment status as a first-time stu-
the ‘Commissioner’) shall develop and main- Transparency Act, the Commissioner, in con- dent, recent transfer student, or other non-
tain a secure, privacy-protected postsec- sultation with the Postsecondary Student first-time student.
ondary student-level data system in order Data System Advisory Committee estab- ‘‘(II) Attendance intensity, whether full-
to— lished under subparagraph (B), shall deter- time or part-time.
‘‘(i) accurately evaluate student enroll- mine— ‘‘(III) Credential-seeking status, by creden-
ment patterns, progression, completion, and ‘‘(i) the data elements to be included in the tial level.
postcollegiate outcomes, and higher edu- postsecondary student data system, in ac- ‘‘(IV) Race or ethnicity, in a manner that
cation costs and financial aid; cordance with subparagraphs (C) and (D); and captures all the racial groups specified in the
‘‘(ii) assist with transparency, institu- ‘‘(ii) how to include the data elements re-
tional improvement, and analysis of Federal most recent American Community Survey of
quired under subparagraph (C), and any addi-
aid programs; the Bureau of the Census.
tional data elements selected under subpara-
‘‘(iii) provide accurate, complete, and ‘‘(V) Age intervals.
graph (D), in the postsecondary student data
customizable information for students and ‘‘(VI) Gender.
system.
families making decisions about postsec- ‘‘(VII) Program of study (as applicable).
‘‘(B) POSTSECONDARY STUDENT DATA SYSTEM
ondary education; and ‘‘(VIII) Military or veteran benefit status
ADVISORY COMMITTEE.—
‘‘(iv) reduce the reporting burden on insti- ‘‘(i) ESTABLISHMENT.—Not later than 2 (as determined based on receipt of veteran’s
tutions of higher education, in accordance years after the date of enactment of the Col- education benefits, as defined in section
with section 5(b) of the College Transparency lege Transparency Act, the Commissioner 480(c)).
Act. shall establish a Postsecondary Student ‘‘(IX) Status as a distance education stu-
‘‘(B) AVOIDING DUPLICATED REPORTING.— Data System Advisory Committee (referred dent, whether exclusively or partially en-
Notwithstanding any other provision of this to in this subsection as the ‘Advisory Com- rolled in distance education.
section, to the extent that another provision mittee’), whose members shall include— ‘‘(X) Federal Pell Grant recipient status
of this section requires the same reporting or ‘‘(I) the Chief Privacy Officer of the De- under section 401 and Federal loan recipient
collection of data that is required under this partment or an official of the Department status under title IV, provided that the col-
subsection, an institution of higher edu- delegated the duties of overseeing data pri- lection of such information complies with
cation, or the Secretary or Commissioner, vacy at the Department; paragraph (1)(B).
may use the reporting or data required for ‘‘(II) the Chief Security Officer of the De- ‘‘(D) OTHER DATA ELEMENTS.—
the postsecondary student data system partment or an official of the Department ‘‘(i) IN GENERAL.—The Commissioner may,
under this subsection to satisfy both require- delegated the duties of overseeing data secu- after consultation with the Advisory Com-
ments. rity at the Department; mittee and provision of a public comment
‘‘(C) DEVELOPMENT PROCESS.—In developing ‘‘(III) representatives of diverse institu- period, include additional data elements in
the postsecondary student data system de- tions of higher education, which shall in- the postsecondary student data system, such
scribed in this subsection, the Commissioner clude equal representation between 2-year as those described in clause (ii), if those data
shall— and 4-year institutions of higher education, elements—
‘‘(i) focus on the needs of— and from public, nonprofit, and proprietary ‘‘(I) are necessary to ensure that the post-
‘‘(I) users of the data system; and institutions of higher education, including secondary data system fulfills the purposes
‘‘(II) entities, including institutions of minority-serving institutions; described in paragraph (1)(A); and
higher education, reporting to the data sys- ‘‘(IV) representatives from State higher ‘‘(II) are consistent with data minimiza-
tem; education agencies, entities, bodies, or tion principles, including the collection of
‘‘(ii) take into consideration, to the extent boards; only those additional elements that are nec-
practicable— ‘‘(V) representatives of postsecondary stu- essary to ensure such purposes.
‘‘(I) the guidelines outlined in the U.S. Web dents; ‘‘(ii) DATA ELEMENTS.—The data elements
Design Standards maintained by the General ‘‘(VI) representatives from relevant Fed- described in clause (i) may include—
Services Administration and the Digital eral agencies; and ‘‘(I) status as a first generation college stu-
Services Playbook and TechFAR Handbook ‘‘(VII) other stakeholders (including indi- dent, as defined in section 402A(h);
for Procuring Digital Services Using Agile viduals with expertise in data privacy and ‘‘(II) economic status;
Processes of the U.S. Digital Service; and security, consumer protection, and postsec- ‘‘(III) participation in postsecondary reme-
‘‘(II) the relevant successor documents or ondary education research). dial coursework or gateway course comple-
recommendations of such guidelines; ‘‘(ii) REQUIREMENTS.—The Commissioner tion; or
‘‘(iii) use modern, relevant privacy- and se- shall ensure that the Advisory Committee— ‘‘(IV) other data elements that are nec-
curity-enhancing technology, and enhance ‘‘(I) adheres to all requirements under the essary in accordance with clause (i).
and update the data system as necessary to Federal Advisory Committee Act (5 U.S.C. ‘‘(E) REEVALUATION.—Not less than once
carry out the purpose of this subsection; App.); every 3 years after the implementation of
‘‘(iv) ensure data privacy and security is ‘‘(II) establishes operating and meeting the postsecondary student data system de-
consistent with any Federal law relating to procedures and guidelines necessary to exe- scribed in this subsection, the Commissioner,
privacy or data security, including— cute its advisory duties; and in consultation with the Advisory Com-
‘‘(I) the requirements of subchapter II of ‘‘(III) is provided with appropriate staffing mittee described in subparagraph (B), shall
chapter 35 of title 44, United States Code, and resources to execute its advisory duties. review the data elements included in the
specifying security categorization under the ‘‘(C) REQUIRED DATA ELEMENTS.—The data postsecondary student data system and may
Federal Information Processing Standards or elements in the postsecondary student data revise the data elements to be included in
any relevant successor of such standards; system shall include, at a minimum, the fol- such system.
‘‘(II) security requirements that are con- lowing: ‘‘(F) PROHIBITIONS.—The Commissioner
sistent with the Federal agency responsibil- ‘‘(i) Student-level data elements necessary shall not include individual health data (in-
ities in section 3554 of title 44, United States to calculate the information within the sur- cluding data relating to physical health or
Code, or any relevant successor of such re- veys designated by the Commissioner as ‘stu- mental health), student discipline records or
sponsibilities; and dent-related surveys’ in the Integrated Post- data, elementary and secondary education
‘‘(III) security requirements, guidelines, secondary Education Data System (IPEDS), data, an exact address, citizenship status,
and controls consistent with cybersecurity as such surveys are in effect on the day be- migrant status, or national origin status for
standards and best practices developed by fore the date of enactment of the College students or their families, course grades,
the National Institute of Standards and Transparency Act, except that in the case postsecondary entrance examination results,
Technology, including frameworks, con- that collection of such elements would con- political affiliation, or religion in the post-
ctelli on DSK11ZRN23PROD with SENATE
sistent with section 2(c) of the National In- flict with subparagraph (F), such elements in secondary student data system under this
stitute of Standards and Technology Act (15 conflict with subparagraph (F) shall be in- subsection.
U.S.C. 272(c)), or any relevant successor of cluded in the aggregate instead of at the stu- ‘‘(3) PERIODIC MATCHING WITH OTHER FED-
such frameworks; dent level. ERAL DATA SYSTEMS.—
‘‘(v) follow Federal data minimization ‘‘(ii) Student-level data elements necessary ‘‘(A) DATA SHARING AGREEMENTS.—
practices to ensure only the minimum to allow for reporting student enrollment, ‘‘(i) The Commissioner shall ensure secure,
amount of data is collected to meet the sys- persistence, retention, transfer, and comple- periodic data matches by entering into data
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00061 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.050 S18NOPT1
S8468 CONGRESSIONAL RECORD — SENATE November 18, 2021
sharing agreements with each of the fol- this subsection, the Commissioner, in con- ‘‘(II) number of completions, disaggregated
lowing Federal agencies and offices: sultation with the Advisory Committee, by each category described in paragraph
‘‘(I) The Secretary of the Treasury and the shall review methods for streamlining data (2)(C)(ii).
Commissioner of the Internal Revenue Serv- collection from institutions of higher edu- ‘‘(iv) Measures of student costs, includ-
ice, in order to calculate aggregate program- cation and minimizing duplicative reporting ing—
and institution-level earnings of postsec- within the Department and across Federal ‘‘(I) tuition, required fees, total cost of at-
ondary students. agencies that provide data for the postsec- tendance, and net price after total grant aid,
‘‘(II) The Secretary of Defense, in order to ondary student data system. disaggregated by in-State tuition or in-dis-
assess the use of postsecondary educational ‘‘(iii) CONFIDENTIALITY.—The Commis- trict tuition status (if applicable), program
benefits and the outcomes of sioner shall ensure that any periodic match- of study (if applicable), and credential level;
servicemembers. ing or sharing of data through periodic data and
‘‘(III) The Secretary of Veterans Affairs, in system matches established in accordance ‘‘(II) typical grant amounts and loan
order to assess the use of postsecondary edu- with this paragraph— amounts received by students reported sepa-
cational benefits and outcomes of veterans. ‘‘(I) complies with the security and privacy rately from Federal, State, local, and insti-
‘‘(IV) The Director of the Bureau of the protections described in paragraph (1)(C)(iv) tutional sources, and cumulative debt,
Census, in order to assess the earnings out- and other Federal data protection protocols; disaggregated by each category described in
comes of former postsecondary education ‘‘(II) follows industry best practices com- paragraph (2)(C)(ii) and completion status.
students. mensurate with the sensitivity of specific ‘‘(v) Measures of postcollegiate student
‘‘(V) The Chief Operating Officer of the Of- outcomes, including employment rates,
data elements or metrics;
fice of Federal Student Aid, in order to ana- mean and median earnings, loan repayment
‘‘(III) does not result in the creation of a
lyze the use of postsecondary educational and default rates, and further education
single standing, linked Federal database at
benefits provided under this Act. rates. These measures shall—
the Department that maintains the informa-
‘‘(VI) The Commissioner of the Social Se- ‘‘(I) be disaggregated by each category de-
tion reported across other Federal agencies;
curity Administration, in order to evaluate scribed in paragraph (2)(C)(ii) and comple-
and
labor market outcomes of former postsec- tion status; and
‘‘(IV) discloses to postsecondary students
ondary education students. ‘‘(II) be measured immediately after leav-
‘‘(VII) The Commissioner of the Bureau of what data are included in the data system ing postsecondary education and at time in-
Labor Statistics, in order to assess the wages and periodically matched and how the data tervals appropriate to the credential sought
of former postsecondary education students. are used. or earned.
‘‘(ii) The heads of Federal agencies and of- ‘‘(iv) CORRECTION.—The Commissioner, in ‘‘(D) DEVELOPMENT CRITERIA.—In devel-
fices described under clause (i) shall enter consultation with the Advisory Committee, oping the method and format of making the
into data sharing agreements with the Com- shall establish a process for students to re- information described in this paragraph pub-
missioner to ensure secure, periodic data quest access to only their personal informa- licly available, the Commissioner shall—
matches as described in this paragraph. tion for inspection and request corrections ‘‘(i) focus on the needs of the users of the
‘‘(B) CATEGORIES OF DATA.—The Commis- to inaccuracies in a manner that protects information, which will include students,
sioner shall, at a minimum, seek to ensure the student’s personally identifiable infor- families of students, potential students, re-
that the secure periodic data system mation. The Commissioner shall respond in searchers, and other consumers of education
matches described in subparagraph (A) per- writing to every request for a correction data;
mit consistent reporting of the following from a student. ‘‘(ii) take into consideration, to the extent
categories of data for all postsecondary stu- ‘‘(4) PUBLICLY AVAILABLE INFORMATION.— practicable, the guidelines described in para-
dents: ‘‘(A) IN GENERAL.—The Commissioner shall graph (1)(C)(ii)(I), and relevant successor
‘‘(i) Enrollment, retention, transfer, and make the summary aggregate information documents or recommendations of such
completion outcomes for all postsecondary described in subparagraph (C), at a min- guidelines;
students. imum, publicly available through a user- ‘‘(iii) use modern, relevant technology and
‘‘(ii) Financial indicators for postsec- friendly consumer information website and enhance and update the postsecondary stu-
ondary students receiving Federal grants analytic tool that— dent data system with information, as nec-
and loans, including grant and loan aid by ‘‘(i) provides appropriate mechanisms for essary to carry out the purpose of this para-
source, cumulative student debt, loan repay- users to customize and filter information by graph;
ment status, and repayment plan. institutional and student characteristics; ‘‘(iv) ensure data privacy and security in
‘‘(iii) Post-completion outcomes for all ‘‘(ii) allows users to build summary aggre- accordance with standards and guidelines de-
postsecondary students, including earnings, gate reports of information, including re- veloped by the National Institute of Stand-
employment, and further education, by pro- ports that allow comparisons across multiple ards and Technology, and in accordance with
gram of study and credential level and as institutions and programs, subject to sub- any other Federal law relating to privacy or
measured— paragraph (B); security, including complying with the re-
‘‘(I) immediately after leaving postsec- ‘‘(iii) uses appropriate statistical disclo- quirements of subchapter II of chapter 35 of
ondary education; and sure limitation techniques necessary to en- title 44, United States Code, specifying secu-
‘‘(II) at time intervals appropriate to the sure that the data released to the public can- rity categorization under the Federal Infor-
credential sought and earned. not be used to identify specific individuals; mation Processing Standards, and security
‘‘(C) PERIODIC DATA MATCH STREAMLINING and requirements, and setting of National Insti-
AND CONFIDENTIALITY.— ‘‘(iv) provides users with appropriate con- tute of Standards and Technology security
‘‘(i) STREAMLINING.—In carrying out the se- textual factors to make comparisons, which baseline controls at the appropriate level;
cure periodic data system matches under may include national median figures of the and
this paragraph, the Commissioner shall— summary aggregate information described in ‘‘(v) conduct consumer testing to deter-
‘‘(I) ensure that such matches are not con- subparagraph (C). mine how to make the information as mean-
tinuous, but occur only periodically at ap- ‘‘(B) NO PERSONALLY IDENTIFIABLE INFOR- ingful to users as possible.
propriate intervals, as determined by the MATION AVAILABLE.—The summary aggregate ‘‘(5) PERMISSIBLE DISCLOSURES OF DATA.—
Commissioner to meet the goals of subpara- information described in this paragraph shall ‘‘(A) DATA REPORTS AND QUERIES.—
graph (A); and not include personally identifiable informa- ‘‘(i) IN GENERAL.—Not later than 4 years
‘‘(II) seek to— tion. after the date of enactment of the College
‘‘(aa) streamline the data collection and ‘‘(C) SUMMARY AGGREGATE INFORMATION Transparency Act, the Commissioner shall
reporting requirements for institutions of AVAILABLE.—The summary aggregate infor- develop and implement a secure process for
higher education; mation described in this paragraph shall, at making student-level, non-personally identi-
‘‘(bb) minimize duplicative reporting a minimum, include each of the following for fiable information, with direct identifiers re-
across or within Federal agencies or depart- each institution of higher education: moved, from the postsecondary student data
ments, including reporting requirements ap- ‘‘(i) Measures of student access, includ- system available for vetted research and
plicable to institutions of higher education ing— evaluation purposes approved by the Com-
under the Workforce Innovation and Oppor- ‘‘(I) admissions selectivity and yield; and missioner in a manner compatible with prac-
tunity Act (29 U.S.C. 3101 et seq.) and the ‘‘(II) enrollment, disaggregated by each tices for disclosing National Center for Edu-
Carl D. Perkins Career and Technical Edu- category described in paragraph (2)(C)(ii). cation Statistics restricted-use survey data
cation Act of 2006; ‘‘(ii) Measures of student progression, in- as in effect on the day before the date of en-
‘‘(cc) protect student privacy; and cluding retention rates and persistence actment of the College Transparency Act, or
ctelli on DSK11ZRN23PROD with SENATE
‘‘(dd) streamline the application process rates, disaggregated by each category de- by applying other research and disclosure re-
for student loan benefit programs available scribed in paragraph (2)(C)(ii). strictions to ensure data privacy and secu-
to borrowers based on data available from ‘‘(iii) Measures of student completion, in- rity. Such process shall be approved by the
different Federal data systems. cluding— National Center for Education Statistics’
‘‘(ii) REVIEW.—Not less often than once ‘‘(I) transfer rates and completion rates, Disclosure Review Board (or successor body).
every 3 years after the establishment of the disaggregated by each category described in ‘‘(ii) PROVIDING DATA REPORTS AND QUERIES
postsecondary student data system under paragraph (2)(C)(ii); and TO INSTITUTIONS AND STATES.—
VerDate Sep 11 2014 06:17 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00062 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.050 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8469
‘‘(I) IN GENERAL.—The Commissioner shall ty to establish any Federal ranking system ‘‘(F) protocols for managing a breach, in-
provide feedback reports, at least annually, of institutions of higher education or a sys- cluding breach notifications, in accordance
to each institution of higher education, each tem that results in a summative Federal rat- with the standards of National Center for
postsecondary education system that fully ing of institutions of higher education. Education Statistics.
participates in the postsecondary student ‘‘(G) RULE OF CONSTRUCTION.—Nothing in ‘‘(9) DATA COLLECTION.—The Commissioner
data system, and each State higher edu- this paragraph shall be construed to prevent shall ensure that data collection, mainte-
cation body as designated by the governor. the use of individual categories of aggregate nance, and use under this subsection com-
‘‘(II) FEEDBACK REPORTS.—The feedback re- information to be used for accountability plies with section 552a of title 5, United
ports provided under this clause shall in- purposes. States Code.
clude program-level and institution-level in- ‘‘(H) RULE OF CONSTRUCTION REGARDING ‘‘(10) DEFINITIONS.—In this subsection:
formation from the postsecondary student COMMERCIAL USE OF DATA.—Nothing in this ‘‘(A) INSTITUTION OF HIGHER EDUCATION.—
data system regarding students who are as- paragraph shall be construed to prohibit The term ‘institution of higher education’
sociated with the institution or, for State third-party entities from using publicly has the meaning given the term in section
representatives, the institutions within that available information in this data system for 102.
State, on or before the date of the report, on commercial use. ‘‘(B) MINORITY-SERVING INSTITUTION.—The
measures including student mobility and ‘‘(6) SUBMISSION OF DATA.— term ‘minority-serving institution’ means an
workforce outcomes, provided that the feed- ‘‘(A) REQUIRED SUBMISSION.—Each institu- institution of higher education listed in sec-
back aggregate summary reports protect the tion of higher education participating in a tion 371(a).
privacy of individuals. program under title IV, or the assigned ‘‘(C) PERSONALLY IDENTIFIABLE INFORMA-
‘‘(III) DETERMINATION OF CONTENT.—The agent of such institution, shall, for each eli- TION.—The term ‘personally identifiable in-
content of the feedback reports shall be de- gible program, in accordance with section formation’ means personally identifiable in-
termined by the Commissioner in consulta- 487(a)(17), collect, and submit to the Com- formation within the meaning of section 444
tion with the Advisory Committee. missioner, the data requested by the Com- of the General Education Provisions Act.’’.
‘‘(iii) PERMITTING STATE DATA QUERIES.— missioner to carry out this subsection. (c) REPEAL OF PROHIBITION ON STUDENT
The Commissioner shall, in consultation ‘‘(B) VOLUNTARY SUBMISSION.—Any institu- DATA SYSTEM.—Section 134 of the Higher
with the Advisory Committee and as soon as tion of higher education not participating in Education Act of 1965 (20 U.S.C. 1015c) is re-
practicable, create a process through which a program under title IV may voluntarily pealed.
States may submit lists of secondary school participate in the postsecondary student (d) INSTITUTIONAL REQUIREMENTS.—
graduates within the State to receive sum- data system under this subsection by col- (1) IN GENERAL.—Paragraph (17) of section
mary aggregate outcomes for those students lecting and submitting data to the Commis- 487(a) of the Higher Education Act of 1965 (20
who enrolled at an institution of higher edu- sioner, as the Commissioner may request to U.S.C. 1094(a)) is amended to read as follows:
cation, including postsecondary enrollment carry out this subsection. ‘‘(17) The institution or the assigned agent
and college completion, provided that those ‘‘(C) PERSONALLY IDENTIFIABLE INFORMA- of the institution will collect and submit
data protect the privacy of individuals and TION.—In accordance with paragraph (2)(C)(i), data to the Commissioner for Education Sta-
that the State data submitted to the Com- if the submission of an element of student- tistics in accordance with section 132(l), the
missioner are not stored in the postsec- level data is prohibited under paragraph nonstudent related surveys within the Inte-
ondary education system. (2)(F) (or otherwise prohibited by law), the grated Postsecondary Education Data Sys-
‘‘(iv) REGULATIONS.—The Commissioner institution of higher education shall submit tem (IPEDS), or any other Federal institu-
shall promulgate regulations to ensure fair, that data to the Commissioner in the aggre- tion of higher education data collection ef-
secure, and equitable access to data reports gate. fort (as designated by the Secretary), in a
and queries under this paragraph. ‘‘(7) UNLAWFUL WILLFUL DISCLOSURE.— timely manner and to the satisfaction of the
‘‘(B) DISCLOSURE LIMITATIONS.—In carrying ‘‘(A) IN GENERAL.—It shall be unlawful for Secretary.’’.
out the public reporting and disclosure re- any person who obtains or has access to per- (2) EFFECTIVE DATE.—The amendment
quirements of this subsection, the Commis- sonally identifiable information in connec- made by paragraph (1) shall take effect on
sioner shall use appropriate statistical dis- tion with the postsecondary student data the date that is 4 years after the date of en-
closure limitation techniques necessary to system described in this subsection to will- actment of this Act.
ensure that the data released to the public fully disclose to any person (except as au- (e) TRANSITION PROVISIONS.—The Secretary
cannot include personally identifiable infor- thorized in this Act or by any Federal law) of Education and the Commissioner for Edu-
mation or be used to identify specific indi- such personally identifiable information. cation Statistics shall take such steps as are
viduals. ‘‘(B) PENALTY.—Any person who violates necessary to ensure that the development
‘‘(C) SALE OF DATA PROHIBITED.—Data col- subparagraph (A) shall be subject to a pen- and maintenance of the postsecondary stu-
lected under this subsection, including the alty described under section 3572(f) of title dent data system required under section
public-use data set and data comprising the 44, United States Code, and section 183(d)(6) 132(l) of the Higher Education Act of 1965, as
summary aggregate information available of the Education Sciences Reform Act of 2002 added by subsection (b) of this section, oc-
under paragraph (4), shall not be sold to any (20 U.S.C. 9573(d)(6)). curs in a manner that reduces the reporting
third party by the Commissioner, including ‘‘(C) EMPLOYEE OR OFFICER OF THE UNITED burden for entities that reported into the In-
any institution of higher education or any STATES.—If a violation of subparagraph (A) is
tegrated Postsecondary Education Data Sys-
other entity. committed by any officer or employee of the
tem (IPEDS).
‘‘(D) LIMITATION ON USE BY OTHER FEDERAL United States, the officer or employee shall ---
AGENCIES.— be dismissed from office or discharged from SA 4799. Mr. PETERS (for himself,
‘‘(i) IN GENERAL.—The Commissioner shall employment upon conviction for the viola-
Mr. PORTMAN, Mr. WARNER, Ms. COL-
not allow any other Federal agency to use tion.
data collected under this subsection for any ‘‘(8) DATA SECURITY.—The Commissioner LINS, Mr. KING, Mr. RUBIO, Mr. RISCH,
purpose except— shall produce and update as needed guidance Ms. ROSEN, Mr. CORNYN, and Mr. BURR)
‘‘(I) for vetted research and evaluation con- and regulations relating to privacy, security, submitted an amendment intended to
ducted by the other Federal agency, as de- and access which shall govern the use and be proposed to amendment SA 3867 sub-
scribed in subparagraph (A)(i); or disclosure of data collected in connection mitted by Mr. REED and intended to be
‘‘(II) for a purpose explicitly authorized by with the activities authorized in this sub- proposed to the bill H.R. 4350, to au-
this Act. section. The guidance and regulations devel- thorize appropriations for fiscal year
‘‘(ii) PROHIBITION ON LIMITATION OF SERV- oped and reviewed shall protect data from
2022 for military activities of the De-
ICES.—The Secretary, or the head of any unauthorized access, use, and disclosure, and
other Federal agency, shall not use data col- shall include— partment of Defense, for military con-
lected under this subsection to limit services ‘‘(A) an audit capability, including manda- struction, and for defense activities of
to students. tory and regularly conducted audits; the Department of Energy, to prescribe
‘‘(E) LAW ENFORCEMENT.—Personally iden- ‘‘(B) access controls; military personnel strengths for such
tifiable information collected under this sub- ‘‘(C) requirements to ensure sufficient data fiscal year, and for other purposes;
section shall not be used for any Federal, security, quality, validity, and reliability; which was ordered to lie on the table;
State, or local law enforcement activity or ‘‘(D) confidentiality protection in accord- as follows:
any other activity that would result in ad- ance with the applicable provisions of sub-
At the end, add the following:
verse action against any student or a stu- chapter III of chapter 35 of title 44, United
dent’s family, including debt collection ac- States Code; DIVISION E—FEDERAL INFORMATION
ctelli on DSK11ZRN23PROD with SENATE
tivity or enforcement of immigration laws. ‘‘(E) appropriate and applicable privacy SECURITY MODERNIZATION ACT OF 2021
‘‘(F) LIMITATION OF USE FOR FEDERAL and security protection, including data re- SEC. 5101. SHORT TITLE.
RANKINGS OR SUMMATIVE RATING SYSTEM.— tention and destruction protocols and data This division may be cited as the ‘‘Federal
The comprehensive data collection and anal- minimization, in accordance with the most Information Security Modernization Act of
ysis necessary for the postsecondary student recent Federal standards developed by the 2021’’.
data system under this subsection shall not National Institute of Standards and Tech- SEC. 5102. DEFINITIONS.
be used by the Secretary or any Federal enti- nology; and In this division, unless otherwise specified:
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00063 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.050 S18NOPT1
S8470 CONGRESSIONAL RECORD — SENATE November 18, 2021
(1) ADDITIONAL CYBERSECURITY PROCE- (4) in section 3513— (D) INTERNET OF THINGS CYBERSECURITY IM-
DURE.—The term ‘‘additional cybersecurity (A) by redesignating subsection (c) as sub- PROVEMENT ACT OF 2020.—Section 3(5) of the
procedure’’ has the meaning given the term section (d); and Internet of Things Cybersecurity Improve-
in section 3552(b) of title 44, United States (B) by inserting after subsection (b) the ment Act of 2020 (15 U.S.C. 278g–3a) is amend-
Code, as amended by this division. following: ed by striking ‘‘section 3552(b)(6)’’ and insert-
(2) AGENCY.—The term ‘‘agency’’ has the ‘‘(c) Each agency providing a written plan ing ‘‘section 3552(b)’’.
meaning given the term in section 3502 of under subsection (b) shall provide any por- (E) NATIONAL DEFENSE AUTHORIZATION ACT
title 44, United States Code. tion of the written plan addressing informa- FOR FISCAL YEAR 2013.—Section 933(e)(1)(B) of
(3) APPROPRIATE CONGRESSIONAL COMMIT- tion security or cybersecurity to the Direc- the National Defense Authorization Act for
TEES.—The term ‘‘appropriate congressional tor of the Cybersecurity and Infrastructure Fiscal Year 2013 (10 U.S.C. 2224 note) is
committees’’ means— Security Agency.’’. amended by striking ‘‘section 3542(b)(2)’’ and
(A) the Committee on Homeland Security (b) SUBCHAPTER II DEFINITIONS.— inserting ‘‘section 3552(b)’’.
and Governmental Affairs of the Senate; (1) IN GENERAL.—Section 3552(b) of title 44, (F) IKE SKELTON NATIONAL DEFENSE AUTHOR-
(B) the Committee on Oversight and Re- IZATION ACT FOR FISCAL YEAR 2011.—The Ike
United States Code, is amended—
form of the House of Representatives; and (A) by redesignating paragraphs (1), (2), (3), Skelton National Defense Authorization Act
(C) the Committee on Homeland Security for Fiscal Year 2011 (Public Law 111–383) is
(4), (5), (6), and (7) as paragraphs (2), (3), (4),
of the House of Representatives. amended—
(5), (6), (9), and (11), respectively;
(4) DIRECTOR.—The term ‘‘Director’’ means (i) in section 806(e)(5) (10 U.S.C. 2304 note),
(B) by inserting before paragraph (2), as so
the Director of the Office of Management by striking ‘‘section 3542(b)’’ and inserting
redesignated, the following:
and Budget. ‘‘section 3552(b)’’;
‘‘(1) The term ‘additional cybersecurity
(5) INCIDENT.—The term ‘‘incident’’ has the (ii) in section 931(b)(3) (10 U.S.C. 2223 note),
procedure’ means a process, procedure, or
meaning given the term in section 3552(b) of by striking ‘‘section 3542(b)(2)’’ and inserting
other activity that is established in excess of
title 44, United States Code. ‘‘section 3552(b)’’; and
the information security standards promul-
(6) NATIONAL SECURITY SYSTEM.—The term (iii) in section 932(b)(2) (10 U.S.C. 2224
gated under section 11331(b) of title 40 to in-
‘‘national security system’’ has the meaning note), by striking ‘‘section 3542(b)(2)’’ and in-
given the term in section 3552(b) of title 44, crease the security and reduce the cyberse- serting ‘‘section 3552(b)’’.
United States Code. curity risk of agency systems.’’; (G) E-GOVERNMENT ACT OF 2002.—Section
(7) PENETRATION TEST.—The term ‘‘penetra- (C) by inserting after paragraph (6), as so 301(c)(1)(A) of the E-Government Act of 2002
tion test’’ has the meaning given the term in redesignated, the following: (44 U.S.C. 3501 note) is amended by striking
section 3552(b) of title 44, United States ‘‘(7) The term ‘high value asset’ means in- ‘‘section 3542(b)(2)’’ and inserting ‘‘section
Code, as amended by this division. formation or an information system that the 3552(b)’’.
(8) THREAT HUNTING.—The term ‘‘threat head of an agency determines so critical to (H) NATIONAL INSTITUTE OF STANDARDS AND
hunting’’ means proactively and iteratively the agency that the loss or corruption of the TECHNOLOGY ACT.—Section 20 of the National
searching for threats to systems that evade information or the loss of access to the infor- Institute of Standards and Technology Act
detection by automated threat detection sys- mation system would have a serious impact (15 U.S.C. 278g–3) is amended—
tems. on the ability of the agency to perform the (i) in subsection (a)(2), by striking ‘‘section
mission of the agency or conduct business. 3552(b)(5)’’ and inserting ‘‘section 3552(b)’’;
TITLE LI—UPDATES TO FISMA
‘‘(8) The term ‘major incident’ has the and
SEC. 5121. TITLE 44 AMENDMENTS.
meaning given the term in guidance issued (ii) in subsection (f)—
(a) SUBCHAPTER I AMENDMENTS.—Sub- by the Director under section 3598(a).’’;
chapter I of chapter 35 of title 44, United (I) in paragraph (3), by striking ‘‘section
(D) by inserting after paragraph (9), as so 3532(1)’’ and inserting ‘‘section 3552(b)’’; and
States Code, is amended— redesignated, the following:
(1) in section 3504— (II) in paragraph (5), by striking ‘‘section
‘‘(10) The term ‘penetration test’ means a 3532(b)(2)’’ and inserting ‘‘section 3552(b)’’.
(A) in subsection (a)(1)(B)—
specialized type of assessment that— (c) SUBCHAPTER II AMENDMENTS.—Sub-
(i) by striking clause (v) and inserting the
‘‘(A) is conducted on an information sys- chapter II of chapter 35 of title 44, United
following:
tem or a component of an information sys- States Code, is amended—
‘‘(v) confidentiality, privacy, disclosure,
tem; and (1) in section 3551—
and sharing of information;’’;
‘‘(B) emulates an attack or other exploi- (A) in paragraph (4), by striking ‘‘diagnose
(ii) by redesignating clause (vi) as clause
tation capability of a potential adversary, and improve’’ and inserting ‘‘integrate, de-
(vii); and
typically under specific constraints, in order liver, diagnose, and improve’’;
(iii) by inserting after clause (v) the fol-
to identify any vulnerabilities of an informa- (B) in paragraph (5), by striking ‘‘and’’ at
lowing:
tion system or a component of an informa- the end;
‘‘(vi) in consultation with the National
tion system that could be exploited.’’; and (C) in paragraph (6), by striking the period
Cyber Director and the Director of the Cy-
bersecurity and Infrastructure Security (E) by inserting after paragraph (11), as so at the end and inserting a semi colon; and
Agency, security of information; and’’; and redesignated, the following: (D) by adding at the end the following:
(B) in subsection (g), by striking paragraph ‘‘(12) The term ‘shared service’ means a ‘‘(7) recognize that each agency has spe-
(1) and inserting the following: centralized business or mission capability cific mission requirements and, at times,
‘‘(1) develop, and in consultation with the that is provided to multiple organizations unique cybersecurity requirements to meet
Director of the Cybersecurity and Infrastruc- within an agency or to multiple agencies.’’. the mission of the agency;
ture Security Agency and the National (2) CONFORMING AMENDMENTS.— ‘‘(8) recognize that each agency does not
Cyber Director, oversee the implementation (A) HOMELAND SECURITY ACT OF 2002.—Sec- have the same resources to secure agency
of policies, principles, standards, and guide- tion 1001(c)(1)(A) of the Homeland Security systems, and an agency should not be ex-
lines on privacy, confidentiality, security, Act of 2002 (6 U.S.C. 511(1)(A)) is amended by pected to have the capability to secure the
disclosure and sharing of information col- striking ‘‘section 3552(b)(5)’’ and inserting systems of the agency from advanced adver-
lected or maintained by or for agencies; ‘‘section 3552(b)’’. saries alone; and
and’’; (B) TITLE 10.— ‘‘(9) recognize that a holistic Federal cy-
(2) in section 3505— (i) SECTION 2222.—Section 2222(i)(8) of title bersecurity model is necessary to account
(A) in paragraph (3) of the first subsection 10, United States Code, is amended by strik- for differences between the missions and ca-
designated as subsection (c)— ing ‘‘section 3552(b)(6)(A)’’ and inserting pabilities of agencies.’’;
(i) in subparagraph (B)— ‘‘section 3552(b)(9)(A)’’. (2) in section 3553—
(I) by inserting ‘‘the Director of the Cyber- (ii) SECTION 2223.—Section 2223(c)(3) of title (A) by striking the section heading and in-
security and Infrastructure Security Agency, 10, United States Code, is amended by strik- serting ‘‘Authority and functions of the Di-
the National Cyber Director, and’’ before ing ‘‘section 3552(b)(6)’’ and inserting ‘‘sec- rector and the Director of the Cybersecurity
‘‘the Comptroller General’’; and tion 3552(b)’’. and Infrastructure Security Agency’’.
(II) by striking ‘‘and’’ at the end; (iii) SECTION 2315.—Section 2315 of title 10, (B) in subsection (a)—
(ii) in subparagraph (C)(v), by striking the United States Code, is amended by striking (i) in paragraph (1), by inserting ‘‘, in con-
period at the end and inserting ‘‘; and’’; and ‘‘section 3552(b)(6)’’ and inserting ‘‘section sultation with the Director of the Cybersecu-
(iii) by adding at the end the following: 3552(b)’’. rity and Infrastructure Security Agency and
‘‘(D) maintained on a continual basis (iv) SECTION 2339A.—Section 2339a(e)(5) of the National Cyber Director,’’ before ‘‘over-
through the use of automation, machine- title 10, United States Code, is amended by seeing’’;
readable data, and scanning.’’; and striking ‘‘section 3552(b)(6)’’ and inserting (ii) in paragraph (5), by striking ‘‘and’’ at
ctelli on DSK11ZRN23PROD with SENATE
(B) by striking the second subsection des- ‘‘section 3552(b)’’. the end; and
ignated as subsection (c); (C) HIGH-PERFORMANCE COMPUTING ACT OF (iii) by adding at the end the following:
(3) in section 3506— 1991.—Section 207(a) of the High-Performance ‘‘(8) promoting, in consultation with the
(A) in subsection (b)(1)(C), by inserting ‘‘, Computing Act of 1991 (15 U.S.C. 5527(a)) is Director of the Cybersecurity and Infrastruc-
availability’’ after ‘‘integrity’’; and amended by striking ‘‘section ture Security Agency and the Director of the
(B) in subsection (h)(3), by inserting ‘‘secu- 3552(b)(6)(A)(i)’’ and inserting ‘‘section National Institute of Standards and Tech-
rity,’’ after ‘‘efficiency,’’; and 3552(b)(9)(A)(i)’’. nology—
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00064 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8471
‘‘(A) the use of automation to improve ‘‘(9) agency system risk assessments per- the Cybersecurity and Infrastructure Secu-
Federal cybersecurity and visibility with re- formed under section 3554(a)(1)(A); and rity Agency, information’’;
spect to the implementation of Federal cy- ‘‘(10) any other information the Director of (IV) in subparagraph (C), as so redesig-
bersecurity; and the Cybersecurity and Infrastructure Secu- nated—
‘‘(B) the use of presumption of compromise rity Agency determines relevant.’’; and (aa) in clause (ii) by inserting ‘‘binding’’
and least privilege principles to improve re- (G) in subsection (j), as so redesignated— before ‘‘operational’’; and
siliency and timely response actions to inci- (i) by striking ‘‘regarding the specific’’ and (bb) in clause (vi), by striking ‘‘and’’ at the
dents on Federal systems.’’; inserting ‘‘that includes a summary of— end; and
(C) in subsection (b)— ‘‘(1) the specific’’; (V) by adding at the end the following:
(i) by striking the subsection heading and (ii) in paragraph (1), as so designated, by ‘‘(E) providing an update on the ongoing
inserting ‘‘CYBERSECURITY AND INFRASTRUC- striking the period at the end and inserting and continuous assessment performed under
TURE SECURITY AGENCY’’; ‘‘; and’’ and subparagraph (A)—
(ii) in the matter preceding paragraph (1), (iii) by adding at the end the following: ‘‘(i) upon request, to the inspector general
by striking ‘‘The Secretary, in consultation ‘‘(2) the trends identified in the Federal of the agency or the Comptroller General of
with the Director’’ and inserting ‘‘The Direc- risk assessment performed under subsection the United States; and
tor of the Cybersecurity and Infrastructure (i).’’; and ‘‘(ii) on a periodic basis, as determined by
Security Agency, in consultation with the (H) by adding at the end the following: guidance issued by the Director but not less
Director and the National Cyber Director’’; ‘‘(n) BINDING OPERATIONAL DIRECTIVES.—If
frequently than annually, to—
(iii) in paragraph (2)— the Director of the Cybersecurity and Infra-
structure Security Agency issues a binding ‘‘(I) the Director;
(I) in subparagraph (A), by inserting ‘‘and ‘‘(II) the Director of the Cybersecurity and
reporting requirements under subchapter IV operational directive or an emergency direc-
tive under this section, not later than 2 days Infrastructure Security Agency; and
of this title’’ after ‘‘section 3556’’; and ‘‘(III) the National Cyber Director;
(II) in subparagraph (D), by striking ‘‘the after the date on which the binding oper-
ational directive requires an agency to take ‘‘(F) in consultation with the Director of
Director or Secretary’’ and inserting ‘‘the the Cybersecurity and Infrastructure Secu-
an action, the Director of the Cybersecurity
Director of the Cybersecurity and Infrastruc- rity Agency and not less frequently than
and Infrastructure Security Agency shall
ture Security Agency’’; once every 3 years, performing an evaluation
provide to the appropriate reporting entities
(iv) in paragraph (5), by striking ‘‘coordi- of whether additional cybersecurity proce-
the status of the implementation of the bind-
nating’’ and inserting ‘‘leading the coordina- ing operational directive at the agency.’’; dures are appropriate for securing a system
tion of’’; (3) in section 3554— of, or under the supervision of, the agency,
(v) in paragraph (8), by striking ‘‘the Sec- (A) in subsection (a)— which shall—
retary’s discretion’’ and inserting ‘‘the Di- (i) in paragraph (1)— ‘‘(i) be completed considering the agency
rector of the Cybersecurity and Infrastruc- (I) by redesignating subparagraphs (A), (B), system risk assessment performed under sub-
ture Security Agency’s discretion’’; and and (C) as subparagraphs (B), (C), and (D), re- paragraph (A); and
(vi) in paragraph (9), by striking ‘‘as the spectively; ‘‘(ii) include a specific evaluation for high
Director or the Secretary, in consultation (II) by inserting before subparagraph (B), value assets;
with the Director,’’ and inserting ‘‘as the Di- as so redesignated, the following: ‘‘(G) not later than 30 days after com-
rector of the Cybersecurity and Infrastruc- ‘‘(A) on an ongoing and continuous basis, pleting the evaluation performed under sub-
ture Security Agency’’; performing agency system risk assessments paragraph (F), providing the evaluation and
(D) in subsection (c)— that— an implementation plan, if applicable, for
(i) in the matter preceding paragraph (1), ‘‘(i) identify and document the high value using additional cybersecurity procedures
by striking ‘‘each year’’ and inserting ‘‘each assets of the agency using guidance from the determined to be appropriate to—
year during which agencies are required to Director; ‘‘(i) the Director of the Cybersecurity and
submit reports under section 3554(c)’’; ‘‘(ii) evaluate the data assets inventoried Infrastructure Security Agency;
(ii) by striking paragraph (1); under section 3511 for sensitivity to com- ‘‘(ii) the Director; and
(iii) by redesignating paragraphs (2), (3), promises in confidentiality, integrity, and ‘‘(iii) the National Cyber Director; and
and (4) as paragraphs (1), (2), and (3), respec- availability; ‘‘(H) if the head of the agency determines
tively; ‘‘(iii) identify agency systems that have there is need for additional cybersecurity
(iv) in paragraph (3), as so redesignated, by access to or hold the data assets inventoried procedures, ensuring that those additional
striking ‘‘and’’ at the end; under section 3511; cybersecurity procedures are reflected in the
(v) by inserting after paragraph (3), as so ‘‘(iv) evaluate the threats facing agency budget request of the agency in accordance
redesignated the following: systems and data, including high value as- with the risk-based cyber budget model de-
‘‘(4) a summary of each assessment of Fed- sets, based on Federal and non-Federal cyber veloped pursuant to section 3553(a)(7);’’;
eral risk posture performed under subsection threat intelligence products, where avail- (ii) in paragraph (2)—
(i);’’; and able; (I) in subparagraph (A), by inserting ‘‘in
(vi) in paragraph (5), by striking the period ‘‘(v) evaluate the vulnerability of agency accordance with the agency system risk as-
at the end and inserting ‘‘; and’’; systems and data, including high value as- sessment performed under paragraph (1)(A)’’
(E) by redesignating subsections (i), (j), sets, including by analyzing— after ‘‘information systems’’;
(k), and (l) as subsections (j), (k), (l), and (m) ‘‘(I) the results of penetration testing per- (II) in subparagraph (B)—
respectively; formed by the Department of Homeland Se- (aa) by striking ‘‘in accordance with stand-
(F) by inserting after subsection (h) the curity under section 3553(b)(9); ards’’ and inserting ‘‘in accordance with—
following: ‘‘(II) the results of penetration testing per- ‘‘(i) standards’’; and
‘‘(i) FEDERAL RISK ASSESSMENTS.—On an formed under section 3559A; (bb) by adding at the end the following:
ongoing and continuous basis, the Director ‘‘(III) information provided to the agency ‘‘(ii) the evaluation performed under para-
of the Cybersecurity and Infrastructure Se- through the vulnerability disclosure pro- graph (1)(F); and
curity Agency shall perform assessments of gram of the agency under section 3559B; ‘‘(iii) the implementation plan described in
Federal risk posture using any available in- ‘‘(IV) incidents; and paragraph (1)(G);’’; and
formation on the cybersecurity posture of ‘‘(V) any other vulnerability information (III) in subparagraph (D), by inserting ‘‘,
agencies, and brief the Director and National relating to agency systems that is known to through the use of penetration testing, the
Cyber Director on the findings of those as- the agency; vulnerability disclosure program established
sessments including— ‘‘(vi) assess the impacts of potential agen- under section 3559B, and other means,’’ after
‘‘(1) the status of agency cybersecurity re- cy incidents to agency systems, data, and op- ‘‘periodically’’;
medial actions described in section 3554(b)(7); erations based on the evaluations described (iii) in paragraph (3)—
‘‘(2) any vulnerability information relating in clauses (ii) and (iv) and the agency sys- (I) in subparagraph (A)—
to the systems of an agency that is known by tems identified under clause (iii); and (aa) in clause (iii), by striking ‘‘and’’ at the
the agency; ‘‘(vii) assess the consequences of potential end;
‘‘(3) analysis of incident information under incidents occurring on agency systems that (bb) in clause (iv), by adding ‘‘and’’ at the
section 3597; would impact systems at other agencies, in- end; and
‘‘(4) evaluation of penetration testing per- cluding due to interconnectivity between dif- (cc) by adding at the end the following:
formed under section 3559A; ferent agency systems or operational reli- ‘‘(v) ensure that—
‘‘(5) evaluation of vulnerability disclosure ance on the operations of the system or data ‘‘(I) senior agency information security of-
ctelli on DSK11ZRN23PROD with SENATE
program information under section 3559B; in the system;’’; ficers of component agencies carry out re-
‘‘(6) evaluation of agency threat hunting (III) in subparagraph (B), as so redesig- sponsibilities under this subchapter, as di-
results; nated, in the matter preceding clause (i), by rected by the senior agency information se-
‘‘(7) evaluation of Federal and non-Federal striking ‘‘providing information’’ and insert- curity officer of the agency or an equivalent
cyber threat intelligence; ing ‘‘using information from the assessment official; and
‘‘(8) data on agency compliance with stand- conducted under subparagraph (A), pro- ‘‘(II) senior agency information security
ards issued under section 11331 of title 40; viding, in consultation with the Director of officers of component agencies report to—
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00065 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8472 CONGRESSIONAL RECORD — SENATE November 18, 2021
‘‘(aa) the senior information security offi- (dd) by redesignating subclause (IV) as sub- (A) in the section heading, by striking ‘‘AN-
cer of the agency or an equivalent official; clause (III); NUAL INDEPENDENT’’ and inserting ‘‘INDE-
and (C) in subsection (c)— PENDENT’’;
‘‘(bb) the Chief Information Officer of the (i) by redesignating paragraph (2) as para- (B) in subsection (a)—
component agency or an equivalent offi- graph (5); (i) in paragraph (1), by inserting ‘‘during
cial;’’; and (ii) by striking paragraph (1) and inserting which a report is required to be submitted
(iv) in paragraph (5), by inserting ‘‘and the the following: under section 3553(c),’’ after ‘‘Each year’’;
Director of the Cybersecurity and Infrastruc- ‘‘(1) BIANNUAL REPORT.—Not later than 2 (ii) in paragraph (2)(A), by inserting ‘‘, in-
ture Security Agency’’ before ‘‘on the effec- years after the date of enactment of the Fed- cluding by penetration testing and analyzing
tiveness’’; eral Information Security Modernization Act the vulnerability disclosure program of the
(B) in subsection (b)— of 2021 and not less frequently than once agency’’ after ‘‘information systems’’; and
(i) by striking paragraph (1) and inserting every 2 years thereafter, using the contin- (iii) by adding at the end the following:
the following: uous and ongoing agency system risk assess- ‘‘(3) An evaluation under this section may
‘‘(1) pursuant to subsection (a)(1)(A), per- ment under subsection (a)(1)(A), the head of include recommendations for improving the
forming ongoing and continuous agency sys- each agency shall submit to the Director, cybersecurity posture of the agency.’’;
tem risk assessments, which may include the Director of the Cybersecurity and Infra- (C) in subsection (b)(1), by striking ‘‘an-
using guidelines and automated tools con- structure Security Agency, the majority and nual’’;
sistent with standards and guidelines pro- minority leaders of the Senate, the Speaker (D) in subsection (e)(1), by inserting ‘‘dur-
mulgated under section 11331 of title 40, as ing which a report is required to be sub-
and minority leader of the House of Rep-
applicable;’’; mitted under section 3553(c)’’ after ‘‘Each
resentatives, the Committee on Homeland
(ii) in paragraph (2)— year’’;
Security and Governmental Affairs of the
(I) by striking subparagraph (B) and insert- (E) by striking subsection (f) and inserting
Senate, the Committee on Oversight and Re-
ing the following: the following:
form of the House of Representatives, the
‘‘(B) comply with the risk-based cyber ‘‘(f) PROTECTION OF INFORMATION.—(1)
Committee on Homeland Security of the
budget model developed pursuant to section Agencies, evaluators, and other recipients of
3553(a)(7);’’; and House of Representatives, the Committee on
Commerce, Science, and Transportation of information that, if disclosed, may cause
(II) in subparagraph (D)— grave harm to the efforts of Federal informa-
(aa) by redesignating clauses (iii) and (iv) the Senate, the Committee on Science,
Space, and Technology of the House of Rep- tion security officers shall take appropriate
as clauses (iv) and (v), respectively;
resentatives, the appropriate authorization steps to ensure the protection of that infor-
(bb) by inserting after clause (ii) the fol-
and appropriations committees of Congress, mation, including safeguarding the informa-
lowing:
the National Cyber Director, and the Comp- tion from public disclosure.
‘‘(iii) binding operational directives and
troller General of the United States a report ‘‘(2) The protections required under para-
emergency directives promulgated by the Di-
that— graph (1) shall be commensurate with the
rector of the Cybersecurity and Infrastruc-
‘‘(A) summarizes the agency system risk risk and comply with all applicable laws and
ture Security Agency under section 3553;’’;
and assessment performed under subsection regulations.
(cc) in clause (iv), as so redesignated, by (a)(1)(A); ‘‘(3) With respect to information that is
striking ‘‘as determined by the agency; and’’ ‘‘(B) evaluates the adequacy and effective- not related to national security systems,
and inserting ‘‘as determined by the agency, ness of information security policies, proce- agencies and evaluators shall make a sum-
considering— dures, and practices of the agency to address mary of the information unclassified and
‘‘(I) the agency risk assessment performed the risks identified in the agency system publicly available, including information
under subsection (a)(1)(A); and risk assessment performed under subsection that does not identify—
‘‘(II) the determinations of applying more (a)(1)(A), including an analysis of the agen- ‘‘(A) specific information system incidents;
stringent standards and additional cyberse- cy’s cybersecurity and incident response ca- or
curity procedures pursuant to section pabilities using the metrics established ‘‘(B) specific information system
11331(c)(1) of title 40; and’’; under section 224(c) of the Cybersecurity Act vulnerabilities.’’;
(iii) in paragraph (5)(A), by inserting ‘‘, in- of 2015 (6 U.S.C. 1522(c)); (F) in subsection (g)(2)—
cluding penetration testing, as appropriate,’’ ‘‘(C) summarizes the evaluation and imple- (i) by striking ‘‘this subsection shall’’ and
after ‘‘shall include testing’’; mentation plans described in subparagraphs inserting ‘‘this subsection—
(iv) in paragraph (6), by striking ‘‘plan- (F) and (G) of subsection (a)(1) and whether ‘‘(A) shall’’;
ning, implementing, evaluating, and docu- those evaluation and implementation plans (ii) in subparagraph (A), as so designated,
menting’’ and inserting ‘‘planning and imple- call for the use of additional cybersecurity by striking the period at the end and insert-
menting and, in consultation with the Direc- procedures determined to be appropriate by ing ‘‘; and’’; and
tor of the Cybersecurity and Infrastructure the agency; and (iii) by adding at the end the following:
Security Agency, evaluating and docu- ‘‘(D) summarizes the status of remedial ac- ‘‘(B) identify any entity that performs an
menting’’; tions identified by inspector general of the independent evaluation under subsection
(v) by redesignating paragraphs (7) and (8) agency, the Comptroller General of the (b).’’; and
as paragraphs (8) and (9), respectively; United States, and any other source deter- (G) by striking subsection (j) and inserting
(vi) by inserting after paragraph (6) the fol- mined appropriate by the head of the agency. the following:
lowing: ‘‘(2) UNCLASSIFIED REPORTS.—Each report ‘‘(j) GUIDANCE.—
‘‘(7) a process for providing the status of submitted under paragraph (1)— ‘‘(1) IN GENERAL.—The Director, in con-
every remedial action and known system ‘‘(A) shall be, to the greatest extent prac- sultation with the Director of the Cybersecu-
vulnerability to the Director and the Direc- ticable, in an unclassified and otherwise un- rity and Infrastructure Security Agency, the
tor of the Cybersecurity and Infrastructure controlled form; and Chief Information Officers Council, the
Security Agency, using automation and ma- ‘‘(B) may include a classified annex. Council of the Inspectors General on Integ-
chine-readable data to the greatest extent ‘‘(3) ACCESS TO INFORMATION.—The head of rity and Efficiency, and other interested par-
practicable;’’; and an agency shall ensure that, to the greatest ties as appropriate, shall ensure the develop-
(vii) in paragraph (8)(C), as so redesig- extent practicable, information is included ment of guidance for evaluating the effec-
nated— in the unclassified form of the report sub- tiveness of an information security program
(I) by striking clause (ii) and inserting the mitted by the agency under paragraph (2)(A). and practices
following: ‘‘(4) BRIEFINGS.—During each year during ‘‘(2) PRIORITIES.—The guidance developed
‘‘(ii) notifying and consulting with the which a report is not required to be sub- under paragraph (1) shall prioritize the iden-
Federal information security incident center mitted under paragraph (1), the Director tification of—
established under section 3556 pursuant to shall provide to the congressional commit- ‘‘(A) the most common threat patterns ex-
the requirements of section 3594;’’; tees described in paragraph (1) a briefing perienced by each agency;
(II) by redesignating clause (iii) as clause summarizing current agency and Federal ‘‘(B) the security controls that address the
(iv); risk postures.’’; and threat patterns described in subparagraph
(III) by inserting after clause (ii) the fol- (iii) in paragraph (5), as so redesignated, by (A); and
lowing: striking the period at the end and inserting ‘‘(C) any other security risks unique to the
‘‘(iii) performing the notifications and ‘‘, including the reporting procedures estab- networks of each agency.’’; and
other activities required under subchapter lished under section 11315(d) of title 40 and (5) in section 3556(a)—
ctelli on DSK11ZRN23PROD with SENATE
IV of this title; and’’; and subsection (a)(3)(A)(v) of this section.’’; and (A) in the matter preceding paragraph (1),
(IV) in clause (iv), as so redesignated— (D) in subsection (d)(1), in the matter pre- by inserting ‘‘within the Cybersecurity and
(aa) in subclause (I), by striking ‘‘and rel- ceding subparagraph (A), by inserting ‘‘and Infrastructure Security Agency’’ after ‘‘inci-
evant offices of inspectors general’’; the Director of the Cybersecurity and Infra- dent center’’; and
(bb) in subclause (II), by adding ‘‘and’’ at structure Security Agency’’ after ‘‘the Direc- (B) in paragraph (4), by striking ‘‘3554(b)’’
the end; tor’’; and and inserting ‘‘3554(a)(1)(A)’’.
(cc) by striking subclause (III); and (4) in section 3555— (d) CONFORMING AMENDMENTS.—
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00066 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8473
(1) TABLE OF SECTIONS.—The table of sec- ‘‘(4) CONTRACTOR.—The term ‘contractor’ Federal law enforcement agencies and each
tions for chapter 35 of title 44, United States means— nationwide consumer reporting agency; and
Code, is amended— ‘‘(A) a prime contractor of an agency or a ‘‘(6) any other appropriate information, as
(A) by striking the item relating to section subcontractor of a prime contractor of an determined by the head of the agency or es-
3553 and inserting the following: agency; and tablished in guidance by the Director.
‘‘3553. Authority and functions of the Direc- ‘‘(B) any person or business that collects or ‘‘(c) DELAY OF NOTIFICATION.—
tor and the Director of the Cy- maintains information, including personally ‘‘(1) IN GENERAL.—The Attorney General,
bersecurity and Infrastructure identifiable information, on behalf of an the Director of National Intelligence, or the
Security Agency.’’; and agency. Secretary of Homeland Security may delay a
(B) by striking the item relating to section ‘‘(5) FEDERAL INFORMATION.—The term notification required under subsection (a) if
3555 and inserting the following: ‘Federal information’ means information the notification would—
‘‘3555. Independent evaluation.’’. created, collected, processed, maintained, ‘‘(A) impede a criminal investigation or a
(2) OMB REPORTS.—Section 226(c) of the Cy- disseminated, disclosed, or disposed of by or national security activity;
bersecurity Act of 2015 (6 U.S.C. 1524(c)) is for the Federal Government in any medium ‘‘(B) reveal sensitive sources and methods;
amended— or form. ‘‘(C) cause damage to national security; or
(A) in paragraph (1)(B), in the matter pre- ‘‘(6) FEDERAL INFORMATION SYSTEM.—The ‘‘(D) hamper security remediation actions.
ceding clause (i), by striking ‘‘annually term ‘Federal information system’ means an ‘‘(2) DOCUMENTATION.—
thereafter’’ and inserting ‘‘thereafter during information system used or operated by an ‘‘(A) IN GENERAL.—Any delay under para-
the years during which a report is required agency, a contractor, an awardee, or another graph (1) shall be reported in writing to the
to be submitted under section 3553(c) of title organization on behalf of an agency. Director, the Attorney General, the Director
44, United States Code’’; and ‘‘(7) INTELLIGENCE COMMUNITY.—The term of National Intelligence, the Secretary of
(B) in paragraph (2)(B), in the matter pre- ‘intelligence community’ has the meaning Homeland Security, the Director of the Cy-
ceding clause (i)— given the term in section 3 of the National bersecurity and Infrastructure Security
(i) by striking ‘‘annually thereafter’’ and Security Act of 1947 (50 U.S.C. 3003). Agency, and the head of the agency and the
inserting ‘‘thereafter during the years during ‘‘(8) NATIONWIDE CONSUMER REPORTING inspector general of the agency that experi-
which a report is required to be submitted AGENCY.—The term ‘nationwide consumer re- enced the breach.
under section 3553(c) of title 44, United porting agency’ means a consumer reporting ‘‘(B) CONTENTS.—A report required under
States Code’’; and agency described in section 603(p) of the Fair subparagraph (A) shall include a written
(ii) by striking ‘‘the report required under Credit Reporting Act (15 U.S.C. 1681a(p)). statement from the entity that delayed the
section 3553(c) of title 44, United States ‘‘(9) VULNERABILITY DISCLOSURE.—The term notification explaining the need for the
Code’’ and inserting ‘‘that report’’. ‘vulnerability disclosure’ means a vulner- delay.
(3) NIST RESPONSIBILITIES.—Section ability identified under section 3559B. ‘‘(C) FORM.—The report required under sub-
20(d)(3)(B) of the National Institute of Stand- ‘‘§ 3592. Notification of breach paragraph (A) shall be unclassified but may
ards and Technology Act (15 U.S.C. 278g– ‘‘(a) NOTIFICATION.—As expeditiously as include a classified annex.
3(d)(3)(B)) is amended by striking ‘‘annual’’. practicable and without unreasonable delay, ‘‘(3) RENEWAL.—A delay under paragraph
(e) FEDERAL SYSTEM INCIDENT RESPONSE.— and in any case not later than 45 days after (1) shall be for a period of 60 days and may be
(1) IN GENERAL.—Chapter 35 of title 44, an agency has a reasonable basis to conclude renewed.
United States Code, is amended by adding at that a breach has occurred, the head of the ‘‘(d) UPDATE NOTIFICATION.—If an agency
the end the following: agency, in consultation with a senior privacy determines there is a significant change in
‘‘SUBCHAPTER IV—FEDERAL SYSTEM officer of the agency, shall— the reasonable basis to conclude that a
INCIDENT RESPONSE ‘‘(1) determine whether notice to any indi- breach occurred, a significant change to the
‘‘§ 3591. Definitions vidual potentially affected by the breach is determination made under subsection (a)(1),
‘‘(a) IN GENERAL.—Except as provided in appropriate based on an assessment of the or that it is necessary to update the details
subsection (b), the definitions under sections risk of harm to the individual that con- of the information provided to impacted in-
3502 and 3552 shall apply to this subchapter. siders— dividuals as described in subsection (b), the
‘‘(b) ADDITIONAL DEFINITIONS.—As used in ‘‘(A) the nature and sensitivity of the per- agency shall as expeditiously as practicable
this subchapter: sonally identifiable information affected by and without unreasonable delay, and in any
‘‘(1) APPROPRIATE REPORTING ENTITIES.— the breach; case not later than 30 days after such a de-
The term ‘appropriate reporting entities’ ‘‘(B) the likelihood of access to and use of termination, notify each individual who re-
means— the personally identifiable information af- ceived a notification pursuant to subsection
‘‘(A) the majority and minority leaders of fected by the breach; (a) of those changes.
the Senate; ‘‘(C) the type of breach; and ‘‘(e) EXEMPTION FROM NOTIFICATION.—
‘‘(B) the Speaker and minority leader of ‘‘(D) any other factors determined by the ‘‘(1) IN GENERAL.—The head of an agency,
the House of Representatives; Director; and in consultation with the inspector general of
‘‘(C) the Committee on Homeland Security ‘‘(2) as appropriate, provide written notice the agency, may request an exemption from
and Governmental Affairs of the Senate; in accordance with subsection (b) to each in- the Director from complying with the notifi-
‘‘(D) the Committee on Oversight and Re- dividual potentially affected by the breach— cation requirements under subsection (a) if
form of the House of Representatives; ‘‘(A) to the last known mailing address of the information affected by the breach is de-
‘‘(E) the Committee on Homeland Security the individual; or termined by an independent evaluation to be
of the House of Representatives; ‘‘(B) through an appropriate alternative unreadable, including, as appropriate, in-
‘‘(F) the appropriate authorization and ap- method of notification that the head of the stances in which the information is—
propriations committees of Congress; agency or a designated senior-level indi- ‘‘(A) encrypted; and
‘‘(G) the Director; vidual of the agency selects based on factors ‘‘(B) determined by the Director of the Cy-
‘‘(H) the Director of the Cybersecurity and determined by the Director. bersecurity and Infrastructure Security
Infrastructure Security Agency; ‘‘(b) CONTENTS OF NOTICE.—Each notice of a Agency to be of sufficiently low risk of expo-
‘‘(I) the National Cyber Director; breach provided to an individual under sub- sure.
‘‘(J) the Comptroller General of the United section (a)(2) shall include— ‘‘(2) APPROVAL.—The Director shall deter-
States; and ‘‘(1) a brief description of the rationale for mine whether to grant an exemption re-
‘‘(K) the inspector general of any impacted the determination that notice should be pro- quested under paragraph (1) in consultation
agency. vided under subsection (a); with—
‘‘(2) AWARDEE.—The term ‘awardee’— ‘‘(2) if possible, a description of the types ‘‘(A) the Director of the Cybersecurity and
‘‘(A) means a person, business, or other en- of personally identifiable information af- Infrastructure Security Agency; and
tity that receives a grant from, or is a party fected by the breach; ‘‘(B) the Attorney General.
to a cooperative agreement or an other ‘‘(3) contact information of the agency ‘‘(3) DOCUMENTATION.—Any exemption
transaction agreement with, an agency; and that may be used to ask questions of the granted by the Director under paragraph (1)
‘‘(B) includes any subgrantee of a person, agency, which— shall be reported in writing to the head of
business, or other entity described in sub- ‘‘(A) shall include an e-mail address or an- the agency and the inspector general of the
paragraph (A). other digital contact mechanism; and agency that experienced the breach and the
‘‘(3) BREACH.—The term ‘breach’ means— ‘‘(B) may include a telephone number or a Director of the Cybersecurity and Infrastruc-
‘‘(A) a compromise of the security, con- website; ture Security Agency.
ctelli on DSK11ZRN23PROD with SENATE
fidentiality, or integrity of data in elec- ‘‘(4) information on any remedy being of- ‘‘(f) RULE OF CONSTRUCTION.—Nothing in
tronic form that results in unauthorized ac- fered by the agency; this section shall be construed to limit—
cess to, or an acquisition of, personal infor- ‘‘(5) any applicable educational materials ‘‘(1) the Director from issuing guidance re-
mation; or relating to what individuals can do in re- lating to notifications or the head of an
‘‘(B) a loss of data in electronic form that sponse to a breach that potentially affects agency from notifying individuals poten-
results in unauthorized access to, or an ac- their personally identifiable information, in- tially affected by breaches that are not de-
quisition of, personal information. cluding relevant contact information for termined to be major incidents; or
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00067 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8474 CONGRESSIONAL RECORD — SENATE November 18, 2021
‘‘(2) the Director from issuing guidance re- ‘‘(6) an update to the assessment of the ‘‘(C) in order to protect against a similar
lating to notifications of major incidents or risk to agency operations, or to impacts on incident, identify—
the head of an agency from providing more other agency or non-Federal entity oper- ‘‘(i) how the safeguards described in sub-
information than described in subsection (b) ations, affected by the major incident based paragraph (A) should be implemented dif-
when notifying individuals potentially af- on information available to agency officials ferently; and
fected by breaches. as of the date on which the agency provides ‘‘(ii) additional necessary safeguards; and
‘‘§ 3593. Congressional and Executive Branch the update; and ‘‘(D) include information to aid in incident
reports ‘‘(7) the detection, response, and remedi- response, such as—
‘‘(a) INITIAL REPORT.— ation actions of the agency, including any ‘‘(i) a description of the affected systems or
‘‘(1) IN GENERAL.—Not later than 72 hours support provided by the Cybersecurity and networks;
after an agency has a reasonable basis to Infrastructure Security Agency under sec- ‘‘(ii) the estimated dates of when the inci-
conclude that a major incident occurred, the tion 3594(d) and status updates on the notifi- dent occurred; and
head of the agency impacted by the major in- cation process described in section 3592(a), ‘‘(iii) information that could reasonably
cident shall submit to the appropriate re- including any delay or exemption described help identify the party that conducted the
porting entities a written report and, to the in subsection (c) or (e), respectively, of sec- incident.
extent practicable, provide a briefing to the tion 3592, if applicable. ‘‘(3) INFORMATION SHARING.—To the great-
‘‘(c) UPDATE REPORT.—If the agency deter- est extent practicable, the Director of the
Committee on Homeland Security and Gov-
mines that there is any significant change in Cybersecurity and Infrastructure Security
ernmental Affairs of the Senate, the Com-
the understanding of the agency of the scope, Agency shall share information relating to
mittee on Oversight and Reform of the House
scale, or consequence of a major incident for an incident with any agencies that may be
of Representatives, the Committee on Home-
which an agency submitted a written report impacted by the incident.
land Security of the House of Representa- under subsection (a), the agency shall pro-
tives, and the appropriate authorization and ‘‘(4) NATIONAL SECURITY SYSTEMS.—Each
vide an updated report to the appropriate re- agency operating or exercising control of a
appropriations committees of Congress, tak- porting entities that includes information
ing into account— national security system shall share infor-
relating to the change in understanding. mation about incidents that occur on na-
‘‘(A) the information known at the time of ‘‘(d) ANNUAL REPORT.—Each agency shall
the report; tional security systems with the Director of
submit as part of the annual report required
‘‘(B) the sensitivity of the details associ- the Cybersecurity and Infrastructure Secu-
under section 3554(c)(1) of this title a descrip-
ated with the major incident; and rity Agency to the extent consistent with
tion of each major incident that occurred
‘‘(C) the classification level of the informa- standards and guidelines for national secu-
during the 1-year period preceding the date
tion contained in the report. rity systems issued in accordance with law
on which the report is submitted.
‘‘(2) CONTENTS.—A report required under ‘‘(e) DELAY AND EXEMPTION REPORT.— and as directed by the President.
paragraph (1) shall include, in a manner that ‘‘(1) IN GENERAL.—The Director shall sub- ‘‘(b) COMPLIANCE.—The information pro-
excludes or otherwise reasonably protects mit to the appropriate notification entities vided under subsection (a) shall take into ac-
personally identifiable information and to an annual report on all notification delays count the level of classification of the infor-
the extent permitted by applicable law, in- and exemptions granted pursuant to sub- mation and any information sharing limita-
cluding privacy and statistical laws— sections (c) and (d) of section 3592. tions and protections, such as limitations
‘‘(A) a summary of the information avail- ‘‘(2) COMPONENT OF OTHER REPORT.—The Di- and protections relating to law enforcement,
able about the major incident, including how rector may submit the report required under national security, privacy, statistical con-
the major incident occurred, information in- paragraph (1) as a component of the annual fidentiality, or other factors determined by
dicating that the major incident may be a report submitted under section 3597(b). the Director
‘‘(f) REPORT DELIVERY.—Any written report ‘‘(c) INCIDENT RESPONSE.—Each agency
breach, and information relating to the
required to be submitted under this section that has a reasonable basis to conclude that
major incident as a breach, based on infor-
may be submitted in a paper or electronic a major incident occurred involving Federal
mation available to agency officials as of the
format. information in electronic medium or form,
date on which the agency submits the report;
‘‘(g) THREAT BRIEFING.— as defined by the Director and not involving
‘‘(B) if applicable, a description and any as-
‘‘(1) IN GENERAL.—Not later than 7 days a national security system, regardless of
sociated documentation of any cir-
after the date on which an agency has a rea- delays from notification granted for a major
cumstances necessitating a delay in or ex-
sonable basis to conclude that a major inci- incident, shall coordinate with the Cyberse-
emption to notification to individuals poten-
dent occurred, the head of the agency, joint- curity and Infrastructure Security Agency
tially affected by the major incident under
ly with the National Cyber Director and any regarding—
subsection (c) or (e) of section 3592; and
other Federal entity determined appropriate ‘‘(1) incident response and recovery; and
‘‘(C) if applicable, an assessment of the im-
by the National Cyber Director, shall provide ‘‘(2) recommendations for mitigating fu-
pacts to the agency, the Federal Govern-
a briefing to the congressional committees ture incidents.
ment, or the security of the United States,
based on information available to agency of- described in subsection (a)(1) on the threat ‘‘§ 3595. Responsibilities of contractors and
ficials on the date on which the agency sub- causing the major incident. awardees
mits the report. ‘‘(2) COMPONENTS.—The briefing required ‘‘(a) NOTIFICATION.—
‘‘(b) SUPPLEMENTAL REPORT.—Within a rea- under paragraph (1)— ‘‘(1) IN GENERAL.—Unless otherwise speci-
sonable amount of time, but not later than ‘‘(A) shall, to the greatest extent prac- fied in a contract, grant, cooperative agree-
30 days after the date on which an agency ticable, include an unclassified component; ment, or an other transaction agreement,
submits a written report under subsection and any contractor or awardee of an agency shall
(a), the head of the agency shall provide to ‘‘(B) may include a classified component. report to the agency within the same
the appropriate reporting entities written ‘‘(h) RULE OF CONSTRUCTION.—Nothing in amount of time such agency is required to
updates on the major incident and, to the ex- this section shall be construed to limit— report an incident to the Cybersecurity and
tent practicable, provide a briefing to the ‘‘(1) the ability of an agency to provide ad- Infrastructure Security Agency, if the con-
congressional committees described in sub- ditional reports or briefings to Congress; or tractor or awardee has a reasonable basis to
section (a)(1), including summaries of— ‘‘(2) Congress from requesting additional conclude that—
‘‘(1) vulnerabilities, means by which the information from agencies through reports, ‘‘(A) an incident or breach has occurred
major incident occurred, and impacts to the briefings, or other means. with respect to Federal information col-
agency relating to the major incident; ‘‘§ 3594. Government information sharing and lected, used, or maintained by the contractor
‘‘(2) any risk assessment and subsequent incident response or awardee in connection with the contract,
risk-based security implementation of the ‘‘(a) IN GENERAL.— grant, cooperative agreement, or other
affected information system before the date ‘‘(1) INCIDENT REPORTING.—The head of each transaction agreement of the contractor or
on which the major incident occurred; agency shall provide any information relat- awardee;
‘‘(3) the status of compliance of the af- ing to any incident, whether the information ‘‘(B) an incident or breach has occurred
fected information system with applicable is obtained by the Federal Government di- with respect to a Federal information sys-
security requirements at the time of the rectly or indirectly, to the Cybersecurity tem used or operated by the contractor or
major incident; and Infrastructure Security Agency and the awardee in connection with the contract,
‘‘(4) an estimate of the number of individ- Office of Management and Budget. grant, cooperative agreement, or other
uals potentially affected by the major inci- ‘‘(2) CONTENTS.—A provision of information transaction agreement of the contractor or
dent based on information available to agen- relating to an incident made by the head of awardee; or
ctelli on DSK11ZRN23PROD with SENATE
cy officials as of the date on which the agen- an agency under paragraph (1) shall— ‘‘(C) the contractor or awardee has re-
cy provides the update; ‘‘(A) include detailed information about ceived information from the agency that the
‘‘(5) an assessment of the risk of harm to the safeguards that were in place when the contractor or awardee is not authorized to
individuals potentially affected by the major incident occurred; receive in connection with the contract,
incident based on information available to ‘‘(B) whether the agency implemented the grant, cooperative agreement, or other
agency officials as of the date on which the safeguards described in subparagraph (A) transaction agreement of the contractor or
agency provides the update; correctly; awardee.
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00068 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8475
‘‘(2) PROCEDURES.— ‘‘(B) FORMAT.—In carrying out subpara- ‘‘(ii) the Speaker and minority leader of
‘‘(A) MAJOR INCIDENT.—Following a report graph (A), the Director shall share the anal- the House of Representatives;
of a breach or major incident by a contractor yses— ‘‘(iii) the Committee on Homeland Secu-
or awardee under paragraph (1), the agency, ‘‘(i) in human-readable written products; rity and Governmental Affairs of the Senate;
in consultation with the contractor or and ‘‘(iv) the Select Committee on Intelligence
awardee, shall carry out the requirements ‘‘(ii) to the greatest extent practicable, in of the Senate;
under sections 3592, 3593, and 3594 with re- machine-readable formats in order to enable ‘‘(v) the Committee on Armed Services of
spect to the major incident. automated intake and use by agencies. the Senate;
‘‘(B) INCIDENT.—Following a report of an ‘‘(b) ANNUAL REPORT ON FEDERAL INCI- ‘‘(vi) the Committee on Appropriations of
incident by a contractor or awardee under DENTS.—Not later than 2 years after the date the Senate;
paragraph (1), an agency, in consultation of enactment of this section, and not less fre- ‘‘(vii) the Committee on Oversight and Re-
with the contractor or awardee, shall carry quently than annually thereafter, the Direc- form of the House of Representatives;
out the requirements under section 3594 with tor of the Cybersecurity and Infrastructure ‘‘(viii) the Committee on Homeland Secu-
respect to the incident. Security Agency, in consultation with the rity of the House of Representatives;
‘‘(b) EFFECTIVE DATE.—This section shall Director and other Federal agencies as ap- ‘‘(ix) the Permanent Select Committee on
apply on and after the date that is 1 year propriate, shall submit to the appropriate Intelligence of the House of Representatives;
after the date of enactment of the Federal notification entities a report that includes— ‘‘(x) the Committee on Armed Services of
Information Security Modernization Act of ‘‘(1) a summary of causes of incidents from the House of Representatives; and
2021. ‘‘(xi) the Committee on Appropriations of
across the Federal Government that cat-
‘‘§ 3596. Training egorizes those incidents as incidents or the House of Representatives.
‘‘(a) COVERED INDIVIDUAL DEFINED.—In this major incidents; ‘‘(B) CLASSIFIED FORM.—A report required
section, the term ‘covered individual’ means ‘‘(2) the quantitative and qualitative anal- under subparagraph (A) may be submitted in
an individual who obtains access to Federal yses of incidents developed under subsection a classified form.
information or Federal information systems (a)(1) on an agency-by-agency basis and com- ‘‘(e) REQUIREMENT FOR COMPILING INFORMA-
because of the status of the individual as an prehensively across the Federal Government, TION.—In publishing the public report re-
employee, contractor, awardee, volunteer, or including— quired under subsection (c), the Director of
intern of an agency. ‘‘(A) a specific analysis of breaches; and the Cybersecurity and Infrastructure Secu-
‘‘(b) REQUIREMENT.—The head of each agen- ‘‘(B) an analysis of the Federal Govern- rity Agency shall sufficiently compile infor-
cy shall develop training for covered individ- ment’s performance against the metrics es- mation such that no specific incident of an
uals on how to identify and respond to an in- agency can be identified, except with the
tablished under section 224(c) of the Cyberse-
cident, including— concurrence of the Director of the Office of
curity Act of 2015 (6 U.S.C. 1522(c)); and
‘‘(1) the internal process of the agency for Management and Budget and in consultation
‘‘(3) an annex for each agency that in-
reporting an incident; and with the impacted agency.
cludes—
‘‘(2) the obligation of a covered individual
‘‘(A) a description of each major incident; ‘‘§ 3598. Major incident definition
to report to the agency a confirmed major
‘‘(B) the total number of compromises of ‘‘(a) IN GENERAL.—Not later than 180 days
incident and any suspected incident involv-
the agency; and after the date of enactment of the Federal
ing information in any medium or form, in-
cluding paper, oral, and electronic. ‘‘(C) an analysis of the agency’s perform- Information Security Modernization Act of
‘‘(c) INCLUSION IN ANNUAL TRAINING.—The ance against the metrics established under 2021, the Director, in coordination with the
training developed under subsection (b) may section 224(c) of the Cybersecurity Act of Director of the Cybersecurity and Infrastruc-
be included as part of an annual privacy or 2015 (6 U.S.C. 1522(c)). ture Security Agency and the National
security awareness training of an agency. ‘‘(c) PUBLICATION.—A version of each report Cyber Director, shall develop and promul-
‘‘§ 3597. Analysis and report on Federal inci- submitted under subsection (b) shall be made gate guidance on the definition of the term
dents publicly available on the website of the Cy- ‘major incident’ for the purposes of sub-
bersecurity and Infrastructure Security chapter II and this subchapter.
‘‘(a) ANALYSIS OF FEDERAL INCIDENTS.—
Agency during the year in which the report ‘‘(b) REQUIREMENTS.—With respect to the
‘‘(1) QUANTITATIVE AND QUALITATIVE ANAL-
YSES.—The Director of the Cybersecurity and
is submitted. guidance issued under subsection (a), the def-
Infrastructure Security Agency shall de- ‘‘(d) INFORMATION PROVIDED BY AGENCIES.— inition of the term ‘major incident’ shall—
velop, in consultation with the Director and ‘‘(1) IN GENERAL.—The analysis required ‘‘(1) include, with respect to any informa-
the National Cyber Director, and perform under subsection (a) and each report sub- tion collected or maintained by or on behalf
continuous monitoring and quantitative and mitted under subsection (b) shall use infor- of an agency or an information system used
qualitative analyses of incidents at agencies, mation provided by agencies under section or operated by an agency or by a contractor
including major incidents, including— 3594(a). of an agency or another organization on be-
‘‘(A) the causes of incidents, including— ‘‘(2) NONCOMPLIANCE REPORTS.— half of an agency—
‘‘(i) attacker tactics, techniques, and pro- ‘‘(A) IN GENERAL.—Subject to subparagraph ‘‘(A) any incident the head of the agency
cedures; and (B), during any year during which the head determines is likely to have an impact on—
‘‘(ii) system vulnerabilities, including zero of an agency does not provide data for an in- ‘‘(i) the national security, homeland secu-
days, unpatched systems, and information cident to the Cybersecurity and Infrastruc- rity, or economic security of the United
system misconfigurations; ture Security Agency in accordance with States; or
‘‘(B) the scope and scale of incidents at section 3594(a), the head of the agency, in co- ‘‘(ii) the civil liberties or public health and
agencies; ordination with the Director of the Cyberse- safety of the people of the United States;
‘‘(C) cross Federal Government root causes curity and Infrastructure Security Agency ‘‘(B) any incident the head of the agency
of incidents at agencies; and the Director, shall submit to the appro- determines likely to result in an inability
‘‘(D) agency incident response, recovery, priate reporting entities a report that in- for the agency, a component of the agency,
and remediation actions and the effective- cludes— or the Federal Government, to provide 1 or
ness of those actions, as applicable; ‘‘(i) data for the incident; and more critical services;
‘‘(E) lessons learned and recommendations ‘‘(ii) the information described in sub- ‘‘(C) any incident that the head of an agen-
in responding to, recovering from, remedi- section (b) with respect to the agency. cy, in consultation with a senior privacy of-
ating, and mitigating future incidents; and ‘‘(B) EXCEPTION FOR NATIONAL SECURITY ficer of the agency, determines is likely to
‘‘(F) trends in cross-Federal Government SYSTEMS.—The head of an agency that owns have a significant privacy impact on 1 or
cybersecurity and incident response capabili- or exercises control of a national security more individual;
ties using the metrics established under sec- system shall not include data for an incident ‘‘(D) any incident that the head of the
tion 224(c) of the Cybersecurity Act of 2015 (6 that occurs on a national security system in agency, in consultation with a senior privacy
U.S.C. 1522(c)). any report submitted under subparagraph official of the agency, determines is likely to
‘‘(2) AUTOMATED ANALYSIS.—The analyses (A). have a substantial privacy impact on a sig-
developed under paragraph (1) shall, to the ‘‘(3) NATIONAL SECURITY SYSTEM REPORTS.— nificant number of individuals;
greatest extent practicable, use machine ‘‘(A) IN GENERAL.—Annually, the head of an ‘‘(E) any incident the head of the agency
readable data, automation, and machine agency that operates or exercises control of determines impacts the operations of a high
learning processes. a national security system shall submit a re- value asset owned or operated by the agency;
‘‘(3) SHARING OF DATA AND ANALYSIS.— port that includes the information described ‘‘(F) any incident involving the exposure of
‘‘(A) IN GENERAL.—The Director shall share in subsection (b) with respect to the agency sensitive agency information to a foreign en-
ctelli on DSK11ZRN23PROD with SENATE
on an ongoing basis the analyses required to the extent that the submission is con- tity, such as the communications of the head
under this subsection with agencies and the sistent with standards and guidelines for na- of the agency, the head of a component of
National Cyber Director to— tional security systems issued in accordance the agency, or the direct reports of the head
‘‘(i) improve the understanding of cyberse- with law and as directed by the President of the agency or the head of a component of
curity risk of agencies; and to— the agency; and
‘‘(ii) support the cybersecurity improve- ‘‘(i) the majority and minority leaders of ‘‘(G) any other type of incident determined
ment efforts of agencies. the Senate, appropriate by the Director;
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00069 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8476 CONGRESSIONAL RECORD — SENATE November 18, 2021
‘‘(2) stipulate that the National Cyber Di- (B) in paragraph (7)— ‘‘(iii) The Director shall provide to the Na-
rector shall declare a major incident at each (i) in the paragraph heading, by striking tional Cyber Director any cybersecurity
agency impacted by an incident if the Direc- ‘‘CIO’’ and inserting ‘‘CIO’’; funding information described in subpara-
tor of the Cybersecurity and Infrastructure (ii) by striking ‘‘In evaluating projects’’ graph (A)(ii) that is provided to the Director
Security Agency determines that an inci- and inserting the following: under clause (ii) of this subparagraph.’’; and
dent— ‘‘(A) CONSIDERATION OF GUIDANCE.—In eval- (ii) in paragraph (4)(B), in the matter pre-
‘‘(A) occurs at not less than 2 agencies; and uating projects’’; ceding clause (i), by inserting ‘‘not later
‘‘(B) is enabled by— (iii) in subparagraph (A), as so designated, than 30 days after the date on which the re-
‘‘(i) a common technical root cause, such by striking ‘‘under section 1094(b)(1)’’ and in- view under subparagraph (A) is completed,’’
as a supply chain compromise, a common serting ‘‘by the Director’’; and before ‘‘the Administrator’’;
software or hardware vulnerability; or (iv) by adding at the end the following: (C) in subsection (f)—
‘‘(ii) the related activities of a common ‘‘(B) CONSULTATION.—In using funds under (i) by striking ‘‘heads of executive agencies
threat actor; and paragraph (3)(A), the Chief Information Offi- to develop’’ and inserting ‘‘heads of execu-
‘‘(3) stipulate that, in determining whether cer of the covered agency shall consult with tive agencies to—
an incident constitutes a major incident be- the necessary stakeholders to ensure the ‘‘(1) develop’’;
cause that incident— project appropriately addresses cybersecu- (ii) in paragraph (1), as so designated, by
‘‘(A) is any incident described in paragraph rity risks, including the Director of the Cy- striking the period at the end and inserting
(1), the head of an agency shall consult with bersecurity and Infrastructure Security ‘‘; and’’; and
the Director of the Cybersecurity and Infra- Agency, as appropriate.’’; and (iii) by adding at the end the following:
structure Security Agency; (2) in section 1078— ‘‘(2) consult with the Director of the Cyber-
‘‘(B) is an incident described in paragraph (A) by striking subsection (a) and inserting security and Infrastructure Security Agency
(1)(A), the head of the agency shall consult the following: for the development and use of supply chain
with the National Cyber Director; and ‘‘(a) DEFINITIONS.—In this section: security best practices.’’; and
‘‘(C) is an incident described in subpara- ‘‘(1) AGENCY.—The term ‘agency’ has the (D) in subsection (h), by inserting ‘‘, in-
graph (C) or (D) of paragraph (1), the head of meaning given the term in section 551 of cluding cybersecurity performances,’’ after
the agency shall consult with— title 5, United States Code. ‘‘the performances’’; and
‘‘(i) the Privacy and Civil Liberties Over- ‘‘(2) HIGH VALUE ASSET.—The term ‘high (2) in section 11303(b)—
sight Board; and value asset’ has the meaning given the term (A) in paragraph (2)(B)—
in section 3552 of title 44, United States (i) in clause (i), by striking ‘‘or’’ at the
‘‘(ii) the Chair of the Federal Trade Com-
Code.’’; end;
mission.
‘‘(c) SIGNIFICANT NUMBER OF INDIVIDUALS.— (B) in subsection (b), by adding at the end (ii) in clause (ii), by adding ‘‘or’’ at the
In determining what constitutes a signifi- the following: end; and
‘‘(8) PROPOSAL EVALUATION.—The Director (iii) by adding at the end the following:
cant number of individuals under subsection
shall— ‘‘(iii) whether the function should be per-
(b)(1)(D), the Director—
‘‘(A) give consideration for the use of formed by a shared service offered by an-
‘‘(1) may determine a threshold for a min-
amounts in the Fund to improve the security other executive agency;’’; and
imum number of individuals that constitutes
of high value assets; and (B) in paragraph (5)(B)(i), by inserting ‘‘,
a significant amount; and
‘‘(B) require that any proposal for the use while taking into account the risk-based
‘‘(2) may not determine a threshold de-
of amounts in the Fund includes a cybersecu- cyber budget model developed pursuant to
scribed in paragraph (1) that exceeds 5,000 in-
rity plan, including a supply chain risk man- section 3553(a)(7) of title 44’’ after ‘‘title 31’’.
dividuals.
agement plan, to be reviewed by the member (c) SUBCHAPTER II.—Subchapter II of sub-
‘‘(d) EVALUATION AND UPDATES.—Not later
of the Technology Modernization Board de- title III of title 40, United States Code, is
than 2 years after the date of enactment of
scribed in subsection (c)(5)(C).’’; and amended—
the Federal Information Security Moderniza-
(C) in subsection (c)— (1) in section 11312(a), by inserting ‘‘, in-
tion Act of 2021, and not less frequently than
(i) in paragraph (2)(A)(i), by inserting ‘‘, in- cluding security risks’’ after ‘‘managing the
every 2 years thereafter, the Director shall
cluding a consideration of the impact on risks’’;
submit to the Committee on Homeland Secu-
high value assets’’ after ‘‘operational risks’’; (2) in section 11313(1), by striking ‘‘effi-
rity and Governmental Affairs of the Senate
(ii) in paragraph (5)— ciency and effectiveness’’ and inserting ‘‘effi-
and the Committee on Oversight and Reform
(I) in subparagraph (A), by striking ‘‘and’’ ciency, security, and effectiveness’’;
of the House of Representatives an evalua-
at the end; (3) in section 11315, by adding at the end
tion, which shall include—
(II) in subparagraph (B), by striking the pe- the following:
‘‘(1) an update, if necessary, to the guid-
riod at the end and inserting ‘‘and’’; and ‘‘(d) COMPONENT AGENCY CHIEF INFORMA-
ance issued under subsection (a);
(III) by adding at the end the following: TION OFFICERS.—The Chief Information Offi-
‘‘(2) the definition of the term ‘major inci-
‘‘(C) a senior official from the Cybersecu- cer or an equivalent official of a component
dent’ included in the guidance issued under
rity and Infrastructure Security Agency of agency shall report to—
subsection (a); and
the Department of Homeland Security, ap- ‘‘(1) the Chief Information Officer des-
‘‘(3) an explanation of, and the analysis
pointed by the Director.’’; and ignated under section 3506(a)(2) of title 44 or
that led to, the definition described in para-
(iii) in paragraph (6)(A), by striking ‘‘shall an equivalent official of the agency of which
graph (2).’’.
be—’’ and all that follows through ‘‘4 em- the component agency is a component; and
(2) CLERICAL AMENDMENT.—The table of
ployees’’ and inserting ‘‘shall be 4 employ- ‘‘(2) the head of the component agency.’’;
sections for chapter 35 of title 44, United
ees’’. (4) in section 11317, by inserting ‘‘secu-
States Code, is amended by adding at the end (b) SUBCHAPTER I.—Subchapter I of subtitle
the following: rity,’’ before ‘‘or schedule’’; and
III of title 40, United States Code, is amend- (5) in section 11319(b)(1), in the paragraph
‘‘SUBCHAPTER IV—FEDERAL SYSTEM INCIDENT ed— heading, by striking ‘‘CIOS’’ and inserting
RESPONSE (1) in section 11302— ‘‘CHIEF INFORMATION OFFICERS’’.
‘‘3591. Definitions. (A) in subsection (b), by striking ‘‘use, se- (d) SUBCHAPTER III.—Section 11331 of title
‘‘3592. Notification of breach. curity, and disposal of’’ and inserting ‘‘use, 40, United States Code, is amended—
‘‘3593. Congressional and Executive Branch and disposal of, and, in consultation with the (1) in subsection (a), by striking ‘‘section
reports. Director of the Cybersecurity and Infrastruc- 3532(b)(1)’’ and inserting ‘‘section 3552(b)’’;
‘‘3594. Government information sharing and ture Security Agency and the National (2) in subsection (b)(1)(A), by striking ‘‘the
incident response. Cyber Director, promote and improve the se- Secretary of Homeland Security’’ and insert-
‘‘3595. Responsibilities of contractors and curity of,’’; ing ‘‘the Director of the Cybersecurity and
awardees. (B) in subsection (c)— Infrastructure Security Agency’’;
‘‘3596. Training. (i) in paragraph (3)— (3) by striking subsection (c) and inserting
‘‘3597. Analysis and report on Federal inci- (I) in subparagraph (A)— the following:
dents. (aa) by striking ‘‘including data’’ and in- ‘‘(c) APPLICATION OF MORE STRINGENT
‘‘3598. Major incident definition.’’. serting ‘‘which shall— STANDARDS.—
SEC. 5122. AMENDMENTS TO SUBTITLE III OF ‘‘(i) include data’’; ‘‘(1) IN GENERAL.—The head of an agency
TITLE 40. (bb) in clause (i), as so designated, by shall—
(a) MODERNIZING GOVERNMENT TECH- striking ‘‘, and performance’’ and inserting ‘‘(A) evaluate, in consultation with the
NOLOGY.—Subtitle G of title X of Division A ‘‘security, and performance; and’’; and senior agency information security officers,
ctelli on DSK11ZRN23PROD with SENATE
of the National Defense Authorization Act (cc) by adding at the end the following: the need to employ standards for cost-effec-
for Fiscal Year 2018 (40 U.S.C. 11301 note) is ‘‘(ii) specifically denote cybersecurity tive, risk-based information security for all
amended— funding under the risk-based cyber budget systems, operations, and assets within or
(1) in section 1077(b)— model developed pursuant to section under the supervision of the agency that are
(A) in paragraph (5)(A), by inserting ‘‘im- 3553(a)(7) of title 44.’’; and more stringent than the standards promul-
proving the cybersecurity of systems and’’ (II) in subparagraph (B), adding at the end gated by the Director under this section, if
before ‘‘cost savings activities’’; and the following: such standards contain, at a minimum, the
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00070 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8477
provisions of those applicable standards risk assessments performed under section (B) by redesignating subsections (c)
made compulsory and binding by the Direc- 3553(i) of title 44. through (f) as subsections (b) through (e), re-
tor; and ‘‘(2) UPDATED GUIDANCE.—Not later than 90 spectively.
‘‘(B) to the greatest extent practicable and days after the date on which a review is com- (2) INCIDENT DATA SHARING.—
if the head of the agency determines that the pleted under paragraph (1), the Director of (A) IN GENERAL.—The Director shall de-
standards described in subparagraph (A) are the Office of Management and Budget shall velop guidance, to be updated not less fre-
necessary, employ those standards. issue updated guidance or policy to agencies quently than once every 2 years, on the con-
‘‘(2) EVALUATION OF MORE STRINGENT STAND- determined appropriate by the Director, tent, timeliness, and format of the informa-
ARDS.—In evaluating the need to employ based on the results of the review. tion provided by agencies under section
more stringent standards under paragraph ‘‘(3) PUBLIC REPORT.—Not later than 30 3594(a) of title 44, United States Code, as
(1), the head of an agency shall consider days after the date on which a review is com- added by this division.
available risk information, such as— pleted under paragraph (1), the Director of (B) REQUIREMENTS.—The guidance devel-
‘‘(A) the status of cybersecurity remedial the Office of Management and Budget shall oped under subparagraph (A) shall—
actions of the agency; make publicly available a report that in- (i) prioritize the availability of data nec-
‘‘(B) any vulnerability information relat- cludes— essary to understand and analyze—
ing to agency systems that is known to the ‘‘(A) an overview of the guidance and pol- (I) the causes of incidents;
agency; icy promulgated under this section that is (II) the scope and scale of incidents within
‘‘(C) incident information of the agency; currently in effect; the environments and systems of an agency;
‘‘(D) information from— ‘‘(B) the cybersecurity risk mitigation, or (III) a root cause analysis of incidents
‘‘(i) penetration testing performed under other cybersecurity benefit, offered by each that—
section 3559A of title 44; and guidance or policy document described in (aa) are common across the Federal Gov-
‘‘(ii) information from the vulnerability subparagraph (A); and ernment; or
disclosure program established under section ‘‘(C) a summary of the guidance or policy (bb) have a Government-wide impact;
3559B of title 44; to which changes were determined appro- (IV) agency response, recovery, and reme-
‘‘(E) agency threat hunting results under priate during the review and what the diation actions and the effectiveness of those
section 5145 of the Federal Information Secu- changes are anticipated to include. actions; and
rity Modernization Act of 2021; ‘‘(4) CONGRESSIONAL BRIEFING.—Not later (V) the impact of incidents;
‘‘(F) Federal and non-Federal cyber threat than 30 days after the date on which a review (ii) enable the efficient development of—
intelligence; is completed under paragraph (1), the Direc- (I) lessons learned and recommendations in
‘‘(G) data on compliance with standards tor shall provide to the Committee on Home- responding to, recovering from, remediating,
issued under this section; land Security and Governmental Affairs of and mitigating future incidents; and
‘‘(H) agency system risk assessments per- the Senate and the Committee on Oversight (II) the report on Federal incidents re-
formed under section 3554(a)(1)(A) of title 44; and Reform of the House of Representatives quired under section 3597(b) of title 44,
and a briefing on the review. United States Code, as added by this divi-
‘‘(I) any other information determined rel- ‘‘(f) AUTOMATED STANDARD IMPLEMENTA- sion;
evant by the head of the agency.’’; TION VERIFICATION.—When the Director of (iii) include requirements for the timeli-
(4) in subsection (d)(2)— the National Institute of Standards and ness of data production; and
(A) in the paragraph heading, by striking Technology issues a proposed standard pur- (iv) include requirements for using auto-
‘‘NOTICE AND COMMENT’’ and inserting ‘‘CON- suant to paragraphs (2) and (3) of section mation and machine-readable data for data
SULTATION, NOTICE, AND COMMENT’’; 20(a) of the National Institute of Standards sharing and availability.
(B) by inserting ‘‘promulgate,’’ before ‘‘sig- and Technology Act (15 U.S.C. 278g–3(a)), the (3) GUIDANCE ON RESPONDING TO INFORMA-
nificantly modify’’; and Director of the National Institute of Stand- TION REQUESTS.—Not later than 1 year after
(C) by striking ‘‘shall be made after the ards and Technology shall consider devel- the date of enactment of this Act, the Direc-
public is given an opportunity to comment oping and, if appropriate and practical, de- tor shall develop guidance for agencies to
on the Director’s proposed decision.’’ and in- velop, in consultation with the Director of implement the requirement under section
serting ‘‘shall be made— the Cybersecurity and Infrastructure Secu- 3594(c) of title 44, United States Code, as
‘‘(A) for a decision to significantly modify rity Agency, specifications to enable the added by this division, to provide informa-
or not promulgate such a proposed standard, automated verification of the implementa- tion to other agencies experiencing inci-
after the public is given an opportunity to tion of the controls within the standard.’’. dents.
comment on the Director’s proposed deci- SEC. 5123. ACTIONS TO ENHANCE FEDERAL INCI- (4) STANDARD GUIDANCE AND TEMPLATES.—
sion; DENT RESPONSE. Not later than 1 year after the date of enact-
‘‘(B) in consultation with the Chief Infor- (a) RESPONSIBILITIES OF THE CYBERSECU- ment of this Act, the Director, in consulta-
mation Officers Council, the Director of the RITY AND INFRASTRUCTURE SECURITY AGEN- tion with the Director of the Cybersecurity
Cybersecurity and Infrastructure Security CY.— and Infrastructure Security Agency, shall
Agency, the National Cyber Director, the (1) IN GENERAL.—Not later than 180 days develop guidance and templates, to be re-
Comptroller General of the United States, after the date of enactment of this Act, the viewed and, if necessary, updated not less
and the Council of the Inspectors General on Director of the Cybersecurity and Infrastruc- frequently than once every 2 years, for use
Integrity and Efficiency; ture Security Agency shall— by Federal agencies in the activities re-
‘‘(C) considering the Federal risk assess- (A) develop a plan for the development of quired under sections 3592, 3593, and 3596 of
ments performed under section 3553(i) of title the analysis required under section 3597(a) of title 44, United States Code, as added by this
44; and title 44, United States Code, as added by this division.
‘‘(D) considering the extent to which the division, and the report required under sub- (5) CONTRACTOR AND AWARDEE GUIDANCE.—
proposed standard reduces risk relative to section (b) of that section that includes— (A) IN GENERAL.—Not later than 1 year
the cost of implementation of the stand- (i) a description of any challenges the Di- after the date of enactment of this Act, the
ard.’’; and rector anticipates encountering; and Director, in coordination with the Secretary
(5) by adding at the end the following: (ii) the use of automation and machine- of Homeland Security, the Secretary of De-
‘‘(e) REVIEW OF OFFICE OF MANAGEMENT readable formats for collecting, compiling, fense, the Administrator of General Services,
AND BUDGET GUIDANCE AND POLICY.— monitoring, and analyzing data; and and the heads of other agencies determined
‘‘(1) CONDUCT OF REVIEW.— (B) provide to the appropriate congres- appropriate by the Director, shall issue guid-
‘‘(A) IN GENERAL.—Not less frequently than sional committees a briefing on the plan de- ance to Federal agencies on how to
once every 3 years, the Director of the Office veloped under subparagraph (A). deconflict, to the greatest extent prac-
of Management and Budget, in consultation (2) BRIEFING.—Not later than 1 year after ticable, existing regulations, policies, and
with the Chief Information Officers Council, the date of enactment of this Act, the Direc- procedures relating to the responsibilities of
the Director of the Cybersecurity and Infra- tor of the Cybersecurity and Infrastructure contractors and awardees established under
structure Security Agency, the National Security Agency shall provide to the appro- section 3595 of title 44, United States Code,
Cyber Director, the Comptroller General of priate congressional committees a briefing as added by this division.
the United States, and the Council of the In- on— (B) EXISTING PROCESSES.—To the greatest
spectors General on Integrity and Efficiency (A) the execution of the plan required extent practicable, the guidance issued under
shall review the efficacy of the guidance and under paragraph (1)(A); and subparagraph (A) shall allow contractors and
policy promulgated by the Director in reduc- (B) the development of the report required awardees to use existing processes for noti-
ing cybersecurity risks, including an assess- under section 3597(b) of title 44, United fying Federal agencies of incidents involving
ctelli on DSK11ZRN23PROD with SENATE
ment of the requirements for agencies to re- States Code, as added by this division. information of the Federal Government.
port information to the Director, and deter- (b) RESPONSIBILITIES OF THE DIRECTOR OF (6) UPDATED BRIEFINGS.—Not less fre-
mine whether any changes to that guidance THE OFFICE OF MANAGEMENT AND BUDGET.— quently than once every 2 years, the Direc-
or policy is appropriate. (1) FISMA.—Section 2 of the Federal Infor- tor shall provide to the appropriate congres-
‘‘(B) FEDERAL RISK ASSESSMENTS.—In con- mation Security Modernization Act of 2014 sional committees an update on the guidance
ducting the review described in subparagraph (44 U.S.C. 3554 note) is amended— and templates developed under paragraphs
(A), the Director shall consider the Federal (A) by striking subsection (b); and (2) through (4).
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00071 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8478 CONGRESSIONAL RECORD — SENATE November 18, 2021
(c) UPDATE TO THE PRIVACY ACT OF 1974.— (1) evaluate mobile application security sharing of log data with other appropriate
Section 552a(b) of title 5, United States Code guidance promulgated by the Director; and agencies, or any other logging activity deter-
(commonly known as the ‘‘Privacy Act of (2) issue guidance to secure mobile devices, mined to be appropriate by the Director.
1974’’) is amended— including for mobile applications, for every SEC. 5143. CISA AGENCY ADVISORS.
(1) in paragraph (11), by striking ‘‘or’’ at agency. (a) IN GENERAL.—Not later than 120 days
the end; (b) CONTENTS.—The guidance issued under after the date of enactment of this Act, the
(2) in paragraph (12), by striking the period subsection (a)(2) shall include— Director of the Cybersecurity and Infrastruc-
at the end and inserting ‘‘; or’’; and (1) a requirement, pursuant to section ture Security Agency shall assign not less
(3) by adding at the end the following: 3506(b)(4) of title 44, United States Code, for than 1 cybersecurity professional employed
‘‘(13) to another agency in furtherance of a every agency to maintain a continuous in- by the Cybersecurity and Infrastructure Se-
response to an incident (as defined in section ventory of every— curity Agency to be the Cybersecurity and
3552 of title 44) and pursuant to the informa- (A) mobile device operated by or on behalf Infrastructure Security Agency advisor to
tion sharing requirements in section 3594 of of the agency; and the senior agency information security offi-
title 44 if the head of the requesting agency (B) vulnerability identified by the agency cer of each agency.
has made a written request to the agency associated with a mobile device; and (b) QUALIFICATIONS.—Each advisor assigned
that maintains the record specifying the par- (2) a requirement for every agency to per- under subsection (a) shall have knowledge
ticular portion desired and the activity for form continuous evaluation of the of—
which the record is sought.’’. vulnerabilities described in paragraph (1)(B) (1) cybersecurity threats facing agencies,
SEC. 5124. ADDITIONAL GUIDANCE TO AGENCIES and other risks associated with the use of ap- including any specific threats to the as-
ON FISMA UPDATES. plications on mobile devices. signed agency;
Not later than 1 year after the date of en- (c) INFORMATION SHARING.—The Director, (2) performing risk assessments of agency
actment of this Act, the Director, in coordi- in coordination with the Director of the Cy- systems; and
nation with the Director of the Cybersecu- bersecurity and Infrastructure Security (3) other Federal cybersecurity initiatives.
rity and Infrastructure Security Agency, Agency, shall issue guidance to agencies for (c) DUTIES.—The duties of each advisor as-
shall issue guidance for agencies on— sharing the inventory of the agency required signed under subsection (a) shall include—
(1) performing the ongoing and continuous under subsection (b)(1) with the Director of (1) providing ongoing assistance and ad-
agency system risk assessment required the Cybersecurity and Infrastructure Secu- vice, as requested, to the agency Chief Infor-
under section 3554(a)(1)(A) of title 44, United rity Agency, using automation and machine- mation Officer;
States Code, as amended by this division; readable data to the greatest extent prac- (2) serving as an incident response point of
(2) implementing additional cybersecurity ticable. contact between the assigned agency and the
procedures, which shall include resources for (d) BRIEFING.—Not later than 60 days after
Cybersecurity and Infrastructure Security
the date on which the Director issues guid-
shared services; Agency; and
ance under subsection (a)(2), the Director, in
(3) establishing a process for providing the (3) familiarizing themselves with agency
coordination with the Director of the Cyber-
status of each remedial action under section systems, processes, and procedures to better
security and Infrastructure Security Agency,
3554(b)(7) of title 44, United States Code, as facilitate support to the agency in respond-
shall provide to the appropriate congres-
amended by this division, to the Director ing to incidents.
sional committees a briefing on the guid-
and the Cybersecurity and Infrastructure Se- (d) LIMITATION.—An advisor assigned under
ance.
curity Agency using automation and ma- subsection (a) shall not be a contractor.
SEC. 5142. DATA AND LOGGING RETENTION FOR
chine-readable data, as practicable, which (e) MULTIPLE ASSIGNMENTS.—One indi-
INCIDENT RESPONSE.
shall include— vidual advisor may be assigned to multiple
(a) RECOMMENDATIONS.—Not later than 2
(A) specific guidance for the use of auto- agency Chief Information Officers under sub-
years after the date of enactment of this
mation and machine-readable data; and section (a).
Act, and not less frequently than every 2
(B) templates for providing the status of SEC. 5144. FEDERAL PENETRATION TESTING POL-
years thereafter, the Director of the Cyberse- ICY.
the remedial action;
curity and Infrastructure Security Agency,
(4) interpreting the definition of ‘‘high (a) IN GENERAL.—Subchapter II of chapter
in consultation with the Attorney General,
value asset’’ under section 3552 of title 44, 35 of title 44, United States Code, is amended
shall submit to the Director recommenda-
United States Code, as amended by this divi- by adding at the end the following:
tions on requirements for logging events on
sion; and ‘‘§ 3559A. Federal penetration testing
agency systems and retaining other relevant
(5) a requirement to coordinate with in- ‘‘(a) DEFINITIONS.—In this section:
data within the systems and networks of an
spectors general of agencies to ensure con- ‘‘(1) AGENCY OPERATIONAL PLAN.—The term
agency.
sistent understanding and application of (b) CONTENTS.—The recommendations pro- ‘agency operational plan’ means a plan of an
agency policies for the purpose of evalua- vided under subsection (a) shall include— agency for the use of penetration testing.
tions by inspectors general. (1) the types of logs to be maintained; ‘‘(2) RULES OF ENGAGEMENT.—The term
SEC. 5125. AGENCY REQUIREMENTS TO NOTIFY (2) the time periods to retain the logs and ‘rules of engagement’ means a set of rules es-
PRIVATE SECTOR ENTITIES IM-
other relevant data; tablished by an agency for the use of pene-
PACTED BY INCIDENTS.
(3) the time periods for agencies to enable tration testing.
(a) DEFINITIONS.—In this section: ‘‘(b) GUIDANCE.—
recommended logging and security require-
(1) REPORTING ENTITY.—The term ‘‘report- ‘‘(1) IN GENERAL.—The Director shall issue
ments;
ing entity’’ means private organization or guidance that—
(4) how to ensure the confidentiality, in-
governmental unit that is required by stat- ‘‘(A) requires agencies to use, when and
tegrity, and availability of logs;
ute or regulation to submit sensitive infor- where appropriate, penetration testing on
(5) requirements to ensure that, upon re-
mation to an agency. agency systems; and
quest, in a manner that excludes or other-
(2) SENSITIVE INFORMATION.—The term ‘‘(B) requires agencies to develop an agen-
wise reasonably protects personally identifi-
‘‘sensitive information’’ has the meaning cy operational plan and rules of engagement
able information, and to the extent per-
given the term by the Director in guidance that meet the requirements under subsection
mitted by applicable law (including privacy
issued under subsection (b). (c).
and statistical laws), agencies provide logs
(b) GUIDANCE ON NOTIFICATION OF REPORT-
to— ‘‘(2) PENETRATION TESTING GUIDANCE.—The
ING ENTITIES.—Not later than 180 days after
(A) the Director of the Cybersecurity and guidance issued under this section shall—
the date of enactment of this Act, the Direc-
Infrastructure Security Agency for a cyber- ‘‘(A) permit an agency to use, for the pur-
tor shall issue guidance requiring the head of
security purpose; and pose of performing penetration testing—
each agency to notify a reporting entity of
(B) the Federal Bureau of Investigation to ‘‘(i) a shared service of the agency or an-
an incident that is likely to substantially af-
investigate potential criminal activity; and other agency; or
fect—
(6) requirements to ensure that, subject to ‘‘(ii) an external entity, such as a vendor;
(1) the confidentiality or integrity of sen-
compliance with statistical laws and other and
sitive information submitted by the report-
relevant data protection requirements, the ‘‘(B) require agencies to provide the rules
ing entity to the agency pursuant to a statu-
highest level security operations center of of engagement and results of penetration
tory or regulatory requirement; or
each agency has visibility into all agency testing to the Director and the Director of
(2) the agency information system or sys-
logs. the Cybersecurity and Infrastructure Secu-
tems used in the transmission or storage of
(c) GUIDANCE.—Not later than 90 days after rity Agency, without regard to the status of
the sensitive information described in para- receiving the recommendations submitted the entity that performs the penetration
graph (1).
ctelli on DSK11ZRN23PROD with SENATE
under subsection (a), the Director, in con- testing.
TITLE LII—IMPROVING FEDERAL sultation with the Director of the Cybersecu- ‘‘(c) AGENCY PLANS AND RULES OF ENGAGE-
CYBERSECURITY rity and Infrastructure Security Agency and MENT.—The agency operational plan and
SEC. 5141. MOBILE SECURITY STANDARDS. the Attorney General, shall, as determined rules of engagement of an agency shall—
(a) IN GENERAL.—Not later than 1 year to be appropriate by the Director, update ‘‘(1) require the agency to—
after the date of enactment of this Act, the guidance to agencies regarding requirements ‘‘(A) perform penetration testing on the
Director shall— for logging, log retention, log management, high value assets of the agency; or
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00072 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8479
‘‘(B) coordinate with the Director of the States Code, is amended by adding after the ‘‘(2) REPORTER.—The term ‘reporter’ means
Cybersecurity and Infrastructure Security item relating to section 3559 the following: an individual that submits a vulnerability
Agency to ensure that penetration testing is ‘‘3559A. Federal penetration testing.’’. report pursuant to the vulnerability disclo-
being performed; (d) PENETRATION TESTING BY THE SEC- sure process of an agency.
‘‘(2) establish guidelines for avoiding, as a RETARY OF HOMELAND SECURITY.—Section ‘‘(b) RESPONSIBILITIES OF OMB.—
result of penetration testing— 3553(b) of title 44, United States Code, as ‘‘(1) LIMITATION ON LEGAL ACTION.—The Di-
‘‘(A) adverse impacts to the operations of amended by section 5121, is further amend- rector, in consultation with the Attorney
the agency; ed— General, shall issue guidance to agencies to
‘‘(B) adverse impacts to operational envi- (1) in paragraph (8)(B), by striking ‘‘and’’ not recommend or pursue legal action
ronments and systems of the agency; and at the end; against a reporter or an individual that con-
‘‘(C) inappropriate access to data; (2) by redesignating paragraph (9) as para- ducts a security research activity that the
‘‘(3) require the results of penetration test- graph (10); and head of the agency determines—
ing to include feedback to improve the cy- (3) by inserting after paragraph (8) the fol- ‘‘(A) represents a good faith effort to fol-
bersecurity of the agency; and lowing: low the vulnerability disclosure policy of the
‘‘(4) include mechanisms for providing con- ‘‘(9) performing penetration testing with or agency developed under subsection (d)(2);
sistently formatted, and, if applicable, auto- without advance notice to, or authorization and
mated and machine-readable, data to the Di- from, agencies, to identify vulnerabilities ‘‘(B) is authorized under the vulnerability
rector and the Director of the Cybersecurity within Federal information systems; and’’. disclosure policy of the agency developed
and Infrastructure Security Agency. SEC. 5145. ONGOING THREAT HUNTING PRO- under subsection (d)(2).
‘‘(d) RESPONSIBILITIES OF CISA.—The Di- GRAM. ‘‘(2) SHARING INFORMATION WITH CISA.—The
rector of the Cybersecurity and Infrastruc- (a) THREAT HUNTING PROGRAM.— Director, in coordination with the Director
ture Security Agency shall— (1) IN GENERAL.—Not later than 540 days of the Cybersecurity and Infrastructure Se-
‘‘(1) establish a process to assess the per- after the date of enactment of this Act, the curity Agency and in consultation with the
formance of penetration testing by both Fed- Director of the Cybersecurity and Infrastruc- National Cyber Director, shall issue guid-
eral and non-Federal entities that estab- ture Security Agency shall establish a pro- ance to agencies on sharing relevant infor-
gram to provide ongoing, hypothesis-driven mation in a consistent, automated, and ma-
lishes minimum quality controls for penetra-
threat-hunting services on the network of chine readable manner with the Cybersecu-
tion testing;
each agency. rity and Infrastructure Security Agency, in-
‘‘(2) develop operational guidance for insti-
(2) PLAN.—Not later than 180 days after the cluding—
tuting penetration testing programs at agen-
date of enactment of this Act, the Director ‘‘(A) any valid or credible reports of newly
cies;
of the Cybersecurity and Infrastructure Se- discovered or not publicly known
‘‘(3) develop and maintain a centralized ca-
curity Agency shall develop a plan to estab- vulnerabilities (including misconfigurations)
pability to offer penetration testing as a
lish the program required under paragraph on Federal information systems that use
service to Federal and non-Federal entities;
(1) that describes how the Director of the Cy- commercial software or services;
and
bersecurity and Infrastructure Security ‘‘(B) information relating to vulnerability
‘‘(4) provide guidance to agencies on the
Agency plans to— disclosure, coordination, or remediation ac-
best use of penetration testing resources.
(A) determine the method for collecting, tivities of an agency, particularly as those
‘‘(e) RESPONSIBILITIES OF OMB.—The Direc- storing, accessing, and analyzing appropriate activities relate to outside organizations—
tor, in coordination with the Director of the agency data; ‘‘(i) with which the head of the agency be-
Cybersecurity and Infrastructure Security (B) provide on-premises support to agen- lieves the Director of the Cybersecurity and
Agency, shall— cies; Infrastructure Security Agency can assist;
‘‘(1) not less frequently than annually, in- (C) staff threat hunting services; or
ventory all Federal penetration testing as- (D) allocate available human and financial ‘‘(ii) about which the head of the agency
sets; and resources to implement the plan; and believes the Director of the Cybersecurity
‘‘(2) develop and maintain a standardized (E) provide input to the heads of agencies and Infrastructure Security Agency should
process for the use of penetration testing. on the use of— know; and
‘‘(f) PRIORITIZATION OF PENETRATION TEST- (i) more stringent standards under section ‘‘(C) any other information with respect to
ING RESOURCES.— 11331(c)(1) of title 40, United States Code; and which the head of the agency determines
‘‘(1) IN GENERAL.—The Director, in coordi- (ii) additional cybersecurity procedures helpful or necessary to involve the Cyberse-
nation with the Director of the Cybersecu- under section 3554 of title 44, United States curity and Infrastructure Security Agency.
rity and Infrastructure Security Agency, Code. ‘‘(3) AGENCY VULNERABILITY DISCLOSURE
shall develop a framework for prioritizing (b) REPORTS.—The Director of the Cyberse- POLICIES.—The Director shall issue guidance
Federal penetration testing resources among curity and Infrastructure Security Agency to agencies on the required minimum scope
agencies. shall submit to the appropriate congres- of agency systems covered by the vulner-
‘‘(2) CONSIDERATIONS.—In developing the sional committees— ability disclosure policy of an agency re-
framework under this subsection, the Direc- (1) not later than 30 days after the date on quired under subsection (d)(2).
tor shall consider— which the Director of the Cybersecurity and ‘‘(c) RESPONSIBILITIES OF CISA.—The Direc-
‘‘(A) agency system risk assessments per- Infrastructure Security Agency completes tor of the Cybersecurity and Infrastructure
formed under section 3554(a)(1)(A); the plan required under subsection (a)(2), a Security Agency shall—
‘‘(B) the Federal risk assessment per- report on the plan to provide threat hunting ‘‘(1) provide support to agencies with re-
formed under section 3553(i); services to agencies; spect to the implementation of the require-
‘‘(C) the analysis of Federal incident data (2) not less than 30 days before the date on ments of this section;
performed under section 3597; and which the Director of the Cybersecurity and ‘‘(2) develop tools, processes, and other
‘‘(D) any other information determined ap- Infrastructure Security Agency begins pro- mechanisms determined appropriate to offer
propriate by the Director or the Director of viding threat hunting services under the pro- agencies capabilities to implement the re-
the Cybersecurity and Infrastructure Secu- gram under subsection (a)(1), a report pro- quirements of this section; and
rity Agency. viding any updates to the plan developed ‘‘(3) upon a request by an agency, assist the
‘‘(g) EXCEPTION FOR NATIONAL SECURITY under subsection (a)(2); and agency in the disclosure to vendors of newly
SYSTEMS.—The guidance issued under sub- (3) not later than 1 year after the date on identified vulnerabilities in vendor products
section (b) shall not apply to national secu- which the Director of the Cybersecurity and and services.
rity systems. Infrastructure Security Agency begins pro- ‘‘(d) RESPONSIBILITIES OF AGENCIES.—
‘‘(h) DELEGATION OF AUTHORITY FOR CER- viding threat hunting services to agencies ‘‘(1) PUBLIC INFORMATION.—The head of
TAIN SYSTEMS.—The authorities of the Direc- other than the Cybersecurity and Infrastruc- each agency shall make publicly available,
tor described in subsection (b) shall be dele- ture Security Agency, a report describing with respect to each internet domain under
gated— lessons learned from providing those serv- the control of the agency that is not a na-
‘‘(1) to the Secretary of Defense in the case ices. tional security system—
of systems described in section 3553(e)(2); and SEC. 5146. CODIFYING VULNERABILITY DISCLO- ‘‘(A) an appropriate security contact; and
‘‘(2) to the Director of National Intel- SURE PROGRAMS. ‘‘(B) the component of the agency that is
ligence in the case of systems described in (a) IN GENERAL.—Chapter 35 of title 44, responsible for the internet accessible serv-
3553(e)(3).’’. United States Code, is amended by inserting ices offered at the domain.
(b) DEADLINE FOR GUIDANCE.—Not later after section 3559A, as added by section 5144 ‘‘(2) VULNERABILITY DISCLOSURE POLICY.—
ctelli on DSK11ZRN23PROD with SENATE
than 180 days after the date of enactment of of this division, the following: The head of each agency shall develop and
this Act, the Director shall issue the guid- ‘‘§ 3559B. Federal vulnerability disclosure make publicly available a vulnerability dis-
ance required under section 3559A(b) of title programs closure policy for the agency, which shall—
44, United States Code, as added by sub- ‘‘(a) DEFINITIONS.—In this section: ‘‘(A) describe—
section (a). ‘‘(1) REPORT.—The term ‘report’ means a ‘‘(i) the scope of the systems of the agency
(c) CLERICAL AMENDMENT.—The table of vulnerability disclosure made to an agency included in the vulnerability disclosure pol-
sections for chapter 35 of title 44, United by a reporter. icy;
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00073 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8480 CONGRESSIONAL RECORD — SENATE November 18, 2021
‘‘(ii) the type of information system test- (5) isolating and removing unauthorized Director, in coordination with the Director
ing that is authorized by the agency; entities from agency systems quickly; of the Cybersecurity and Infrastructure Se-
‘‘(iii) the type of information system test- (6) otherwise increasing the resource costs curity Agency, shall promulgate guidance
ing that is not authorized by the agency; and for entities that cause incidents to be suc- that requires each agency to use covered
‘‘(iv) the disclosure policy of the agency for cessful; and metrics to track trends in the cybersecurity
sensitive information; (7) a summary of the agency progress re- and incident response capabilities of the
‘‘(B) with respect to a report to an agency, ports required under subsection (b). agency.
describe— (b) AGENCY PROGRESS REPORTS.—Not later (2) PERFORMANCE DEMONSTRATION.—The
‘‘(i) how the reporter should submit the re- than 1 year after the date of enactment of guidance issued under paragraph (1) and any
port; and this Act, the head of each agency shall sub- subsequent guidance shall require agencies
‘‘(ii) if the report is not anonymous, when mit to the Director a progress report on im- to share with the Director of the Cybersecu-
the reporter should anticipate an acknowl- plementing an information security program rity and Infrastructure Security Agency
edgment of receipt of the report by the agen- based on the presumption of compromise and data demonstrating the performance of the
cy; least privilege principles, which shall in- agency using the covered metrics included in
‘‘(C) include any other relevant informa- clude— the guidance.
tion; and (1) a description of any steps the agency (3) PENETRATION TESTS.—On not less than 2
‘‘(D) be mature in scope, to cover all Fed- has completed, including progress toward occasions during the 2-year period following
eral information systems used or operated by achieving requirements issued by the Direc- the date on which guidance is promulgated
that agency or on behalf of that agency. tor; under paragraph (1), the Director shall en-
‘‘(3) IDENTIFIED VULNERABILITIES.—The (2) an identification of activities that have sure that not less than 3 agencies are sub-
head of each agency shall incorporate any not yet been completed and that would have jected to substantially similar penetration
vulnerabilities reported under paragraph (2) the most immediate security impact; and tests, as determined by the Director, in co-
into the vulnerability management process (3) a schedule to implement any planned ordination with the Director of the Cyberse-
of the agency in order to track and reme- activities. curity and Infrastructure Security Agency,
diate the vulnerability. SEC. 5148. AUTOMATION REPORTS. in order to validate the utility of the covered
‘‘(e) PAPERWORK REDUCTION ACT EXEMP- (a) OMB REPORT.—Not later than 180 days metrics.
TION.—The requirements of subchapter I after the date of enactment of this Act, the (4) ANALYSIS CAPACITY.—The Director of
(commonly known as the ‘Paperwork Reduc- Director shall submit to the appropriate con- the Cybersecurity and Infrastructure Secu-
tion Act’) shall not apply to a vulnerability gressional committees a report on the use of rity Agency shall develop a capability that
disclosure program established under this automation under paragraphs (1), (5)(C) and allows for the analysis of the covered
section. (8)(B) of section 3554(b) of title 44, United metrics, including cross-agency performance
‘‘(f) CONGRESSIONAL REPORTING.—Not later States Code. of agency cybersecurity and incident re-
than 90 days after the date of enactment of (b) GAO REPORT.—Not later than 1 year sponse capability trends.
the Federal Information Security Moderniza- after the date of enactment of this Act, the (d) CONGRESSIONAL REPORTS.—
tion Act of 2021, and annually thereafter for Comptroller General of the United States (1) UTILITY OF METRICS.—Not later than 1
a 3-year period, the Director shall provide to shall perform a study on the use of automa- year after the date of enactment of this Act,
the Committee on Homeland Security and tion and machine readable data across the the Director of the Cybersecurity and Infra-
Governmental Affairs of the Senate and the Federal Government for cybersecurity pur- structure Security Agency shall submit to
Committee on Oversight and Reform of the poses, including the automated updating of the appropriate congressional committees a
House of Representatives a briefing on the cybersecurity tools, sensors, or processes by report on the utility of the covered metrics.
status of the use of vulnerability disclosure agencies. (2) USE OF METRICS.—Not later than 180
policies under this section at agencies, in- SEC. 5149. EXTENSION OF FEDERAL ACQUISITION days after the date on which the Director
cluding, with respect to the guidance issued SECURITY COUNCIL. promulgates guidance under subsection
under subsection (b)(3), an identification of Section 1328 of title 41, United States Code, (c)(1), the Director shall submit to the appro-
the agencies that are compliant and not is amended by striking ‘‘the date that’’ and priate congressional committees a report on
compliant. all that follows and inserting ‘‘December 31, the results of the use of the covered metrics
‘‘(g) EXEMPTIONS.—The authorities and 2026.’’. by agencies.
functions of the Director and Director of the SEC. 5150. COUNCIL OF THE INSPECTORS GEN- (e) CYBERSECURITY ACT OF 2015 UPDATES.—
Cybersecurity and Infrastructure Security ERAL ON INTEGRITY AND EFFI- Section 224 of the Cybersecurity Act of 2015
Agency under this section shall not apply to CIENCY DASHBOARD. (6 U.S.C. 1522) is amended—
national security systems. (a) DASHBOARD REQUIRED.—Section 11(e)(2) (1) by striking subsection (c) and inserting
‘‘(h) DELEGATION OF AUTHORITY FOR CER- of the Inspector General Act of 1978 (5 U.S.C. the following:
TAIN SYSTEMS.—The authorities of the Direc- App.) is amended— ‘‘(c) IMPROVED METRICS.—
tor and the Director of the Cybersecurity (1) in subparagraph (A), by striking ‘‘and’’ ‘‘(1) IN GENERAL.—The Director of the Cy-
and Infrastructure Security Agency de- at the end; bersecurity and Infrastructure Security
scribed in this section shall be delegated— (2) by redesignating subparagraph (B) as Agency, in coordination with the Director,
‘‘(1) to the Secretary of Defense in the case subparagraph (C); and shall establish, review, and update metrics
of systems described in section 3553(e)(2); and (3) by inserting after subparagraph (A) the to measure the cybersecurity and incident
‘‘(2) to the Director of National Intel- following: response capabilities of agencies in accord-
ligence in the case of systems described in ‘‘(B) that shall include a dashboard of open ance with the responsibilities of agencies
section 3553(e)(3).’’. information security recommendations iden- under section 3554 of title 44, United States
(b) CLERICAL AMENDMENT.—The table of tified in the independent evaluations re- Code.
sections for chapter 35 of title 44, United quired by section 3555(a) of title 44, United ‘‘(2) QUALITIES.—With respect to the
States Code, is amended by adding after the States Code; and’’. metrics established, reviewed, and updated
item relating to section 3559A, as added by SEC. 5151. QUANTITATIVE CYBERSECURITY under paragraph (1)—
section 204, the following: METRICS. ‘‘(A) not less than 2 of the metrics shall be
‘‘3559B. Federal vulnerability disclosure pro- (a) DEFINITION OF COVERED METRICS.—In time-based, such as a metric of—
grams.’’. this section, the term ‘‘covered metrics’’ ‘‘(i) the amount of time it takes for an
SEC. 5147. IMPLEMENTING PRESUMPTION OF means the metrics established, reviewed, and agency to detect an incident; and
COMPROMISE AND LEAST PRIVI- updated under section 224(c) of the Cyberse- ‘‘(ii) the amount of time that passes be-
LEGE PRINCIPLES. curity Act of 2015 (6 U.S.C. 1522(c)). tween—
(a) GUIDANCE.—Not later than 1 year after (b) UPDATING AND ESTABLISHING METRICS.— ‘‘(I) the detection of an incident and the re-
the date of enactment of this Act, the Direc- Not later than 1 year after the date of enact- mediation of the incident; and
tor shall provide an update to the appro- ment of this Act, the Director of the Cyber- ‘‘(II) the remediation of an incident and
priate congressional committees on progress security and Infrastructure Security Agency, the recovery from the incident; and
in increasing the internal defenses of agency in coordination with the Director, shall— ‘‘(B) the metrics may include other meas-
systems, including— (1) evaluate any covered metrics estab- urable outcomes.’’;
(1) shifting away from ‘‘trusted networks’’ lished as of the date of enactment of this (2) by striking subsection (e); and
to implement security controls based on a Act; and (3) by redesignating subsection (f) as sub-
presumption of compromise; (2) as appropriate and pursuant to section section (e).
ctelli on DSK11ZRN23PROD with SENATE
(2) implementing principles of least privi- 224(c) of the Cybersecurity Act of 2015 (6 TITLE LIII—RISK-BASED BUDGET MODEL
lege in administering information security U.S.C. 1522(c))—
programs; (A) update the covered metrics; and SEC. 5161. DEFINITIONS.
(3) limiting the ability of entities that (B) establish new covered metrics. In this title:
cause incidents to move laterally through or (c) IMPLEMENTATION.— (1) APPROPRIATE CONGRESSIONAL COMMIT-
between agency systems; (1) IN GENERAL.—Not later than 540 days TEES.—The term ‘‘appropriate congressional
(4) identifying incidents quickly; after the date of enactment of this Act, the committees’’ means—
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00074 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8481
(A) the Committee on Homeland Security required to be developed under this sub- (1) an evaluation of the success of covered
and Governmental Affairs and the Com- section. agencies in developing risk-based budgets;
mittee on Appropriations of the Senate; and (5) PUBLICATION.—The Director shall pub- (2) an evaluation of the success of covered
(B) the Committee on Homeland Security lish the model required to be developed agencies in implementing risk-based budg-
and the Committee on Appropriations of the under this subsection, and any updates nec- ets;
House of Representatives. essary under paragraph (4), on the public (3) an evaluation of whether the risk-based
(2) COVERED AGENCY.—The term ‘‘covered website of the Office of Management and budgets developed by covered agencies miti-
agency’’ has the meaning given the term Budget. gate cyber vulnerability, including the ex-
‘‘executive agency’’ in section 133 of title 41, (6) REPORTS.—Not later than 1 year after tent to which the risk-based budgets inform
United States Code. the date of enactment of this Act, and annu- Federal Government-wide cybersecurity pro-
(3) DIRECTOR.—The term ‘‘Director’’ means ally thereafter for each of the 2 following fis- grams; and
the Director of the Office of Management cal years or until the date on which the (4) any other information relating to risk-
and Budget. model required to be developed under this based budgets the Comptroller General de-
(4) INFORMATION TECHNOLOGY.—The term subsection is completed, whichever is sooner, termines appropriate.
‘‘information technology’’— the Director shall submit a report to Con- TITLE LIV—PILOT PROGRAMS TO
(A) has the meaning given the term in sec- gress on the development of the model. ENHANCE FEDERAL CYBERSECURITY
tion 11101 of title 40, United States Code; and (b) REQUIRED USE OF RISK-BASED BUDGET
MODEL.— SEC. 5181. ACTIVE CYBER DEFENSIVE STUDY.
(B) includes the hardware and software
systems of a Federal agency that monitor (1) IN GENERAL.—Not later than 2 years (a) DEFINITION.—In this section, the term
and control physical equipment and proc- after the date on which the model developed ‘‘active defense technique’’—
esses of the Federal agency. under subsection (a) is published, the head of (1) means an action taken on the systems
(5) RISK-BASED BUDGET.—The term ‘‘risk- each covered agency shall use the model to of an entity to increase the security of infor-
based budget’’ means a budget— develop the annual cybersecurity and infor- mation on the network of an agency by mis-
(A) developed by identifying and mation technology budget requests of the leading an adversary; and
prioritizing cybersecurity risks and agency. (2) includes a honeypot, deception, or pur-
vulnerabilities, including impact on agency (2) AGENCY PERFORMANCE PLANS.—Section posefully feeding false or misleading data to
operations in the case of a cyber attack, 3554(d)(2) of title 44, United States Code, is an adversary when the adversary is on the
through analysis of cyber threat intel- amended by inserting ‘‘and the risk-based systems of the entity.
ligence, incident data, and tactics, tech- budget model required under section (b) STUDY.—Not later than 180 days after
niques, procedures, and capabilities of cyber 3553(a)(7)’’ after ‘‘paragraph (1)’’. the date of enactment of this Act, the Direc-
threats; and (c) VERIFICATION.— tor of the Cybersecurity and Infrastructure
(B) that allocates resources based on the (1) IN GENERAL.—Section 1105(a)(35)(A)(i) of Security Agency, in coordination with the
risks identified and prioritized under sub- title 31, United States Code, is amended— Director, shall perform a study on the use of
paragraph (A). (A) in the matter preceding subclause (I), active defense techniques to enhance the se-
SEC. 5162. ESTABLISHMENT OF RISK-BASED by striking ‘‘by agency, and by initiative curity of agencies, which shall include—
BUDGET MODEL. area (as determined by the administration)’’ (1) a review of legal restrictions on the use
(a) IN GENERAL.— and inserting ‘‘and by agency’’; of different active cyber defense techniques
(1) MODEL.—Not later than 1 year after the (B) in subclause (III), by striking ‘‘and’’ at in Federal environments, in consultation
first publication of the budget submitted by the end; and with the Department of Justice;
the President under section 1105 of title 31, (C) by adding at the end the following: (2) an evaluation of—
United States Code, following the date of en- ‘‘(V) a validation that the budgets sub- (A) the efficacy of a selection of active de-
actment of this Act, the Director, in con- mitted were developed using a risk-based fense techniques determined by the Director
sultation with the Director of the Cybersecu- methodology; and of the Cybersecurity and Infrastructure Se-
rity and Infrastructure Security Agency and ‘‘(VI) a report on the progress of each agen- curity Agency; and
the National Cyber Director and in coordina- cy on closing recommendations identified (B) factors that impact the efficacy of the
tion with the Director of the National Insti- under the independent evaluation required active defense techniques evaluated under
tute of Standards and Technology, shall de- by section 3555(a)(1) of title 44.’’. subparagraph (A);
velop a standard model for creating a risk- (2) EFFECTIVE DATE.—The amendments (3) recommendations on safeguards and
based budget for cybersecurity spending. made by paragraph (1) shall take effect on procedures that shall be established to re-
(2) RESPONSIBILITY OF DIRECTOR.—Section the date that is 2 years after the date on quire that active defense techniques are ade-
3553(a) of title 44, United States Code, as which the model developed under subsection quately coordinated to ensure that active de-
amended by section 5121 of this division, is (a) is published. fense techniques do not impede threat re-
further amended by inserting after para- (d) REPORTS.— sponse efforts, criminal investigations, and
graph (6) the following: (1) INDEPENDENT EVALUATION.—Section national security activities, including intel-
‘‘(7) developing a standard risk-based budg- 3555(a)(2) of title 44, United States Code, is ligence collection; and
et model to inform Federal agency cyberse- amended— (4) the development of a framework for the
curity budget development; and’’. (A) in subparagraph (B), by striking ‘‘and’’ use of different active defense techniques by
(3) CONTENTS OF MODEL.—The model re- at the end; agencies.
quired to be developed under paragraph (1) (B) in subparagraph (C), by striking the pe- SEC. 5182. SECURITY OPERATIONS CENTER AS A
shall— riod at the end and inserting ‘‘; and’’; and SERVICE PILOT.
(A) consider Federal and non-Federal cyber (C) by adding at the end the following: (a) PURPOSE.—The purpose of this section
threat intelligence products, where avail- ‘‘(D) an assessment of how the agency im- is for the Cybersecurity and Infrastructure
able, to identify threats, vulnerabilities, and plemented the risk-based budget model re- Security Agency to run a security operation
risks; quired under section 3553(a)(7) and an evalua- center on behalf of another agency, alle-
(B) consider the impact of agency oper- tion of whether the model mitigates agency viating the need to duplicate this function at
ations of compromise of systems, including cyber vulnerabilities.’’. every agency, and empowering a greater cen-
the interconnectivity to other agency sys- (2) ASSESSMENT.—Section 3553(c) of title 44, tralized cybersecurity capability.
tems and the operations of other agencies; United States Code, as amended by section (b) PLAN.—Not later than 1 year after the
(C) indicate where resources should be allo- 5121, is further amended by inserting after date of enactment of this Act, the Director
cated to have the greatest impact on miti- paragraph (5) the following: of the Cybersecurity and Infrastructure Se-
gating current and future threats and cur- ‘‘(6) an assessment of— curity Agency shall develop a plan to estab-
rent and future cybersecurity capabilities; ‘‘(A) Federal agency implementation of the lish a centralized Federal security oper-
(D) be used to inform acquisition and model required under subsection (a)(7); ations center shared service offering within
sustainment of— ‘‘(B) how cyber vulnerabilities of Federal the Cybersecurity and Infrastructure Secu-
(i) information technology and cybersecu- agencies changed from the previous year; rity Agency.
rity tools; and (c) CONTENTS.—The plan required under
(ii) information technology and cybersecu- ‘‘(C) whether the model mitigates the subsection (b) shall include considerations
rity architectures; cyber vulnerabilities of the Federal Govern- for—
(iii) information technology and cyberse- ment.’’. (1) collecting, organizing, and analyzing
curity personnel; and (e) GAO REPORT.—Not later than 3 years agency information system data in real
(iv) cybersecurity and information tech- after the date on which the first budget of time;
ctelli on DSK11ZRN23PROD with SENATE
nology concepts of operations; and the President is submitted to Congress con- (2) staffing and resources; and
(E) be used to evaluate and inform Govern- taining the validation required under section (3) appropriate interagency agreements,
ment-wide cybersecurity programs of the De- 1105(a)(35)(A)(i)(V) of title 31, United States concepts of operations, and governance
partment of Homeland Security. Code, as amended by subsection (c), the plans.
(4) REQUIRED UPDATES.—Not less frequently Comptroller General of the United States (d) PILOT PROGRAM.—
than once every 3 years, the Director shall shall submit to the appropriate congres- (1) IN GENERAL.—Not later than 180 days
review, and update as necessary, the model sional committees a report that includes— after the date on which the plan required
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00075 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8482 CONGRESSIONAL RECORD — SENATE November 18, 2021
under subsection (b) is developed, the Direc- specified in sections 2202(e), 2203, and 2231, ‘‘(ii) a Federal contractor.
tor of the Cybersecurity and Infrastructure this subsection, and any other authorized ac- ‘‘SEC. 2231. CYBER INCIDENT REVIEW.
Security Agency, in consultation with the tivity of the Director, to enhance the situa- ‘‘(a) ACTIVITIES.—The Center shall—
Director, shall enter into a 1-year agreement tional awareness of cybersecurity threats ‘‘(1) receive, aggregate, analyze, and se-
with not less than 2 agencies to offer a secu- across critical infrastructure sectors.’’; and cure, using processes consistent with the
rity operations center as a shared service. (2) by adding at the end the following: processes developed pursuant to the Cyberse-
(2) ADDITIONAL AGREEMENTS.—After the ‘‘Subtitle C—Cyber Incident Reporting curity Information Sharing Act of 2015 (6
date on which the briefing required under ‘‘SEC. 2230. DEFINITIONS. U.S.C. 1501 et seq.) reports from covered enti-
subsection (e)(1) is provided, the Director of ‘‘In this subtitle: ties related to a covered cyber incident to as-
the Cybersecurity and Infrastructure Secu- ‘‘(1) CENTER.—The term ‘Center’ means the sess the effectiveness of security controls,
rity Agency, in consultation with the Direc- center established under section 2209. identify tactics, techniques, and procedures
tor, may enter into additional 1-year agree- ‘‘(2) COUNCIL.—The term ‘Council’ means adversaries use to overcome those controls
ments described in paragraph (1) with agen- the Cyber Incident Reporting Council de- and other cybersecurity purposes, including
cies. scribed in section 1752(c)(1)(H) of the William to support law enforcement investigations,
(e) BRIEFING AND REPORT.— M. (Mac) Thornberry National Defense Au- to assess potential impact of incidents on
(1) BRIEFING.—Not later than 260 days after thorization Act for Fiscal Year 2021 (6 U.S.C. public health and safety, and to have a more
the date of enactment of this Act, the Direc- 1500(c)(1)(H)). accurate picture of the cyber threat to crit-
tor of the Cybersecurity and Infrastructure ‘‘(3) COVERED CYBER INCIDENT.—The term ical infrastructure and the people of the
Security Agency shall provide to the Com- ‘covered cyber incident’ means a substantial United States;
mittee on Homeland Security and Govern- cyber incident experienced by a covered enti- ‘‘(2) receive, aggregate, analyze, and secure
mental Affairs of the Senate and the Com- ty that satisfies the definition and criteria reports to lead the identification of tactics,
mittee on Homeland Security and the Com- established by the Director in the final rule techniques, and procedures used to perpet-
mittee on Oversight and Reform of the House issued pursuant to section 2232(b). uate cyber incidents and ransomware at-
of Representatives a briefing on the param- ‘‘(4) COVERED ENTITY.—The term ‘covered tacks;
eters of any 1-year agreements entered into entity’ means— ‘‘(3) coordinate and share information with
under subsection (d)(1). ‘‘(A) any Federal contractor; or appropriate Federal departments and agen-
(2) REPORT.—Not later than 90 days after ‘‘(B) an entity that owns or operates crit- cies to identify and track ransom payments,
the date on which the first 1-year agreement ical infrastructure that satisfies the defini- including those utilizing virtual currencies;
entered into under subsection (d) expires, the tion established by the Director in the final ‘‘(4) leverage information gathered about
Director of the Cybersecurity and Infrastruc- rule issued pursuant to section 2232(b). cybersecurity incidents to—
ture Security Agency shall submit to the ‘‘(5) CYBER INCIDENT.—The term ‘cyber in- ‘‘(A) enhance the quality and effectiveness
Committee on Homeland Security and Gov- cident’ has the meaning given the term ‘inci- of information sharing and coordination ef-
ernmental Affairs of the Senate and the dent’ in section 2200. forts with appropriate entities, including
Committee on Homeland Security and the ‘‘(6) CYBER THREAT.—The term ‘cyber agencies, sector coordinating councils, infor-
Committee on Oversight and Reform of the threat’— mation sharing and analysis organizations,
House of Representatives a report on— ‘‘(A) has the meaning given the term ‘cy- technology providers, critical infrastructure
(A) the agreement; and bersecurity threat’ in section 2200; and owners and operators, cybersecurity and in-
(B) any additional agreements entered into ‘‘(B) does not include any activity related cident response firms, and security research-
with agencies under subsection (d). to good faith security research, including ers; and
DIVISION F—CYBER INCIDENT REPORT- participation in a bug-bounty program or a ‘‘(B) provide appropriate entities, includ-
ING ACT OF 2021 AND CISA TECHNICAL vulnerability disclosure program. ing agencies, sector coordinating councils,
CORRECTIONS AND IMPROVEMENTS ‘‘(7) FEDERAL CONTRACTOR.—The term ‘Fed- information sharing and analysis organiza-
ACT OF 2021 eral contractor’ means a business, nonprofit tions, technology providers, cybersecurity
TITLE LXI—CYBER INCIDENT REPORTING organization, or other private sector entity and incident response firms, and security re-
ACT OF 2021 that holds a Federal Government contract or searchers, with timely, actionable, and
SEC. 6101. SHORT TITLE.
subcontract at any tier, grant, cooperative anonymized reports of cyber incident cam-
agreement, or other transaction agreement, paigns and trends, including, to the max-
This title may be cited as the ‘‘Cyber Inci-
unless that entity is a party only to— imum extent practicable, related contextual
dent Reporting Act of 2021’’.
‘‘(A) a service contract to provide house- information, cyber threat indicators, and de-
SEC. 6102. DEFINITIONS. keeping or custodial services; or fensive measures, pursuant to section 2235;
In this title: ‘‘(B) a contract to provide products or serv- ‘‘(5) establish mechanisms to receive feed-
(1) COVERED CYBER INCIDENT; COVERED ENTI- ices unrelated to information technology back from stakeholders on how the Agency
TY; CYBER INCIDENT.—The terms ‘‘covered that is below the micro-purchase threshold, can most effectively receive covered cyber
cyber incident’’, ‘‘covered entity’’, and as defined in section 2.101 of title 48, Code of incident reports, ransom payment reports,
‘‘cyber incident’’ have the meanings given Federal Regulations, or any successor regu- and other voluntarily provided information;
those terms in section 2230 of the Homeland lation. ‘‘(6) facilitate the timely sharing, on a vol-
Security Act of 2002, as added by section 6103 ‘‘(8) FEDERAL ENTITY; INFORMATION SYSTEM; untary basis, between relevant critical infra-
of this title. SECURITY CONTROL.—The terms ‘Federal enti- structure owners and operators of informa-
(2) DIRECTOR.—The term ‘‘Director’’ means ty’, ‘information system’, and ‘security con- tion relating to covered cyber incidents and
the Director of the Cybersecurity and Infra- trol’ have the meanings given those terms in ransom payments, particularly with respect
structure Security Agency. section 102 of the Cybersecurity Act of 2015 (6 to ongoing cyber threats or security
(3) INFORMATION SYSTEM; RANSOM PAYMENT; U.S.C. 1501). vulnerabilities and identify and disseminate
RANSOMWARE ATTACK; SECURITY VULNER- ‘‘(9) SIGNIFICANT CYBER INCIDENT.—The ways to prevent or mitigate similar inci-
ABILITY.—The terms ‘‘information system’’, term ‘significant cyber incident’ means a cy- dents in the future;
‘‘ransom payment’’, ‘‘ransomware attack’’, bersecurity incident, or a group of related ‘‘(7) for a covered cyber incident, including
and ‘‘security vulnerability’’ have the mean- cybersecurity incidents, that the Secretary a ransomware attack, that also satisfies the
ings given those terms in section 2200 of the determines is likely to result in demon- definition of a significant cyber incident, or
Homeland Security Act of 2002, as added by strable harm to the national security inter- is part of a group of related cyber incidents
section 6203 of this division. ests, foreign relations, or economy of the that together satisfy such definition, con-
SEC. 6103. CYBER INCIDENT REPORTING. United States or to the public confidence, duct a review of the details surrounding the
(a) CYBER INCIDENT REPORTING.—Title XXII civil liberties, or public health and safety of covered cyber incident or group of those inci-
of the Homeland Security Act of 2002 (6 the people of the United States. dents and identify and disseminate ways to
U.S.C. 651 et seq.) is amended— ‘‘(10) SMALL ORGANIZATION.—The term prevent or mitigate similar incidents in the
(1) in section 2209(b) (6 U.S.C. 659(b)), as so ‘small organization’— future;
redesignated by section 6203(b) of this divi- ‘‘(A) means— ‘‘(8) with respect to covered cyber incident
sion— ‘‘(i) a small business concern, as defined in reports under section 2232(a) and 2233 involv-
(A) in paragraph (11), by striking ‘‘and’’ at section 3 of the Small Business Act (15 U.S.C. ing an ongoing cyber threat or security vul-
the end; 632); or nerability, immediately review those reports
(B) in paragraph (12), by striking the pe- ‘‘(ii) any nonprofit organization, including for cyber threat indicators that can be
riod at the end and inserting ‘‘; and’’; and faith-based organizations and houses of wor- anonymized and disseminated, with defen-
ctelli on DSK11ZRN23PROD with SENATE
(C) by adding at the end the following: ship, or other private sector entity with sive measures, to appropriate stakeholders,
‘‘(13) receiving, aggregating, and analyzing fewer than 200 employees (determined on a in coordination with other divisions within
reports related to covered cyber incidents (as full-time equivalent basis); and the Agency, as appropriate;
defined in section 2230) submitted by covered ‘‘(B) does not include— ‘‘(9) publish quarterly unclassified, public
entities (as defined in section 2230) and re- ‘‘(i) a business, nonprofit organization, or reports that may be based on the unclassi-
ports related to ransom payments submitted other private sector entity that is a covered fied information contained in the briefings
by entities in furtherance of the activities entity; or required under subsection (c);
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00076 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8483
‘‘(10) proactively identify opportunities ‘‘(4) be unclassified, but may include a ‘‘(3) SUBSEQUENT RULEMAKINGS.—
and perform analyses, consistent with the classified annex. ‘‘(A) IN GENERAL.—The Director is author-
protections in section 2235, to leverage and ‘‘SEC. 2232. REQUIRED REPORTING OF CERTAIN ized to issue regulations to amend or revise
utilize data on ransomware attacks to sup- CYBER INCIDENTS. the final rule issued pursuant to paragraph
port law enforcement operations to identify, ‘‘(a) IN GENERAL.— (2).
track, and seize ransom payments utilizing ‘‘(1) COVERED CYBER INCIDENT REPORTS.—A ‘‘(B) PROCEDURES.—Any subsequent rules
virtual currencies, to the greatest extent covered entity that is a victim of a covered issued under subparagraph (A) shall comply
practicable; cyber incident shall report the covered cyber with the requirements under chapter 5 of
‘‘(11) proactively identify opportunities, incident to the Director not later than 72 title 5, United States Code, including the
consistent with the protections in section hours after the covered entity reasonably be- issuance of a notice of proposed rulemaking
2235, to leverage and utilize data on cyber in- lieves that the covered cyber incident has oc- under section 553 of such title.
cidents in a manner that enables and curred. ‘‘(c) ELEMENTS.—The final rule issued pur-
strengthens cybersecurity research carried ‘‘(2) RANSOM PAYMENT REPORTS.—An enti- suant to subsection (b) shall be composed of
out by academic institutions and other pri- ty, including a covered entity and except for the following elements:
vate sector organizations, to the greatest ex- an individual or a small organization, that ‘‘(1) A clear description of the types of en-
tent practicable; makes a ransom payment as the result of a tities that constitute covered entities, based
‘‘(12) on a not less frequently than annual ransomware attack against the entity shall on—
basis, analyze public disclosures made pursu- report the payment to the Director not later ‘‘(A) the consequences that disruption to
ant to parts 229 and 249 of title 17, Code of than 24 hours after the ransom payment has or compromise of such an entity could cause
Federal Regulations, or any subsequent doc- been made. to national security, economic security, or
ument submitted to the Securities and Ex- ‘‘(3) SUPPLEMENTAL REPORTS.—A covered public health and safety;
change Commission by entities experiencing entity shall promptly submit to the Director ‘‘(B) the likelihood that such an entity
cyber incidents and compare such disclosures an update or supplement to a previously sub- may be targeted by a malicious cyber actor,
to reports received by the Center; and mitted covered cyber incident report if new including a foreign country; and
‘‘(13) in accordance with section 2235 and or different information becomes available ‘‘(C) the extent to which damage, disrup-
subsection (b) of this section, as soon as pos- or if the covered entity makes a ransom pay- tion, or unauthorized access to such an enti-
sible but not later than 24 hours after receiv- ment after submitting a covered cyber inci- ty, including the accessing of sensitive cy-
dent report required under paragraph (1). bersecurity vulnerability information or
ing a covered cyber incident report, ransom
‘‘(4) PRESERVATION OF INFORMATION.—Any penetration testing tools or techniques, will
payment report, voluntarily submitted infor-
entity subject to requirements of paragraph likely enable the disruption of the reliable
mation pursuant to section 2233, or informa-
(1), (2), or (3) shall preserve data relevant to operation of critical infrastructure.
tion received pursuant to a request for infor-
the covered cyber incident or ransom pay- ‘‘(2) A clear description of the types of sub-
mation or subpoena under section 2234, make
ment in accordance with procedures estab- stantial cyber incidents that constitute cov-
available the information to appropriate
lished in the final rule issued pursuant to ered cyber incidents, which shall—
Sector Risk Management Agencies and other
subsection (b). ‘‘(A) at a minimum, require the occurrence
appropriate Federal agencies.
‘‘(5) EXCEPTIONS.— of—
‘‘(b) INTERAGENCY SHARING.—The National ‘‘(A) REPORTING OF COVERED CYBER INCI- ‘‘(i) the unauthorized access to an informa-
Cyber Director, in consultation with the Di- DENT WITH RANSOM PAYMENT.—If a covered tion system or network with a substantial
rector and the Director of the Office of Man- cyber incident includes a ransom payment loss of confidentiality, integrity, or avail-
agement and Budget— such that the reporting requirements under ability of such information system or net-
‘‘(1) may establish a specific time require- paragraphs (1) and (2) apply, the covered en- work, or a serious impact on the safety and
ment for sharing information under sub- tity may submit a single report to satisfy resiliency of operational systems and proc-
section (a)(13); and the requirements of both paragraphs in ac- esses;
‘‘(2) shall determine the appropriate Fed- cordance with procedures established in the ‘‘(ii) a disruption of business or industrial
eral agencies under subsection (a)(13). final rule issued pursuant to subsection (b). operations due to a cyber incident; or
‘‘(c) PERIODIC BRIEFING.—Not later than 60 ‘‘(B) SUBSTANTIALLY SIMILAR REPORTED IN- ‘‘(iii) an occurrence described in clause (i)
days after the effective date of the final rule FORMATION.—The requirements under para- or (ii) due to loss of service facilitated
required under section 2232(b), and on the graphs (1), (2), and (3) shall not apply to an through, or caused by, a compromise of a
first day of each month thereafter, the Di- entity required by law, regulation, or con- cloud service provider, managed service pro-
rector, in consultation with the National tract to report substantially similar infor- vider, or other third-party data hosting pro-
Cyber Director, the Attorney General, and mation to another Federal agency within a vider or by a supply chain compromise;
the Director of National Intelligence, shall substantially similar timeframe. ‘‘(B) consider—
provide to the majority leader of the Senate, ‘‘(C) DOMAIN NAME SYSTEM.—The require- ‘‘(i) the sophistication or novelty of the
the minority leader of the Senate, the ments under paragraphs (1), (2) and (3) shall tactics used to perpetrate such an incident,
Speaker of the House of Representatives, the not apply to an entity or the functions of an as well as the type, volume, and sensitivity
minority leader of the House of Representa- entity that the Director determines con- of the data at issue;
tives, the Committee on Homeland Security stitute critical infrastructure owned, oper- ‘‘(ii) the number of individuals directly or
and Governmental Affairs of the Senate, and ated, or governed by multi-stakeholder orga- indirectly affected or potentially affected by
the Committee on Homeland Security of the nizations that develop, implement, and en- such an incident; and
House of Representatives a briefing that force policies concerning the Domain Name ‘‘(iii) potential impacts on industrial con-
characterizes the national cyber threat land- System, such as the Internet Corporation for trol systems, such as supervisory control and
scape, including the threat facing Federal Assigned Names and Numbers or the Inter- data acquisition systems, distributed control
agencies and covered entities, and applicable net Assigned Numbers Authority. systems, and programmable logic control-
intelligence and law enforcement informa- ‘‘(6) MANNER, TIMING, AND FORM OF RE- lers; and
tion, covered cyber incidents, and PORTS.—Reports made under paragraphs (1), ‘‘(C) exclude—
ransomware attacks, as of the date of the (2), and (3) shall be made in the manner and ‘‘(i) any event where the cyber incident is
briefing, which shall— form, and within the time period in the case perpetuated by good faith security research
‘‘(1) include the total number of reports of reports made under paragraph (3), pre- or in response to an invitation by the owner
submitted under sections 2232 and 2233 dur- scribed in the final rule issued pursuant to or operator of the information system for
ing the preceding month, including a break- subsection (b). third parties to find vulnerabilities in the in-
down of required and voluntary reports; ‘‘(7) EFFECTIVE DATE.—Paragraphs (1) formation system, such as through a vulner-
‘‘(2) include any identified trends in cov- through (4) shall take effect on the dates pre- ability disclosure program or the use of au-
ered cyber incidents and ransomware attacks scribed in the final rule issued pursuant to thorized penetration testing services; and
over the course of the preceding month and subsection (b). ‘‘(ii) the threat of disruption as extortion,
as compared to previous reports, including ‘‘(b) RULEMAKING.— as described in section 2201(9)(A).
any trends related to the information col- ‘‘(1) NOTICE OF PROPOSED RULEMAKING.—Not ‘‘(3) A requirement that, if a covered cyber
lected in the reports submitted under sec- later than 2 years after the date of enact- incident or a ransom payment occurs fol-
tions 2232 and 2233, including— ment of this section, the Director, in con- lowing an exempted threat described in para-
‘‘(A) the infrastructure, tactics, and tech- sultation with Sector Risk Management graph (2)(C)(ii), the entity shall comply with
niques malicious cyber actors commonly Agencies, the Department of Justice, and the requirements in this subtitle in report-
use; and other Federal agencies, shall publish in the ing the covered cyber incident or ransom
ctelli on DSK11ZRN23PROD with SENATE
‘‘(B) intelligence gaps that have impeded, Federal Register a notice of proposed rule- payment.
or currently are impeding, the ability to making to implement subsection (a). ‘‘(4) A clear description of the specific re-
counter covered cyber incidents and ‘‘(2) FINAL RULE.—Not later than 18 months quired contents of a report pursuant to sub-
ransomware threats; after publication of the notice of proposed section (a)(1), which shall include the fol-
‘‘(3) include a summary of the known uses rulemaking under paragraph (1), the Director lowing information, to the extent applicable
of the information in reports submitted shall issue a final rule to implement sub- and available, with respect to a covered
under sections 2232 and 2233; and section (a). cyber incident:
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00077 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8484 CONGRESSIONAL RECORD — SENATE November 18, 2021
‘‘(A) A description of the covered cyber in- ‘‘(A) be established by the Director in con- ‘‘(2) ELEMENTS.—The outreach and edu-
cident, including— sultation with the Council; cation campaign under paragraph (1) shall
‘‘(i) identification and a description of the ‘‘(B) consider any existing regulatory re- include the following:
function of the affected information sys- porting requirements similar in scope, pur- ‘‘(A) An overview of the final rule issued
tems, networks, or devices that were, or are pose, and timing to the reporting require- pursuant to subsection (b).
reasonably believed to have been, affected by ments to which such a covered entity may ‘‘(B) An overview of mechanisms to submit
such incident; also be subject, and make efforts to har- to the Center covered cyber incident reports
‘‘(ii) a description of the unauthorized ac- monize the timing and contents of any such and information relating to the disclosure,
cess with substantial loss of confidentiality, reports to the maximum extent practicable; retention, and use of incident reports under
integrity, or availability of the affected in- and this section.
formation system or network or disruption ‘‘(C) balance the need for situational ‘‘(C) An overview of the protections af-
of business or industrial operations; awareness with the ability of the covered en- forded to covered entities for complying with
‘‘(iii) the estimated date range of such in- tity to conduct incident response and inves- the requirements under paragraphs (1), (2),
cident; and tigations. and (3) of subsection (a).
‘‘(iv) the impact to the operations of the ‘‘(8) Procedures for— ‘‘(D) An overview of the steps taken under
covered entity. ‘‘(A) entities to submit reports required by section 2234 when a covered entity is not in
‘‘(B) Where applicable, a description of the paragraphs (1), (2), and (3) of subsection (a), compliance with the reporting requirements
vulnerabilities, tactics, techniques, and pro- including the manner and form thereof, under subsection (a).
cedures used to perpetuate the covered cyber which shall include, at a minimum, a con- ‘‘(E) Specific outreach to cybersecurity
incident. cise, user-friendly web-based form; vendors, incident response providers, cyber-
‘‘(C) Where applicable, any identifying or ‘‘(B) the Agency to carry out the enforce- security insurance entities, and other enti-
contact information related to each actor ment provisions of section 2233, including ties that may support covered entities or
reasonably believed to be responsible for with respect to the issuance, service, with- ransomware attack victims.
such incident. drawal, and enforcement of subpoenas, ap- ‘‘(F) An overview of the privacy and civil
‘‘(D) Where applicable, identification of the peals and due process procedures, the suspen- liberties requirements in this subtitle.
category or categories of information that sion and debarment provisions in section ‘‘(3) COORDINATION.—In conducting the out-
were, or are reasonably believed to have 2234(c), and other aspects of noncompliance; reach and education campaign required
been, accessed or acquired by an unauthor- ‘‘(C) implementing the exceptions provided under paragraph (1), the Director may co-
ized person. in subsection (a)(5); and ordinate with—
‘‘(E) The name and other information that ‘‘(D) protecting privacy and civil liberties ‘‘(A) the Critical Infrastructure Partner-
clearly identifies the entity impacted by the consistent with processes adopted pursuant ship Advisory Council established under sec-
covered cyber incident. to section 105(b) of the Cybersecurity Act of tion 871;
‘‘(F) Contact information, such as tele- 2015 (6 U.S.C. 1504(b)) and anonymizing and ‘‘(B) information sharing and analysis or-
phone number or electronic mail address, safeguarding, or no longer retaining, infor- ganizations;
that the Center may use to contact the cov- mation received and disclosed through cov- ‘‘(C) trade associations;
ered entity or an authorized agent of such ‘‘(D) information sharing and analysis cen-
ered cyber incident reports and ransom pay-
covered entity, or, where applicable, the
ment reports that is known to be personal ters;
service provider of such covered entity act-
information of a specific individual or infor- ‘‘(E) sector coordinating councils; and
ing with the express permission of, and at
mation that identifies a specific individual ‘‘(F) any other entity as determined appro-
the direction of, the covered entity to assist
that is not directly related to a cybersecu- priate by the Director.
with compliance with the requirements of
rity threat. ‘‘(f) ORGANIZATION OF REPORTS.—Notwith-
this subtitle.
‘‘(9) A clear description of the types of en- standing chapter 35 of title 44, United States
‘‘(5) A clear description of the specific re-
tities that constitute other private sector Code (commonly known as the ‘Paperwork
quired contents of a report pursuant to sub-
entities for purposes of section 2230(b)(7). Reduction Act’), the Director may request
section (a)(2), which shall be the following
‘‘(d) THIRD PARTY REPORT SUBMISSION AND information within the scope of the final
information, to the extent applicable and
available, with respect to a ransom payment: RANSOM PAYMENT.— rule issued under subsection (b) by the alter-
‘‘(A) A description of the ransomware at- ‘‘(1) REPORT SUBMISSION.—An entity, in- ation of existing questions or response fields
tack, including the estimated date range of cluding a covered entity, that is required to and the reorganization and reformatting of
the attack. submit a covered cyber incident report or a the means by which covered cyber incident
‘‘(B) Where applicable, a description of the ransom payment report may use a third reports, ransom payment reports, and any
vulnerabilities, tactics, techniques, and pro- party, such as an incident response company, voluntarily offered information is submitted
cedures used to perpetuate the ransomware insurance provider, service provider, infor- to the Center.
attack. mation sharing and analysis organization, or ‘‘SEC. 2233. VOLUNTARY REPORTING OF OTHER
‘‘(C) Where applicable, any identifying or law firm, to submit the required report CYBER INCIDENTS.
contact information related to the actor or under subsection (a). ‘‘(a) IN GENERAL.—Entities may volun-
actors reasonably believed to be responsible ‘‘(2) RANSOM PAYMENT.—If an entity im- tarily report incidents or ransom payments
for the ransomware attack. pacted by a ransomware attack uses a third to the Director that are not required under
‘‘(D) The name and other information that party to make a ransom payment, the third paragraph (1), (2), or (3) of section 2232(a), but
clearly identifies the entity that made the party shall not be required to submit a ran- may enhance the situational awareness of
ransom payment. som payment report for itself under sub- cyber threats.
‘‘(E) Contact information, such as tele- section (a)(2). ‘‘(b) VOLUNTARY PROVISION OF ADDITIONAL
phone number or electronic mail address, ‘‘(3) DUTY TO REPORT.—Third-party report- INFORMATION IN REQUIRED REPORTS.—Enti-
that the Center may use to contact the enti- ing under this subparagraph does not relieve ties may voluntarily include in reports re-
ty that made the ransom payment or an au- a covered entity or an entity that makes a quired under paragraph (1), (2), or (3) of sec-
thorized agent of such covered entity, or, ransom payment from the duty to comply tion 2232(a) information that is not required
where applicable, the service provider of with the requirements for covered cyber inci- to be included, but may enhance the situa-
such covered entity acting with the express dent report or ransom payment report sub- tional awareness of cyber threats.
permission of, and at the direction of, that mission. ‘‘(c) APPLICATION OF PROTECTIONS.—The
entity to assist with compliance with the re- ‘‘(4) RESPONSIBILITY TO ADVISE.—Any third protections under section 2235 applicable to
quirements of this subtitle. party used by an entity that knowingly covered cyber incident reports shall apply in
‘‘(F) The date of the ransom payment. makes a ransom payment on behalf of an en- the same manner and to the same extent to
‘‘(G) The ransom payment demand, includ- tity impacted by a ransomware attack shall reports and information submitted under
ing the type of virtual currency or other advise the impacted entity of the respon- subsections (a) and (b).
commodity requested, if applicable. sibilities of the impacted entity regarding ‘‘SEC. 2234. NONCOMPLIANCE WITH REQUIRED
‘‘(H) The ransom payment instructions, in- reporting ransom payments under this sec- REPORTING.
cluding information regarding where to send tion. ‘‘(a) PURPOSE.—In the event that an entity
the payment, such as the virtual currency ‘‘(e) OUTREACH TO COVERED ENTITIES.— that is required to submit a report under sec-
address or physical address the funds were ‘‘(1) IN GENERAL.—The Director shall con- tion 2232(a) fails to comply with the require-
requested to be sent to, if applicable. duct an outreach and education campaign to ment to report, the Director may obtain in-
‘‘(I) The amount of the ransom payment. inform likely covered entities, entities that formation about the incident or ransom pay-
ctelli on DSK11ZRN23PROD with SENATE
‘‘(6) A clear description of the types of data offer or advertise as a service to customers ment by engaging the entity directly to re-
required to be preserved pursuant to sub- to make or facilitate ransom payments on quest information about the incident or ran-
section (a)(4) and the period of time for behalf of entities impacted by ransomware som payment, and if the Director is unable
which the data is required to be preserved. attacks, potential ransomware attack vic- to obtain information through such engage-
‘‘(7) Deadlines for submitting reports to tims, and other appropriate entities of the ment, by issuing a subpoena to the entity,
the Director required under subsection (a)(3), requirements of paragraphs (1), (2), and (3) of pursuant to subsection (c), to gather infor-
which shall— subsection (a). mation sufficient to determine whether a
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00078 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8485
covered cyber incident or ransom payment Federal regulatory agency determines, based economic harm, including a terrorist act or
has occurred, and, if so, whether additional on information provided in response to a sub- use of a weapon of mass destruction;
action is warranted pursuant to subsection poena issued pursuant to subsection (c), that ‘‘(D) the purpose of responding to, inves-
(d). the facts relating to the covered cyber inci- tigating, prosecuting, or otherwise pre-
‘‘(b) INITIAL REQUEST FOR INFORMATION.— dent or ransom payment at issue may con- venting or mitigating, a serious threat to a
‘‘(1) IN GENERAL.—If the Director has rea- stitute grounds for a regulatory enforcement minor, including sexual exploitation and
son to believe, whether through public re- action or criminal prosecution, the Attorney threats to physical safety; or
porting or other information in the posses- General or the appropriate Federal regu- ‘‘(E) the purpose of preventing, inves-
sion of the Federal Government, including latory agency may use that information for tigating, disrupting, or prosecuting an of-
through analysis performed pursuant to a regulatory enforcement action or criminal fense arising out of a cyber incident reported
paragraph (1) or (2) of section 2231(a), that an prosecution. pursuant to section 2232 or 2233 or any of the
entity has experienced a covered cyber inci- ‘‘(2) APPLICATION TO CERTAIN ENTITIES AND offenses listed in section 105(d)(5)(A)(v) of the
dent or made a ransom payment but failed to THIRD PARTIES.—A covered cyber incident or Cybersecurity Act of 2015 (6 U.S.C.
report such incident or payment to the Cen- ransom payment report submitted to the 1504(d)(5)(A)(v)).
ter within 72 hours in accordance with sec- Center by an entity that makes a ransom ‘‘(2) AGENCY ACTIONS AFTER RECEIPT.—
tion 2232(a), the Director shall request addi- payment or third party under section 2232 ‘‘(A) RAPID, CONFIDENTIAL SHARING OF
tional information from the entity to con- shall not be used by any Federal, State, CYBER THREAT INDICATORS.—Upon receiving a
firm whether or not a covered cyber incident Tribal, or local government to investigate or covered cyber incident or ransom payment
or ransom payment has occurred. take another law enforcement action against report submitted pursuant to this section,
‘‘(2) TREATMENT.—Information provided to the entity that makes a ransom payment or the center shall immediately review the re-
the Center in response to a request under third party. port to determine whether the incident that
paragraph (1) shall be treated as if it was ‘‘(3) RULE OF CONSTRUCTION.—Nothing in is the subject of the report is connected to
submitted through the reporting procedures this subtitle shall be construed to provide an an ongoing cyber threat or security vulner-
established in section 2232. entity that submits a covered cyber incident ability and where applicable, use such report
‘‘(c) AUTHORITY TO ISSUE SUBPOENAS AND to identify, develop, and rapidly disseminate
report or ransom payment report under sec-
DEBAR.— to appropriate stakeholders actionable,
tion 2232 any immunity from law enforce-
‘‘(1) IN GENERAL.—If, after the date that is anonymized cyber threat indicators and de-
72 hours from the date on which the Director ment action for making a ransom payment
otherwise prohibited by law. fensive measures.
made the request for information in sub- ‘‘(B) STANDARDS FOR SHARING SECURITY
‘‘(e) CONSIDERATIONS.—When determining
section (b), the Director has received no re- VULNERABILITIES.—With respect to informa-
whether to exercise the authorities provided
sponse from the entity from which such in- tion in a covered cyber incident or ransom
under this section, the Director shall take
formation was requested, or received an in- payment report regarding a security vulner-
into consideration—
adequate response, the Director may issue to ability referred to in paragraph (1)(B)(ii), the
‘‘(1) the size and complexity of the entity;
such entity a subpoena to compel disclosure Director shall develop principles that govern
‘‘(2) the complexity in determining if a
of information the Director deems necessary the timing and manner in which information
covered cyber incident has occurred; and
to determine whether a covered cyber inci- relating to security vulnerabilities may be
‘‘(3) prior interaction with the Agency or
dent or ransom payment has occurred and shared, consistent with common industry
awareness of the entity of the policies and
obtain the information required to be re- best practices and United States and inter-
procedures of the Agency for reporting cov-
ported pursuant to section 2232 and any im- national standards.
ered cyber incidents and ransom payments.
plementing regulations. ‘‘(f) EXCLUSIONS.—This section shall not ‘‘(3) PRIVACY AND CIVIL LIBERTIES.—Infor-
‘‘(2) CIVIL ACTION.— apply to a State, local, Tribal, or territorial mation contained in covered cyber incident
‘‘(A) IN GENERAL.—If an entity fails to com- government entity. and ransom payment reports submitted to
ply with a subpoena, the Director may refer ‘‘(g) REPORT TO CONGRESS.—The Director the Center or the Agency pursuant to section
the matter to the Attorney General to bring shall submit to Congress an annual report on 2232 shall be retained, used, and dissemi-
a civil action in a district court of the the number of times the Director— nated, where permissible and appropriate, by
United States to enforce such subpoena. ‘‘(1) issued an initial request for informa- the Federal Government in accordance with
‘‘(B) VENUE.—An action under this para- tion pursuant to subsection (b); processes to be developed for the protection
graph may be brought in the judicial district ‘‘(2) issued a subpoena pursuant to sub- of personal information consistent with
in which the entity against which the action section (c); or processes adopted pursuant to section 105 of
is brought resides, is found, or does business. ‘‘(3) referred a matter to the Attorney Gen- the Cybersecurity Act of 2015 (6 U.S.C. 1504)
‘‘(C) CONTEMPT OF COURT.—A court may eral for a civil action pursuant to subsection and in a manner that protects from unau-
punish a failure to comply with a subpoena (c)(2). thorized use or disclosure any information
issued under this subsection as contempt of ‘‘(h) PUBLICATION OF THE ANNUAL REPORT.— that may contain—
court. The Director shall publish a version of the ‘‘(A) personal information of a specific in-
‘‘(3) NON-DELEGATION.—The authority of annual report required under subsection (g) dividual; or
the Director to issue a subpoena under this on the website of the Agency, which shall in- ‘‘(B) information that identifies a specific
subsection may not be delegated. clude, at a minimum, the number of times individual that is not directly related to a
‘‘(4) DEBARMENT OF FEDERAL CONTRAC- the Director— cybersecurity threat.
TORS.—If a covered entity that is a Federal ‘‘(1) issued an initial request for informa- ‘‘(4) DIGITAL SECURITY.—The Center and the
contractor fails to comply with a subpoena tion pursuant to subsection (b); or Agency shall ensure that reports submitted
issued under this subsection— ‘‘(2) issued a subpoena pursuant to sub- to the Center or the Agency pursuant to sec-
‘‘(A) the Director may refer the matter to section (c). tion 2232, and any information contained in
the Administrator of General Services; and ‘‘(i) ANONYMIZATION OF REPORTS.—The Di- those reports, are collected, stored, and pro-
‘‘(B) upon receiving a referral from the Di- rector shall ensure any victim information tected at a minimum in accordance with the
rector, the Administrator of General Serv- contained in a report required to be pub- requirements for moderate impact Federal
ices may impose additional available pen- lished under subsection (h) be anonymized information systems, as described in Federal
alties, including suspension or debarment. before the report is published. Information Processing Standards Publica-
‘‘(5) AUTHENTICATION.— ‘‘SEC. 2235. INFORMATION SHARED WITH OR PRO- tion 199, or any successor document.
‘‘(A) IN GENERAL.—Any subpoena issued VIDED TO THE FEDERAL GOVERN- ‘‘(5) PROHIBITION ON USE OF INFORMATION IN
electronically pursuant to this subsection MENT.
REGULATORY ACTIONS.—A Federal, State,
shall be authenticated with a cryptographic ‘‘(a) DISCLOSURE, RETENTION, AND USE.— local, or Tribal government shall not use in-
digital signature of an authorized represent- ‘‘(1) AUTHORIZED ACTIVITIES.—Information formation about a covered cyber incident or
ative of the Agency, or other comparable provided to the Center or Agency pursuant ransom payment obtained solely through re-
successor technology, that allows the Agen- to section 2232 or 2233 may be disclosed to, porting directly to the Center or the Agency
cy to demonstrate that such subpoena was retained by, and used by, consistent with in accordance with this subtitle to regulate,
issued by the Agency and has not been al- otherwise applicable provisions of Federal including through an enforcement action,
tered or modified since such issuance. law, any Federal agency or department, com- the activities of the covered entity or entity
‘‘(B) INVALID IF NOT AUTHENTICATED.—Any ponent, officer, employee, or agent of the that made a ransom payment.
subpoena issued electronically pursuant to Federal Government solely for— ‘‘(b) NO WAIVER OF PRIVILEGE OR PROTEC-
this subsection that is not authenticated in ‘‘(A) a cybersecurity purpose; TION.—The submission of a report to the Cen-
accordance with subparagraph (A) shall not ‘‘(B) the purpose of identifying— ter or the Agency under section 2232 shall
ctelli on DSK11ZRN23PROD with SENATE
be considered to be valid by the recipient of ‘‘(i) a cyber threat, including the source of not constitute a waiver of any applicable
such subpoena. the cyber threat; or privilege or protection provided by law, in-
‘‘(d) ACTIONS BY ATTORNEY GENERAL AND ‘‘(ii) a security vulnerability; cluding trade secret protection and attorney-
FEDERAL REGULATORY AGENCIES.— ‘‘(C) the purpose of responding to, or other- client privilege.
‘‘(1) IN GENERAL.—Notwithstanding section wise preventing or mitigating, a specific ‘‘(c) EXEMPTION FROM DISCLOSURE.—Infor-
2235(a) and subsection (b)(2) of this section, if threat of death, a specific threat of serious mation contained in a report submitted to
the Attorney General or the appropriate bodily harm, or a specific threat of serious the Office under section 2232 shall be exempt
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00079 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8486 CONGRESSIONAL RECORD — SENATE November 18, 2021
from disclosure under section 552(b)(3)(B) of SEC. 6104. FEDERAL SHARING OF INCIDENT RE- duplicative, or burdensome requirements;
title 5, United States Code (commonly PORTS. and
known as the ‘Freedom of Information Act’) (a) CYBER INCIDENT REPORTING SHARING.— (2) coordinate with the Director, the Attor-
and any State, Tribal, or local provision of (1) IN GENERAL.—Notwithstanding any ney General, and regulatory authorities that
law requiring disclosure of information or other provision of law or regulation, any receive reports relating to cyber incidents to
records. Federal agency, including any independent identify opportunities to streamline report-
‘‘(d) EX PARTE COMMUNICATIONS.—The sub- establishment (as defined in section 104 of ing processes, and where feasible, facilitate
mission of a report to the Agency under sec- title 5, United States Code), that receives a interagency agreements between such au-
tion 2232 shall not be subject to a rule of any report from an entity of a cyber incident, in- thorities to permit the sharing of such re-
Federal agency or department or any judi- cluding a ransomware attack, shall provide ports, consistent with applicable law and
cial doctrine regarding ex parte communica- the report to the Director as soon as pos- policy, without impacting the ability of such
tions with a decision-making official. sible, but not later than 24 hours after re- agencies to gain timely situational aware-
‘‘(e) LIABILITY PROTECTIONS.— ceiving the report, unless a shorter period is ness of a covered cyber incident or ransom
‘‘(1) IN GENERAL.—No cause of action shall required by an agreement made between the payment.
lie or be maintained in any court by any per- Cybersecurity Infrastructure Security Agen- SEC. 6105. RANSOMWARE VULNERABILITY WARN-
son or entity and any such action shall be cy and the recipient Federal agency. The Di- ING PILOT PROGRAM.
promptly dismissed for the submission of a rector shall share and coordinate each report (a) PROGRAM.—Not later than 1 year after
report pursuant to section 2232(a) that is sub- pursuant to section 2231(b) of the Homeland the date of enactment of this Act, the Direc-
mitted in conformance with this subtitle and Security Act of 2002, as added by section 6103 tor shall establish a ransomware vulner-
the rule promulgated under section 2232(b), of this title. ability warning program to leverage existing
except that this subsection shall not apply (2) RULE OF CONSTRUCTION.—The require- authorities and technology to specifically
with regard to an action by the Federal Gov- ments described in paragraph (1) shall not be develop processes and procedures for, and to
ernment pursuant to section 2234(c)(2). construed to be a violation of any provision dedicate resources to, identifying informa-
‘‘(2) SCOPE.—The liability protections pro- of law or policy that would otherwise pro- tion systems that contain security
vided in subsection (e) shall only apply to or hibit disclosure within the executive branch. vulnerabilities associated with common
affect litigation that is solely based on the (3) PROTECTION OF INFORMATION.—The Di- ransomware attacks, and to notify the own-
submission of a covered cyber incident re- rector shall comply with any obligations of ers of those vulnerable systems of their secu-
port or ransom payment report to the Center the recipient Federal agency described in rity vulnerability.
or the Agency. paragraph (1) to protect information, includ- (b) IDENTIFICATION OF VULNERABLE SYS-
‘‘(3) RESTRICTIONS.—Notwithstanding para- ing with respect to privacy, confidentiality, TEMS.—The pilot program established under
graph (2), no report submitted to the Agency or information security, if those obligations subsection (a) shall—
pursuant to this subtitle or any communica- would impose greater protection require- (1) identify the most common security
tion, document, material, or other record, ments than this Act or the amendments vulnerabilities utilized in ransomware at-
created for the sole purpose of preparing, made by this Act. tacks and mitigation techniques; and
drafting, or submitting such report, may be (4) FOIA EXEMPTION.—Any report received (2) utilize existing authorities to identify
received in evidence, subject to discovery, or by the Director pursuant to paragraph (1) Federal and other relevant information sys-
otherwise used in any trial, hearing, or other shall be exempt from disclosure under sec- tems that contain the security
proceeding in or before any court, regulatory tion 552(b)(3) of title 5, United States Code vulnerabilities identified in paragraph (1).
body, or other authority of the United (commonly known as the ‘‘Freedom of Infor- (c) ENTITY NOTIFICATION.—
States, a State, or a political subdivision mation Act’’). (1) IDENTIFICATION.—If the Director is able
thereof, provided that nothing in this sub- (b) CREATION OF COUNCIL.—Section 1752(c)
to identify the entity at risk that owns or
title shall create a defense to discovery or of the William M. (Mac) Thornberry National
operates a vulnerable information system
otherwise affect the discovery of any com- Defense Authorization Act for Fiscal Year
identified in subsection (b), the Director may
munication, document, material, or other 2021 (6 U.S.C. 1500(c)) is amended—
notify the owner of the information system.
record not created for the sole purpose of (1) in paragraph (1)—
(2) NO IDENTIFICATION.—If the Director is
preparing, drafting, or submitting such re- (A) in subparagraph (G), by striking ‘‘and’’
not able to identify the entity at risk that
port. at the end;
owns or operates a vulnerable information
‘‘(f) SHARING WITH NON-FEDERAL ENTI- (B) by redesignating subparagraph (H) as
system identified in subsection (b), the Di-
TIES.—The Agency shall anonymize the vic- subparagraph (I); and
rector may utilize the subpoena authority
tim who reported the information when (C) by inserting after subparagraph (G) the
pursuant to section 2209 of the Homeland Se-
making information provided in reports re- following:
curity Act of 2002 (6 U.S.C. 659) to identify
ceived under section 2232 available to critical ‘‘(H) lead an intergovernmental Cyber Inci-
and notify the entity at risk pursuant to the
infrastructure owners and operators and the dent Reporting Council, in coordination with
procedures within that section.
general public. the Director of the Office of Management
(3) REQUIRED INFORMATION.—A notification
‘‘(g) PROPRIETARY INFORMATION.—Informa- and Budget, the Attorney General, and the
made under paragraph (1) shall include infor-
tion contained in a report submitted to the Director of the Cybersecurity and Infrastruc-
mation on the identified security vulner-
Agency under section 2232 shall be consid- ture Security Agency and in consultation
ability and mitigation techniques.
ered the commercial, financial, and propri- with Sector Risk Management Agencies (as
(d) PRIORITIZATION OF NOTIFICATIONS.—To
etary information of the covered entity when defined in section 2201 of the Homeland Secu-
the extent practicable, the Director shall
so designated by the covered entity. rity Act of 2002 (6 U.S.C. 651)) and other ap-
‘‘(h) STORED COMMUNICATIONS ACT.—Noth- prioritize covered entities for identification
propriate Federal agencies, to coordinate,
ing in this subtitle shall be construed to per- and notification activities under the pilot
deconflict, and harmonize Federal incident
mit or require disclosure by a provider of a program established under this section.
reporting requirements, including those
remote computing service or a provider of an (e) LIMITATION ON PROCEDURES.—No proce-
issued through regulations, for covered enti-
electronic communication service to the dure, notification, or other authorities uti-
ties (as defined in section 2230 of such Act)
public of information not otherwise per- lized in the execution of the pilot program
and entities that make a ransom payment
mitted or required to be disclosed under established under subsection (a) shall require
(as defined in such section 2201 (6 U.S.C.
chapter 121 of title 18, United States Code an owner or operator of a vulnerable infor-
651)); and’’; and
(commonly known as the ‘Stored Commu- mation system to take any action as a result
(2) by adding at the end the following:
nications Act’).’’. of a notice of a security vulnerability made
‘‘(3) RULE OF CONSTRUCTION.—Nothing in
(b) TECHNICAL AND CONFORMING AMEND- pursuant to subsection (c).
paragraph (1)(H) shall be construed to pro-
MENT.—The table of contents in section 1(b) (f) RULE OF CONSTRUCTION.—Nothing in this
vide any additional regulatory authority to
of the Homeland Security Act of 2002 (Public section shall be construed to provide addi-
any Federal entity.’’.
Law 107–296; 116 Stat. 2135) is amended by in- (c) HARMONIZING REPORTING REQUIRE- tional authorities to the Director to identify
serting after the items relating to subtitle B MENTS.—The National Cyber Director shall, vulnerabilities or vulnerable systems.
of title XXII the following: in consultation with the Director, the Attor- (g) TERMINATION.—The pilot program es-
‘‘Subtitle C—Cyber Incident Reporting ney General, the Cyber Incident Reporting tablished under subsection (a) shall termi-
Council described in section 1752(c)(1)(H) of nate on the date that is 4 years after the
‘‘Sec. 2230. Definitions. date of enactment of this Act.
‘‘Sec. 2231. Cyber Incident Review. the William M. (Mac) Thornberry National
‘‘Sec. 2232. Required reporting of certain Defense Authorization Act for Fiscal Year SEC. 6106. RANSOMWARE THREAT MITIGATION
2021 (6 U.S.C. 1500(c)(1)(H)), and the Director ACTIVITIES.
cyber incidents.
ctelli on DSK11ZRN23PROD with SENATE
‘‘Sec. 2233. Voluntary reporting of other of the Office of Management and Budget, to (a) JOINT RANSOMWARE TASK FORCE.—
cyber incidents. the maximum extent practicable— (1) IN GENERAL.—Not later than 180 days
‘‘Sec. 2234. Noncompliance with required re- (1) periodically review existing regulatory after the date of enactment of this Act, the
porting. requirements, including the information re- National Cyber Director, in consultation
‘‘Sec. 2235. Information shared with or pro- quired in such reports, to report cyber inci- with the Attorney General and the Director
vided to the Federal Govern- dents and ensure that any such reporting re- of the Federal Bureau of Investigation, shall
ment.’’. quirements and procedures avoid conflicting, establish and chair the Joint Ransomware
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00080 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8487
Task Force to coordinate an ongoing nation- this Act, the Director shall submit to the curity of the House of Representatives a re-
wide campaign against ransomware attacks, Committee on Homeland Security and Gov- port on the exemptions to reporting under
and identify and pursue opportunities for ernmental Affairs of the Senate and the paragraphs (2) and (5) of section 2232(a) of the
international cooperation. Committee on Homeland Security of the Homeland Security Act of 2002, as added by
(2) COMPOSITION.—The Joint Ransomware House of Representatives a report describing section 6103 of this title, which shall in-
Task Force shall consist of participants from how the National Cybersecurity and Commu- clude—
Federal agencies, as determined appropriate nications Integration Center established (A) to the extent practicable, an evalua-
by the National Cyber Director in consulta- under section 2209 of the Homeland Security tion of the quantity of incidents not reported
tion with the Secretary of Homeland Secu- Act of 2002 (6 U.S.C. 659) has carried out ac- to the Federal Government;
rity. tivities under section 2231(a)(9) of the Home- (B) an evaluation of the impact on im-
(3) RESPONSIBILITIES.—The Joint land Security Act of 2002, as added by section pacted entities, homeland security, and the
Ransomware Task Force, utilizing only ex- 6103(a) of this title, by proactively identi- national economy of the ransomware crimi-
isting authorities of each participating agen- fying opportunities to use cyber incident nal ecosystem of incidents and ransom pay-
cy, shall coordinate across the Federal Gov- data to inform and enable cybersecurity re- ments, including a discussion on the scope of
ernment the following activities: search within the academic and private sec- impact of incidents that were not reported to
(A) Prioritization of intelligence-driven op- tor. the Federal Government;
erations to disrupt specific ransomware ac- (c) REPORT ON RANSOMWARE VULNERABILITY (C) an evaluation of the burden, financial
tors. WARNING PILOT PROGRAM.—Not later than 1 and otherwise, on entities required to report
(B) Consult with relevant private sector, year after the date of enactment of this Act, cyber incidents under this Act, including an
State, local, Tribal, and territorial govern- and annually thereafter for the duration of analysis of entities that meet the definition
ments and international stakeholders to the pilot program established under section
of a small organization and would be exempt
6105, the Director shall submit to the Com-
identify needs and establish mechanisms for from ransom payment reporting but not for
mittee on Homeland Security and Govern-
providing input into the Task Force. being a covered entity; and
mental Affairs of the Senate and the Com-
(C) Identifying, in consultation with rel- (D) a description of the consequences and
mittee on Homeland Security of the House of
evant entities, a list of highest threat effects of the exemptions.
Representatives a report, which may include
ransomware entities updated on an ongoing (f) REPORT ON EFFECTIVENESS OF ENFORCE-
a classified annex, on the effectiveness of the
basis, in order to facilitate— MENT MECHANISMS.—Not later than 1 year
pilot program, which shall include a discus-
(i) prioritization for Federal action by ap- after the date on which the Director issues
sion of the following:
propriate Federal agencies; and the final rule required under section 2232(b)
(1) The effectiveness of the notifications
(ii) identify metrics for success of said ac- of the Homeland Security Act of 2002, as
under section 6105(c) in mitigating security
tions. added by section 6103 of this title, the Direc-
vulnerabilities and the threat of
(D) Disrupting ransomware criminal ac- tor shall submit to the Committee on Home-
ransomware.
tors, associated infrastructure, and their fi- land Security and Governmental Affairs of
(2) Identification of the most common
nances. the Senate and the Committee on Homeland
vulnerabilities utilized in ransomware.
(E) Facilitating coordination and collabo- Security of the House of Representatives a
(3) The number of notifications issued dur-
ration between Federal entities and relevant report on the effectiveness of the enforce-
ing the preceding year.
entities, including the private sector, to im- ment mechanisms within section 2234 of the
(4) To the extent practicable, the number
prove Federal actions against ransomware Homeland Security Act of 2002, as added by
of vulnerable devices or systems mitigated
threats. section 6103 of this title.
under this pilot by the Agency during the
(F) Collection, sharing, and analysis of TITLE LXII—CISA TECHNICAL CORREC-
preceding year.
ransomware trends to inform Federal ac- (d) REPORT ON HARMONIZATION OF REPORT- TIONS AND IMPROVEMENTS ACT OF 2021
tions. ING REGULATIONS.—
(G) Creation of after-action reports and SEC. 6201. SHORT TITLE.
(1) IN GENERAL.—Not later than 180 days
other lessons learned from Federal actions This title may be cited as the ‘‘CISA Tech-
after the date on which the National Cyber
that identify successes and failures to im- nical Corrections and Improvements Act of
Director convenes the Council described in
prove subsequent actions. 2021’’.
section 1752(c)(1)(H) of the William M. (Mac)
(H) Any other activities determined appro- Thornberry National Defense Authorization SEC. 6202. REDESIGNATIONS.
priate by the task force to mitigate the Act for Fiscal Year 2021 (6 U.S.C. (a) IN GENERAL.—Subtitle A of title XXII of
threat of ransomware attacks against Fed- 1500(c)(1)(H)), the National Cyber Director the Homeland Security Act of 2002 (6 U.S.C.
eral and non-Federal entities. shall submit to the appropriate congres- 651 et seq.) is amended—
(b) CLARIFYING PRIVATE SECTOR LAWFUL sional committees a report that includes— (1) by redesignating section 2217 (6 U.S.C.
DEFENSIVE MEASURES.—Not later than 180 (A) a list of duplicative Federal cyber inci- 665f) as section 2220;
days after the date of enactment of this Act, dent reporting requirements on covered enti- (2) by redesignating section 2216 (6 U.S.C.
the National Cyber Director, in coordination ties and entities that make a ransom pay- 665e) as section 2219;
with the Secretary of Homeland Security ment; (3) by redesignating the fourth section 2215
and the Attorney General, shall submit to (B) a description of any challenges in har- (relating to Sector Risk Management Agen-
the Committee on Homeland Security and monizing the duplicative reporting require- cies) (6 U.S.C. 665d) as section 2218;
Governmental Affairs and the Committee on ments; (4) by redesignating the third section 2215
the Judiciary of the Senate and the Com- (C) any actions the National Cyber Direc- (relating to the Cybersecurity State Coordi-
mittee on Homeland Security, the Com- tor intends to take to facilitate harmonizing nator) (6 U.S.C. 665c) as section 2217; and
mittee on the Judiciary, and the Committee the duplicative reporting requirements; and (5) by redesignating the second section 2215
on Oversight and Reform of the House of (D) any proposed legislative changes nec- (relating to the Joint Cyber Planning Office)
Representatives a report that describes de- essary to address the duplicative reporting. (6 U.S.C. 665b) as section 2216.
fensive measures that private sector actors (2) RULE OF CONSTRUCTION.—Nothing in (b) TECHNICAL AND CONFORMING AMEND-
can take when countering ransomware at- paragraph (1) shall be construed to provide MENTS.—Section 2202(c) of the Homeland Se-
tacks and what laws need to be clarified to any additional regulatory authority to any curity Act of 2002 (6 U.S.C. 652(c)) is amend-
enable that action. Federal agency. ed—
(c) RULE OF CONSTRUCTION.—Nothing in (e) GAO REPORTS.— (1) in paragraph (11), by striking ‘‘and’’ at
this section shall be construed to provide (1) IMPLEMENTATION OF THIS ACT.—Not later the end;
any additional authority to any Federal than 2 years after the date of enactment of (2) in the first paragraph (12)—
agency. this Act, the Comptroller General of the (A) by striking ‘‘section 2215’’ and insert-
SEC. 6107. CONGRESSIONAL REPORTING. United States shall submit to the Committee ing ‘‘section 2217’’; and
(a) REPORT ON STAKEHOLDER ENGAGE- on Homeland Security and Governmental Af- (B) by striking ‘‘and’’ at the end; and
MENT.—Not later than 30 days after the date fairs of the Senate and the Committee on (3) by redesignating the second and third
on which the Director issues the final rule Homeland Security of the House of Rep- paragraphs (12) as paragraphs (13) and (14),
under section 2232(b) of the Homeland Secu- resentatives a report on the implementation respectively.
rity Act of 2002, as added by section 6103(b) of of this Act and the amendments made by (c) ADDITIONAL TECHNICAL AMENDMENT.—
this title, the Director shall submit to the this Act. (1) AMENDMENT.—Section 904(b)(1) of the
Committee on Homeland Security and Gov- (2) EXEMPTIONS TO REPORTING.—Not later DOTGOV Act of 2020 (title IX of division U of
ernmental Affairs of the Senate and the than 1 year after the date on which the Di- Public Law 116–260) is amended, in the mat-
ctelli on DSK11ZRN23PROD with SENATE
Committee on Homeland Security of the rector issues the final rule required under ter preceding subparagraph (A), by striking
House of Representatives a report that de- section 2232(b) of the Homeland Security Act ‘‘Homeland Security Act’’ and inserting
scribes how the Director engaged stake- of 2002, as added by section 6103 of this title, ‘‘Homeland Security Act of 2002’’.
holders in the development of the final rule. the Comptroller General of the United States (2) EFFECTIVE DATE.—The amendment
(b) REPORT ON OPPORTUNITIES TO shall submit to the Committee on Homeland made by paragraph (1) shall take effect as if
STRENGTHEN SECURITY RESEARCH.—Not later Security and Governmental Affairs of the enacted as part of the DOTGOV Act of 2020
than 1 year after the date of enactment of Senate and the Committee on Homeland Se- (title IX of division U of Public Law 116–260).
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00081 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8488 CONGRESSIONAL RECORD — SENATE November 18, 2021
SEC. 6203. CONSOLIDATION OF DEFINITIONS. trol or exploitation of a security vulner- formal or informal entity or collaboration
(a) IN GENERAL.—Title XXII of the Home- ability; created or employed by public or private sec-
land Security Act of 2002 (6 U.S.C. 651) is ‘‘(E) malicious cyber command and con- tor organizations, for purposes of—
amended by inserting before the subtitle A trol; ‘‘(A) gathering and analyzing critical infra-
heading the following: ‘‘(F) the actual or potential harm caused structure information, including informa-
‘‘SEC. 2200. DEFINITIONS. by an incident, including a description of the tion related to cybersecurity risks and inci-
‘‘Except as otherwise specifically provided, information exfiltrated as a result of a par- dents, in order to better understand security
in this title: ticular cybersecurity threat; problems and interdependencies related to
‘‘(1) AGENCY.—The term ‘Agency’ means ‘‘(G) any other attribute of a cybersecurity critical infrastructure, including cybersecu-
the Cybersecurity and Infrastructure Secu- threat, if disclosure of such attribute is not rity risks and incidents, and protected sys-
rity Agency. otherwise prohibited by law; or tems, so as to ensure the availability, integ-
‘‘(2) AGENCY INFORMATION.—The term ‘‘(H) any combination thereof. rity, and reliability thereof;
‘agency information’ means information col- ‘‘(8) CYBERSECURITY PURPOSE.—The term ‘‘(B) communicating or disclosing critical
lected or maintained by or on behalf of an ‘cybersecurity purpose’ means the purpose of infrastructure information, including cyber-
agency. protecting an information system or infor- security risks and incidents, to help prevent,
mation that is stored on, processed by, or detect, mitigate, or recover from the effects
‘‘(3) AGENCY INFORMATION SYSTEM.—The
transiting an information system from a cy- of a interference, compromise, or a incapaci-
term ‘agency information system’ means an
bersecurity threat or security vulnerability. tation problem related to critical infrastruc-
information system used or operated by an
‘‘(9) CYBERSECURITY RISK.—The term ‘cy- ture, including cybersecurity risks and inci-
agency or by another entity on behalf of an
bersecurity risk’— dents, or protected systems; and
agency.
‘‘(A) means threats to and vulnerabilities ‘‘(C) voluntarily disseminating critical in-
‘‘(4) APPROPRIATE CONGRESSIONAL COMMIT-
of information or information systems and frastructure information, including cyberse-
TEES.—The term ‘appropriate congressional
any related consequences caused by or re- curity risks and incidents, to its members,
committees’ means—
sulting from unauthorized access, use, dis- State, local, and Federal Governments, or
‘‘(A) the Committee on Homeland Security
closure, degradation, disruption, modifica- any other entities that may be of assistance
and Governmental Affairs of the Senate; and
tion, or destruction of such information or in carrying out the purposes specified in sub-
‘‘(B) the Committee on Homeland Security information systems, including such related paragraphs (A) and (B).
of the House of Representatives. consequences caused by an act of terrorism; ‘‘(15) INFORMATION SYSTEM.—The term ‘in-
‘‘(5) CLOUD SERVICE PROVIDER.—The term and formation system’ has the meaning given the
‘cloud service provider’ means an entity of- ‘‘(B) does not include any action that sole- term in section 3502 of title 44, United States
fering products or services related to cloud ly involves a violation of a consumer term of Code.
computing, as defined by the National Insti- service or a consumer licensing agreement. ‘‘(16) INTELLIGENCE COMMUNITY.—The term
tutes of Standards and Technology in NIST ‘‘(10) CYBERSECURITY THREAT.— ‘intelligence community’ has the meaning
Special Publication 800–145 and any amend- ‘‘(A) IN GENERAL.—Except as provided in given the term in section 3(4) of the National
atory or superseding document relating subparagraph (B), the term ‘cybersecurity Security Act of 1947 (50 U.S.C. 3003(4)).
thereto. threat’ means an action, not protected by ‘‘(17) MANAGED SERVICE PROVIDER.—The
‘‘(6) CRITICAL INFRASTRUCTURE INFORMA- the First Amendment to the Constitution of term ‘managed service provider’ means an
TION.—The term ‘critical infrastructure in- the United States, on or through an informa- entity that delivers services, such as net-
formation’ means information not custom- tion system that may result in an unauthor- work, application, infrastructure, or security
arily in the public domain and related to the ized effort to adversely impact the security, services, via ongoing and regular support and
security of critical infrastructure or pro- availability, confidentiality, or integrity of active administration on the premises of a
tected systems, including— an information system or information that customer, in the data center of the entity
‘‘(A) actual, potential, or threatened inter- is stored on, processed by, or transiting an (such as hosting), or in a third party data
ference with, attack on, compromise of, or information system. center.
incapacitation of critical infrastructure or ‘‘(B) EXCLUSION.—The term ‘cybersecurity ‘‘(18) MONITOR.—The term ‘monitor’ means
protected systems by either physical or com- threat’ does not include any action that sole- to acquire, identify, or scan, or to possess,
puter-based attack or other similar conduct ly involves a violation of a consumer term of information that is stored on, processed by,
(including the misuse of or unauthorized ac- service or a consumer licensing agreement. or transiting an information system.
cess to all types of communications and data ‘‘(11) DEFENSIVE MEASURE.— ‘‘(19) NATIONAL CYBERSECURITY ASSET RE-
transmission systems) that violates Federal, ‘‘(A) IN GENERAL.—Except as provided in SPONSE ACTIVITIES.—The term ‘national cy-
State, or local law, harms interstate com- subparagraph (B), the term ‘defensive meas- bersecurity asset response activities’
merce of the United States, or threatens ure’ means an action, device, procedure, sig- means—
public health or safety; nature, technique, or other measure applied ‘‘(A) furnishing cybersecurity technical as-
‘‘(B) the ability of any critical infrastruc- to an information system or information sistance to entities affected by cybersecurity
ture or protected system to resist such inter- that is stored on, processed by, or transiting risks to protect assets, mitigate
ference, compromise, or incapacitation, in- an information system that detects, pre- vulnerabilities, and reduce impacts of cyber
cluding any planned or past assessment, pro- vents, or mitigates a known or suspected cy- incidents;
jection, or estimate of the vulnerability of bersecurity threat or security vulnerability. ‘‘(B) identifying other entities that may be
critical infrastructure or a protected system, ‘‘(B) EXCLUSION.—The term ‘defensive at risk of an incident and assessing risk to
including security testing, risk evaluation measure’ does not include a measure that de- the same or similar vulnerabilities;
thereto, risk management planning, or risk stroys, renders unusable, provides unauthor- ‘‘(C) assessing potential cybersecurity
audit; or ized access to, or substantially harms an in- risks to a sector or region, including poten-
‘‘(C) any planned or past operational prob- formation system or information stored on, tial cascading effects, and developing courses
lem or solution regarding critical infrastruc- processed by, or transiting such information of action to mitigate such risks;
ture or protected systems, including repair, system not owned by— ‘‘(D) facilitating information sharing and
recovery, reconstruction, insurance, or con- ‘‘(i) the entity operating the measure; or operational coordination with threat re-
tinuity, to the extent it is related to such in- ‘‘(ii) another entity or Federal entity that sponse; and
terference, compromise, or incapacitation. is authorized to provide consent and has pro- ‘‘(E) providing guidance on how best to uti-
‘‘(7) CYBER THREAT INDICATOR.—The term vided consent to that private entity for oper- lize Federal resources and capabilities in a
‘cyber threat indicator’ means information ation of such measure. timely, effective manner to speed recovery
that is necessary to describe or identify— ‘‘(12) HOMELAND SECURITY ENTERPRISE.— from cybersecurity risks.
‘‘(A) malicious reconnaissance, including The term ‘Homeland Security Enterprise’ ‘‘(20) NATIONAL SECURITY SYSTEM.—The
anomalous patterns of communications that means relevant governmental and non- term ‘national security system’ has the
appear to be transmitted for the purpose of governmental entities involved in homeland meaning given the term in section 11103 of
gathering technical information related to a security, including Federal, State, local, and title 40, United States Code.
cybersecurity threat or security vulner- Tribal government officials, private sector ‘‘(21) RANSOM PAYMENT.—The term ‘ransom
ability; representatives, academics, and other policy payment’ means the transmission of any
‘‘(B) a method of defeating a security con- experts. money or other property or asset, including
trol or exploitation of a security vulner- ‘‘(13) INCIDENT.—The term ‘incident’ means virtual currency, or any portion thereof,
ability; an occurrence that actually or imminently which has at any time been delivered as ran-
‘‘(C) a security vulnerability, including jeopardizes, without lawful authority, the in- som in connection with a ransomware at-
ctelli on DSK11ZRN23PROD with SENATE
anomalous activity that appears to indicate tegrity, confidentiality, or availability of in- tack.
the existence of a security vulnerability; formation on an information system, or ac- ‘‘(22) RANSOMWARE ATTACK.—The term
‘‘(D) a method of causing a user with le- tually or imminently jeopardizes, without ‘ransomware attack’—
gitimate access to an information system or lawful authority, an information system. ‘‘(A) means a cyber incident that includes
information that is stored on, processed by, ‘‘(14) INFORMATION SHARING AND ANALYSIS the use or threat of use of unauthorized or
or transiting an information system to un- ORGANIZATION.—The term ‘Information Shar- malicious code on an information system, or
wittingly enable the defeat of a security con- ing and Analysis Organization’ means any the use or threat of use of another digital
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00082 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8489
mechanism such as a denial of service at- (B) by redesignating subsections (b) ation’ means the use of a defensive meas-
tack, to interrupt or disrupt the operations through (o) as subsections (a) through (n), ure.’’;
of an information system or compromise the respectively; (11) in section 2218(c)(4)(A), as so redesig-
confidentiality, availability, or integrity of (C) in subsection (c)(1)— nated, by striking ‘‘information sharing and
electronic data stored on, processed by, or (i) in subparagraph (A)(iii), as so redesig- analysis organizations’’ and inserting ‘‘Infor-
transiting an information system to extort a nated, by striking ‘‘, as that term is defined mation Sharing and Analysis Organiza-
demand for a ransom payment; and under section 3(4) of the National Security tions’’; and
‘‘(B) does not include any such event where Act of 1947 (50 U.S.C. 3003(4))’’; and (12) in section 2222—
the demand for payment is made by a Fed- (ii) in subparagraph (B)(ii), by striking ‘‘in- (A) by striking paragraphs (3), (5), and (8);
eral Government entity, good faith security formation sharing and analysis organiza- (B) by redesignating paragraph (4) as para-
research, or in response to an invitation by tions’’ and inserting ‘‘Information Sharing graph (3); and
the owner or operator of the information and Analysis Organizations’’; (C) by redesignating paragraphs (6) and (7)
system for third parties to identify (D) in subsection (d), as so redesignated— as paragraphs (4) and (5), respectively.
vulnerabilities in the information system. (i) in the matter preceding paragraph (1), (c) TABLE OF CONTENTS AMENDMENTS.—The
‘‘(23) SECTOR RISK MANAGEMENT AGENCY.— by striking ‘‘subsection (c)’’ and inserting table of contents in section 1(b) of the Home-
The term ‘Sector Risk Management Agency’ ‘‘subsection (b)’’; and land Security Act of 2002 (Public Law 107–296;
means a Federal department or agency, des- (ii) in paragraph (1)(E)(ii)(II), by striking 116 Stat. 2135) is amended—
ignated by law or Presidential directive, ‘‘information sharing and analysis organiza- (1) by inserting before the item relating to
with responsibility for providing institu- tions’’ and inserting ‘‘Information Sharing subtitle A of title XXII the following:
tional knowledge and specialized expertise of and Analysis Organizations’’; ‘‘Sec. 2200. Definitions.’’;
a sector, as well as leading, facilitating, or (E) in subsection (j), as so redesignated, by (2) by striking the item relating to section
supporting programs and associated activi- striking ‘‘subsection (c)(8)’’ and inserting 2201 and inserting the following:
ties of its designated critical infrastructure ‘‘subsection (b)(8)’’; and ‘‘Sec. 2201. Definition.’’; and
sector in the all hazards environment in co- (F) in subsection (n), as so redesignated— (3) by striking the item relating to section
ordination with the Department. (i) in paragraph (2)(A), by striking ‘‘sub- 2214 and all that follows through the item re-
‘‘(24) SECURITY CONTROL.—The term ‘secu- section (c)(12)’’ and inserting ‘‘subsection lating to section 2217 and inserting the fol-
rity control’ means the management, oper- (b)(12)’’; and lowing:
ational, and technical controls used to pro- (ii) in paragraph (3)(B)(i), by striking ‘‘sub- ‘‘Sec. 2214. National Asset Database.
tect against an unauthorized effort to ad- section (c)(12)’’ and inserting ‘‘subsection ‘‘Sec. 2215. Duties and authorities relating
versely affect the confidentiality, integrity, (b)(12)’’; to .gov internet domain.
and availability of an information system or (6) in section 2210— ‘‘Sec. 2216. Joint Cyber Planning Office.
its information. (A) by striking subsection (a); ‘‘Sec. 2217. Cybersecurity State Coordinator.
‘‘(25) SECURITY VULNERABILITY.—The term (B) by redesignating subsections (b) ‘‘Sec. 2218. Sector Risk Management Agen-
‘security vulnerability’ means any attribute through (d) as subsections (a) through (c), re- cies.
of hardware, software, process, or procedure spectively; ‘‘Sec. 2219. Cybersecurity Advisory Com-
that could enable or facilitate the defeat of (C) in subsection (b), as so redesignated— mittee.
‘‘Sec. 2220. Cybersecurity Education and
a security control. (i) by striking ‘‘information sharing and
Training Programs.’’.
‘‘(26) SHARING.—The term ‘sharing’ (includ- analysis organizations (as defined in section
(d) CYBERSECURITY ACT OF 2015 DEFINI-
ing all conjugations thereof) means pro- 2222(5))’’ and inserting ‘‘Information Sharing TIONS.—Section 102 of the Cybersecurity Act
viding, receiving, and disseminating (includ- and Analysis Organizations’’; and of 2015 (6 U.S.C. 1501) is amended—
ing all conjugations of each such terms). (ii) by striking ‘‘(as defined in section (1) by striking paragraphs (4) through (7)
‘‘(27) SUPPLY CHAIN COMPROMISE.—The term 2209)’’; and and inserting the following:
‘supply chain compromise’ means a cyber in- (D) in subsection (c), as so redesignated, by ‘‘(4) CYBERSECURITY PURPOSE.—The term
cident within the supply chain of an infor- striking ‘‘subsection (c)’’ and inserting ‘‘sub- ‘cybersecurity purpose’ has the meaning
mation system that an adversary can lever- section (b)’’; given the term in section 2200 of the Home-
age to jeopardize the confidentiality, integ- (7) in section 2211, by striking subsection land Security Act of 2002.
rity, or availability of the information tech- (h); ‘‘(5) CYBERSECURITY THREAT.—The term
nology system or the information the system (8) in section 2212, by striking ‘‘informa- ‘cybersecurity threat’ has the meaning given
processes, stores, or transmits, and can tion sharing and analysis organizations (as the term in section 2200 of the Homeland Se-
occur at any point during the life cycle. defined in section 2222(5))’’ and inserting ‘‘In- curity Act of 2002.
‘‘(28) VIRTUAL CURRENCY.—The term ‘vir- formation Sharing and Analysis Organiza- ‘‘(6) CYBER THREAT INDICATOR.—The term
tual currency’ means the digital representa- tions’’; ‘cyber threat indicator’ has the meaning
tion of value that functions as a medium of (9) in section 2213— given the term in section 2200 of the Home-
exchange, a unit of account, or a store of (A) by striking subsection (a); land Security Act of 2002.
value. (B) by redesignating subsections (b) ‘‘(7) DEFENSIVE MEASURE.—The term ‘defen-
‘‘(29) VIRTUAL CURRENCY ADDRESS.—The through (f) as subsections (a) through (e); re- sive measure’ has the meaning given the
term ‘virtual currency address’ means a spectively; term in section 2200 of the Homeland Secu-
unique public cryptographic key identifying (C) in subsection (b), as so redesignated, by rity Act of 2002.’’;
the location to which a virtual currency pay- striking ‘‘subsection (b)’’ each place it ap- (2) by striking paragraph (13) and inserting
ment can be made.’’. pears and inserting ‘‘subsection (a)’’; the following:
(b) TECHNICAL AND CONFORMING AMEND- (D) in subsection (c), as so redesignated, in ‘‘(13) MONITOR.— The term ‘monitor’ has
MENTS.—The Homeland Security Act of 2002 the matter preceding paragraph (1), by strik- the meaning given the term in section 2200 of
(6 U.S.C. 101 et seq.) is amended— ing ‘‘subsection (b)’’ and inserting ‘‘sub- the Homeland Security Act of 2002.’’; and
(1) by amending section 2201 to read as fol- section (a)’’; and (3) by striking paragraphs (16) and (17) and
lows: (E) in subsection (d), as so redesignated— inserting the following:
(i) in paragraph (1)— ‘‘(16) SECURITY CONTROL.—The term ‘secu-
‘‘SEC. 2201. DEFINITION. (I) in the matter preceding subparagraph rity control’ has the meaning given the term
‘‘In this subtitle, the term ‘Cybersecurity (A), by striking ‘‘subsection (c)(2)’’ and in- in section 2200 of the Homeland Security Act
Advisory Committee’ means the advisory serting ‘‘subsection (b)(2)’’; of 2002.
committee established under section (II) in subparagraph (A), by striking ‘‘sub- ‘‘(17) SECURITY VULNERABILITY.—The term
2219(a).’’; section (c)(1)’’ and inserting ‘‘subsection ‘security vulnerability’ has the meaning
(2) in section 2202— (b)(1)’’; and given the term in section 2200 of the Home-
(A) in subsection (a)(1), by striking ‘‘(in (III) in subparagraph (B), by striking ‘‘sub- land Security Act of 2002.’’.
this subtitle referred to as the Agency)’’; section (c)(2)’’ and inserting ‘‘subsection SEC. 6204. ADDITIONAL TECHNICAL AND CON-
(B) in subsection (f)— (b)(2)’’; and FORMING AMENDMENTS.
(i) in paragraph (1), by inserting ‘‘Execu- (ii) in paragraph (2), by striking ‘‘sub- (a) FEDERAL CYBERSECURITY ENHANCEMENT
tive’’ before ‘‘Assistant Director’’; and section (c)(2)’’ and inserting ‘‘subsection ACT OF 2015.—The Federal Cybersecurity En-
(ii) in paragraph (2), by inserting ‘‘Execu- (b)(2)’’; hancement Act of 2015 (6 U.S.C. 1521 et seq.)
tive’’ before ‘‘Assistant Director’’; (10) in section 2216, as so redesignated— is amended—
(3) in section 2203(a)(2), by striking ‘‘as the (A) in subsection (d)(2), by striking ‘‘infor- (1) in section 222 (6 U.S.C. 1521)—
ctelli on DSK11ZRN23PROD with SENATE
‘Assistant Director’ ’’ and inserting ‘‘as the mation sharing and analysis organizations’’ (A) in paragraph (2), by striking ‘‘section
‘Executive Assistant Director’ ’’; and inserting ‘‘Information Sharing and 2210’’ and inserting ‘‘section 2200’’; and
(4) in section 2204(a)(2), by striking ‘‘as the Analysis Organizations’’; and (B) in paragraph (4), by striking ‘‘section
‘Assistant Director’ ’’ and inserting ‘‘as the (B) by striking subsection (f) and inserting 2209’’ and inserting ‘‘section 2200’’;
‘Executive Assistant Director’ ’’; the following: (2) in section 223(b) (6 U.S.C. 151 note), by
(5) in section 2209— ‘‘(f) CYBER DEFENSE OPERATION DEFINED.— striking ‘‘section 2213(b)(1)’’ each place it ap-
(A) by striking subsection (a); In this section, the term ‘cyber defense oper- pears and inserting ‘‘section 2213(a)(1)’’;
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00083 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
S8490 CONGRESSIONAL RECORD — SENATE November 18, 2021
(3) in section 226 (6 U.S.C. 1524)— ‘‘(i) with respect to the agency information SEC. 1004. AVAILABILITY OF TRAVEL PROMOTION
(A) in subsection (a)— system, the head of the agency submits to FUND FOR BRAND USA.
(i) in paragraph (1), by striking ‘‘section the Director an application for an exemption (a) SHORT TITLE.—This section may be
2213’’ and inserting ‘‘section 2200’’; from the particular requirement, in which cited as the ‘‘Restoring Brand USA Act’’.
(ii) in paragraph (2), by striking ‘‘section the head of the agency personally certifies to (b) IN GENERAL.—Not later than 30 days
102’’ and inserting ‘‘section 2200 of the Home- the Director with particularity that— after the date of the enactment of this Act,
land Security Act of 2002’’; ‘‘(I) operational requirements articulated the Secretary of the Treasury, subject to
(iii) in paragraph (4), by striking ‘‘section in the certification and related to the agency subsections (c) and (d), and notwithstanding
2210(b)(1)’’ and inserting ‘‘section 2210(a)(1)’’; information system would make it exces- any other provision of law, shall make avail-
and sively burdensome to implement the par- able, from unobligated balances remaining
(iv) in paragraph (5), by striking ‘‘section ticular requirement; available from fees collected before October
2213(b)’’ and inserting ‘‘section 2213(a)’’; and ‘‘(II) the particular requirement is not nec- 1, 2020, and credited to Travel Promotion
(B) in subsection (c)(1)(A)(vi), by striking essary to secure the agency information sys- Fund established under subsection (d) of the
‘‘section 2213(c)(5)’’ and inserting ‘‘section tem or agency information stored on or Travel Promotion Act of 2009 (22 U.S.C.
2213(b)(5)’’; and transiting the agency information system; 2131(d)), $250,000,000 for the Corporation for
(4) in section 227(b) (6 U.S.C. 1525(b)), by and Travel Promotion (commonly known as
striking ‘‘section 2213(d)(2)’’ and inserting ‘‘(III) the agency has taken all necessary ‘‘Brand USA’’).
‘‘section 2213(c)(2)’’. steps to secure the agency information sys- (c) INAPPLICABILITY OF CERTAIN REQUIRE-
(b) PUBLIC HEALTH SERVICE ACT.—Section tem and agency information stored on or MENTS AND LIMITATIONS.—The limitations in
2811(b)(4)(D) of the Public Health Service Act transiting the agency information system; subsection (d)(2)(B) of the Travel Promotion
(42 U.S.C. 300hh–10(b)(4)(D)) is amended by ‘‘(ii) the head of the agency or the designee Act of 2009 shall not apply to amounts made
striking ‘‘section 228(c) of the Homeland Se- of the head of the agency has submitted the available under subsection (b), and the re-
curity Act of 2002 (6 U.S.C. 149(c))’’ and in- certification described in clause (i) to the ap- quirements in subsection (d)(3) of such Act
serting ‘‘section 2210(b) of the Homeland Se- propriate congressional committees and any shall not apply to more than $50,000,000 of
curity Act of 2002 (6 U.S.C. 660(b))’’. other congressional committee with jurisdic- the amounts so available.
(c) WILLIAM M. (MAC) THORNBERRY NA- tion over the agency; and (d) USE OF FUNDS.—Brand USA may only
TIONAL DEFENSE AUTHORIZATION ACT OF FIS- ‘‘(iii) the Director grants the exemption use funds provided under subsection (b) to
CAL YEAR 2021.—Section 9002 of the William from the particular requirement. promote travel from countries whose citizens
M. (Mac) Thornberry National Defense Au- ‘‘(B) DURATION OF EXEMPTION.— and nationals are permitted to enter the
thorization Act for Fiscal Year 2021 (6 U.S.C. ‘‘(i) IN GENERAL.—An exemption granted United States.
652a) is amended— under subparagraph (A) shall expire on the (e) REPORT REQUIRED.—Not later than 60
(1) in subsection (a)— date that is 1 year after the date on which days after the date of the enactment of this
(A) in paragraph (5), by striking ‘‘section the Director grants the exemption. Act, Brand USA shall submit to Congress a
2222(5) of the Homeland Security Act of 2002 ‘‘(ii) RENEWAL.—Upon the expiration of an plan for obligating and expending the
(6 U.S.C. 671(5))’’ and inserting ‘‘section 2200 exemption granted to an agency under sub- amounts described in subsection (b).
of the Homeland Security Act of 2002’’; and paragraph (A), the head of the agency may
(B) by amending paragraph (7) to read as apply for an additional exemption.’’. SA 4801. Mr. KENNEDY submitted an
follows:
(b) REPORT ON EXEMPTIONS.—Section amendment intended to be proposed to
‘‘(7) SECTOR RISK MANAGEMENT AGENCY.— amendment SA 3867 submitted by Mr.
3554(c)(1) of title 44, United States Code, as
The term ‘Sector Risk Management Agency’ REED and intended to be proposed to
amended by section 5121 of this Act, is fur-
has the meaning given the term in section the bill H.R. 4350, to authorize appro-
ther amended—
2200 of the Homeland Security Act of 2002.’’;
(2) in subsection (c)(3)(B), by striking ‘‘sec-
(1) in subparagraph (C), by striking ‘‘and’’ priations for fiscal year 2022 for mili-
at the end; tary activities of the Department of
tion 2201(5)’’ and inserting ‘‘section 2200’’;
(2) in subparagraph (D), by striking the pe- Defense, for military construction, and
and
riod at the end and inserting ‘‘; and’’; and
(3) in subsection (d)— for defense activities of the Depart-
(3) by adding at the end the following:
(A) by striking ‘‘section 2215’’ and insert-
‘‘(E) with respect to any exemptions the ment of Energy, to prescribe military
ing ‘‘section 2218’’; and personnel strengths for such fiscal
agency is granted by the Director of the Of-
(B) by striking ‘‘, as added by this sec- year, and for other purposes; which was
fice of Management and Budget under sec-
tion’’. ordered to lie on the table; as follows:
tion 225(b)(2) of the Federal Cybersecurity
(d) NATIONAL SECURITY ACT OF 1947.—Sec-
tion 113B of the National Security Act of 1947 Enhancement Act of 2015 (6 U.S.C. 1523(b)(2)) At the appropriate place, insert the fol-
(50 U.S.C. 3049a(b)(4)) is amended by striking that is effective on the date of submission of lowing:
‘‘section 226 of the Homeland Security Act of the report, includes— SEC. ll. SBIR AND STTR PILOT PROGRAM FOR
2002 (6 U.S.C. 147)’’ and inserting ‘‘section ‘‘(i) an identification of the particular re- UNDERPERFORMING STATES.
2208 of the Homeland Security Act of 2002 (6 quirements from which any agency informa- Section 9 of the Small Business Act (15
U.S.C. 658)’’. tion system (as defined in section 2210 of the U.S.C. 638) is amended by adding at the end
(e) IOT CYBERSECURITY IMPROVEMENT ACT Homeland Security Act of 2002 (6 U.S.C. 660)) the following:
OF 2020.—Section 5(b)(3) of the IoT Cyberse- is exempted; and ‘‘(vv) DEPARTMENT OF DEFENSE PILOT PRO-
curity Improvement Act of 2020 (15 U.S.C. ‘‘(ii) for each requirement identified under GRAM FOR UNDERPERFORMING STATES.—
278g–3c) is amended by striking ‘‘section subclause (I)— ‘‘(1) DEFINITIONS.—In this section:
2209(m) of the Homeland Security Act of 2002 ‘‘(I) an identification of the agency infor- ‘‘(A) DEPARTMENT.—The term ‘Department’
(6 U.S.C. 659(m))’’ and inserting ‘‘section mation system described in subclause (I) ex- means the Department of Defense.
2209(l) of the Homeland Security Act of 2002 empted from the requirement; and ‘‘(B) UNDERPERFORMING STATE.—The term
(6 U.S.C. 659(l))’’. ‘‘(II) an estimate of the date on which the ‘underperforming State’ means any State
(f) SMALL BUSINESS ACT.—Section agency will to be able to comply with the re- participating in the SBIR or STTR program
21(a)(8)(B) of the Small Business Act (15 quirement.’’. that is in the bottom 68 percent of all States
U.S.C. 648(a)(8)(B)) is amended by striking (c) EFFECTIVE DATE.—This section and the historically receiving SBIR or STTR pro-
‘‘section 2209(a)’’ and inserting ‘‘section amendments made by this section shall take gram funding.
2200’’. effect on the date that is 1 year after the ‘‘(2) ESTABLISHMENT.—The Secretary of De-
(g) TITLE 46.—Section 70101(2) of title 46, date of enactment of this Act. fense shall establish a pilot program to pro-
United States Code, is amended by striking vide small business concerns located in
‘‘section 227 of the Homeland Security Act of underperforming States an increased level of
SA 4800. Ms. KLOBUCHAR (for her-
2002 (6 U.S.C. 148)’’ and inserting ‘‘section assistance under the SBIR and STTR pro-
2200 of the Homeland Security Act of 2002’’. self and Mr. BLUNT) submitted an
grams of the Department.
TITLE LXIII—FEDERAL CYBERSECURITY
amendment intended to be proposed by ‘‘(3) ACTIVITIES.—Under the pilot program,
REQUIREMENTS her to the bill H.R. 4350, to authorize the Department, and any component agency
SEC. 6301. EXEMPTION FROM FEDERAL CYBERSE- appropriations for fiscal year 2022 for thereof, may—
CURITY REQUIREMENTS. military activities of the Department ‘‘(A) in any case in which the Department
(a) IN GENERAL.—Section 225(b)(2) of the of Defense, for military construction, seeks to make a Phase II SBIR or STTR
Federal Cybersecurity Enhancement Act of and for defense activities of the De- award to a small business concern based on
ctelli on DSK11ZRN23PROD with SENATE
2015 (6 U.S.C. 1523(b)(2)) is amended to read as partment of Energy, to prescribe mili- the results of a Phase I award made to the
follows: tary personnel strengths for such fiscal small business concern by another agency,
‘‘(2) EXCEPTION.— establish a streamlined transfer and fast
‘‘(A) IN GENERAL.—A particular require-
year, and for other purposes; which was track approval process for that Phase II
ment under paragraph (1) shall not apply to ordered to lie on the table; as follows: award;
an agency information system of an agency At the end of subtitle A of title X, add the ‘‘(B) provide an additional Phase II SBIR
if— following: or STTR award to a small business concern
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00084 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.057 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8491
located in an underperforming State that re- tutional capacity to better support new or students participating in cybersecurity pro-
ceived a Phase I SBIR or STTR award, sub- existing cybersecurity programs, including grams that have received support under this
ject to an increase in the allocation percent- cybersecurity partnerships with public and section.
age; private entities, and to support such institu- (g) PERFORMANCE METRICS.—The Director
‘‘(C) establish a program to make Phase 1.5 tions on the path to producing qualified en- shall establish performance metrics for
SBIR or STTR awards to small business con- trants in the cybersecurity workforce or be- grants awarded under this section.
cerns located in underperforming States in coming a National Center of Academic Ex- (h) EFFECTIVE DATE.—This section shall
order to provide funding for 12 to 24 months cellence in Cybersecurity; and take effect 1 year after the date of enact-
to continue the development of technology; (B) awarding grants to build capacity at ment of this Act.
and institutions of higher education that have an
‘‘(D) carry out subparagraph (C) along with enrollment of needy students, historically SA 4803. Ms. DUCKWORTH (for her-
other mentorship programs. Black colleges and universities, and minor- self, Mr. KELLY, Ms. HIRONO, Ms.
‘‘(4) DURATION.—The pilot program estab- ity-serving institutions, to expand cyberse- ROSEN, Mr. BENNET, Mr. HEINRICH, Mr.
lished under this subsection shall terminate curity education opportunities, cybersecu- MORAN, Mr. YOUNG, Mrs. FEINSTEIN,
5 years after the date on which the pilot pro- rity programs, cybersecurity research, and Mrs. GILLIBRAND, Mr. KING, Mrs. SHA-
gram is established. cybersecurity partnerships with public and HEEN, Ms. KLOBUCHAR, Mr. DURBIN, Mr.
‘‘(5) REPORT.—The Department shall sub- private entities. PETERS, and Mr. BLUMENTHAL) sub-
mit to Congress an annual report on the sta- (2) RESERVATION.—The Director shall mitted an amendment intended to be
tus of the pilot program established under award not less than 50 percent of the amount proposed to amendment SA 3867 sub-
this subsection, including the improvement available for grants under this section to his-
torically Black colleges and universities and
mitted by Mr. REED and intended to be
in funding under the SBIR and STTR pro-
grams of the Department provided to small minority-serving institutions. proposed to the bill H.R. 4350, to au-
business concerns located in underper- (3) COORDINATION.—The Director shall thorize appropriations for fiscal year
forming States.’’. carry out this section in coordination with 2022 for military activities of the De-
appropriate Federal agencies, including the partment of Defense, for military con-
SA 4802. Mr. OSSOFF (for himself, Department of Homeland Security. struction, and for defense activities of
Mr. TILLIS, Mr. KING, Ms. CORTEZ (4) SUNSET.—The Director’s authority to the Department of Energy, to prescribe
MASTO, Mr. ROUNDS, Mr. SCOTT of award grants under paragraph (1) shall ter- military personnel strengths for such
minate on the date that is 5 years after the fiscal year, and for other purposes;
South Carolina, and Mr. KELLY) sub-
date the Director first awards a grant under which was ordered to lie on the table;
mitted an amendment intended to be paragraph (1).
proposed to amendment SA 3867 sub- (d) APPLICATIONS.—An eligible institution as follows:
mitted by Mr. REED and intended to be seeking a grant under subsection (a) shall At the end of subtitle B of title XII, add
proposed to the bill H.R. 4350, to au- submit an application to the Director at the following:
such time, in such manner, and containing SEC. 1216. AFGHANISTAN WAR COMMISSION ACT
thorize appropriations for fiscal year OF 2021.
2022 for military activities of the De- such information as the Director may rea-
sonably require, including a statement of (a) SHORT TITLE.—This section may be
partment of Defense, for military con- how the institution will use the funds award- cited as the ‘‘Afghanistan War Commission
struction, and for defense activities of ed through the grant to expand cybersecu- Act of 2021’’.
the Department of Energy, to prescribe rity education opportunities at the eligible (b) DEFINITIONS.—In this section:
military personnel strengths for such institution. (1) APPLICABLE PERIOD.—The term ‘‘appli-
fiscal year, and for other purposes; (e) ACTIVITIES.—An eligible institution cable period’’ means the period beginning
that receives a grant under this section may June 1, 2001, and ending August 30, 2021.
which was ordered to lie on the table; (2) APPROPRIATE CONGRESSIONAL COMMIT-
use the funds awarded through such grant for
as follows: increasing research, education, technical, TEES.—The term ‘‘appropriate congressional
At the appropriate place, insert the fol- partnership, and innovation capacity, includ- committees’’ means—
lowing: ing for— (A) the Committee on Armed Services of
SEC. ll. DR. DAVID SATCHER CYBERSECURITY (1) building and upgrading institutional ca- the Senate;
EDUCATION GRANT PROGRAM. pacity to better support new or existing cy- (B) the Committee on Foreign Relations of
(a) SHORT TITLE.—This section may be bersecurity programs, including cybersecu- the Senate;
cited as the ‘‘Cybersecurity Opportunity rity partnerships with public and private en- (C) the Select Committee on Intelligence
Act’’. tities; of the Senate;
(b) DEFINITIONS.—In this section: (2) building and upgrading institutional ca- (D) the Committee on Appropriations of
(1) DIRECTOR.—The term ‘‘Director’’ means pacity to provide hands-on research and the Senate;
the Director of the National Institute of training experiences for undergraduate and (E) the Committee on Armed Services of
Standards and Technology. graduate students; and the House of Representatives;
(2) ENROLLMENT OF NEEDY STUDENTS.—The (3) outreach and recruitment to ensure stu- (F) the Committee on Foreign Affairs of
term ‘‘enrollment of needy students’’ has the dents are aware of such new or existing cy- the House of Representatives;
meaning given the term in section 312(d) of bersecurity programs, including cybersecu- (G) the Permanent Select Committee on
the Higher Education Act of 1965 (20 U.S.C. rity partnerships with public and private en- Intelligence of the House of Representatives;
1058(d)). tities. and
(3) HISTORICALLY BLACK COLLEGE OR UNI- (f) REPORTING REQUIREMENTS.—Not later (H) the Committee on Appropriations of
VERSITY.—The term ‘‘historically Black col- than— the House of Representatives.
lege or university’’ has the meaning given (1) 1 year after the effective date of this (3) INTELLIGENCE COMMUNITY.—The term
the term ‘‘part B institution’’ as defined in section, as provided in subsection (h), and ‘‘intelligence community’’ has the meaning
section 322 of the Higher Education Act of annually thereafter until the Director sub- given that term in section 3(4) of the Na-
1965 (20 U.S.C. 1061). mits the report under paragraph (2), the Di- tional Security Act of 1947 (50 U.S.C. 3003(4)).
(4) INSTITUTION OF HIGHER EDUCATION.—The rector shall prepare and submit to Congress (c) ESTABLISHMENT OF COMMISSION.—
term ‘‘institution of higher education’’ has a report on the status and progress of imple- (1) ESTABLISHMENT.—There is established
the meaning given the term in section 101(a) mentation of the grant program under this in the legislative branch an independent
of the Higher Education Act of 1965 (20 U.S.C. section, including on the number and nature commission to be known as the Afghanistan
1001(a)). of institutions participating, the number and War Commission (in this section referred to
(5) MINORITY-SERVING INSTITUTION.—The nature of students served by institutions re- as the ‘‘Commission’’).
term ‘‘minority-serving institution’’ means ceiving grants, the level of funding provided (2) MEMBERSHIP.—
an institution listed in section 371(a) of the to grant recipients, the types of activities (A) COMPOSITION.—The Commission shall
Higher Education Act of 1965 (20 U.S.C. being funded by the grants program, and be composed of 16 members of whom—
1067q(a)). plans for future implementation and devel- (i) 1 shall be appointed by the Chairman of
(c) AUTHORIZATION OF GRANTS.— opment; and the Committee on Armed Services of the
(1) IN GENERAL.—Subject to the avail- (2) 5 years after the effective date of this Senate;
ability of appropriations, the Director shall section, as provided in subsection (h), the Di- (ii) 1 shall be appointed by the ranking
carry out the Dr. David Satcher Cybersecu- rector shall prepare and submit to Congress member of the Committee on Armed Serv-
ctelli on DSK11ZRN23PROD with SENATE
rity Education Grant Program by— a report on the status of cybersecurity edu- ices of the Senate;
(A) awarding grants to assist institutions cation programming and capacity-building (iii) 1 shall be appointed by the Chairman
of higher education that have an enrollment at institutions receiving grants under this of the Committee on Armed Services of the
of needy students, historically Black col- section, including changes in the scale and House of Representatives;
leges and universities, and minority-serving scope of these programs, associated facili- (iv) 1 shall be appointed by the ranking
institutions, to establish or expand cyberse- ties, or in accreditation status, and on the member of the Committee on Armed Serv-
curity programs, to build and upgrade insti- educational and employment outcomes of ices of the House of Representatives;
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00085 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.052 S18NOPT1
S8492 CONGRESSIONAL RECORD — SENATE November 18, 2021
(v) 1 shall be appointed by the Chairman of (A) IN GENERAL.—A member of the Com- progress of diplomatic, military, and intel-
the Committee on Foreign Relations of the mission shall be appointed for the life of the ligence efforts;
Senate; Commission. (iii) the efficacy of interagency planning
(vi) 1 shall be appointed by the ranking (B) VACANCIES.—A vacancy in the Commis- and execution process by the United States
member of the Committee on Foreign Rela- sion— Government;
tions of the Senate; (i) shall not affect the powers of the Com- (iv) factors that led to the collapse of the
(vii) 1 shall be appointed by the Chairman mission; and Afghan National Defense Security Forces in
of the Committee on Foreign Affairs of the (ii) shall be filled in the same manner as 2021, including—
House of Representatives; the original appointment. (I) training;
(viii) 1 shall be appointed by the ranking (4) MEETINGS.— (II) assessment methodologies;
member of the Committee on Foreign Affairs (A) INITIAL MEETING.—Not later than 30 (III) building indigenous forces on western
of the House of Representatives; days after the date on which all members of models;
(ix) 1 shall be appointed by the Chairman the Commission have been appointed, the (IV) reliance on technology and logistics
of the Select Committee on Intelligence of Commission shall hold the first meeting of support; and
the Senate; the Commission. (V) reliance on warfighting enablers pro-
(x) 1 shall be appointed by the ranking (B) FREQUENCY.—The Commission shall vided by the United States;
member of the Select Committee on Intel- meet at the call of the Co-Chairpersons. (v) the efficacy of counter-corruption ef-
ligence of the Senate. (C) QUORUM.—A majority of the members forts to include linkages to diplomatic lines
(xi) 1 shall be appointed by the Chairman of the Commission shall constitute a of effort, linkages to foreign and security as-
of the Permanent Select Committee on In- quorum, but a lesser number of members sistance, and assessment methodologies;
telligence of the House of Representatives; may hold hearings. (vi) the efficacy of counter-narcotic efforts
(xii) 1 shall be appointed by the ranking (5) CO-CHAIRPERSONS.—The Commission to include alternative livelihoods, eradi-
member of the Permanent Select Committee shall select, by a simple majority vote— cation, interdiction, and education efforts;
on Intelligence of the House of Representa- (A) 1 Co-Chairperson from the members of (vii) the role of countries neighboring Af-
tives; the Commission appointed by chairpersons of ghanistan in contributing to the instability
(xiii) 1 shall be appointed by the majority the appropriate congressional committees; of Afghanistan;
leader of the Senate; and (viii) varying diplomatic approaches be-
(xiv) 1 shall be appointed by the minority (B) 1 Co-Chairperson from the members of tween Presidential administrations;
leader of the Senate; the Commission appointed by the ranking (ix) the extent to which the intelligence
(xv) 1 shall be appointed by the Speaker of members of the appropriate congressional community did or did not fail to provide suf-
the House of Representatives; and committees. ficient warning about the probable outcomes
(xvi) 1 shall be appointed by the Minority of a withdrawal of coalition military support
(d) PURPOSE OF COMMISSION.— The purpose
Leader of the House of Representatives. from Afghanistan, including as it relates
of the Commission is—
(B) QUALIFICATIONS.—It is the sense of Con- to—
(1) to examine the key strategic, diplo-
gress that each member of the Commission (I) the capability and sustainability of the
appointed under subparagraph (A) should matic, and operational decisions that pertain
Afghanistan National Defense Security
have significant professional experience in to the war in Afghanistan during the rel- Forces;
national security, such as a position in— evant period, including decisions, assess- (II) the sustainability of the Afghan cen-
(i) the Department of Defense; ments, and events that preceded the war in tral government, absent coalition support;
(ii) the Department of State; Afghanistan; and (III) the extent of Taliban control over Af-
(iii) the intelligence community; (2) to develop a series of lessons learned ghanistan over time with respect to geo-
(iv) the United States Agency for Inter- and recommendations for the way forward graphic territory, governance, and influence;
national Development; or that will inform future decisions by Congress and
(v) an academic or scholarly institution. and policymakers throughout the United (IV) the likelihood of the Taliban regain-
(C) PROHIBITIONS.—A member of the Com- States Government. ing control of Afghanistan at various levels
mission appointed under subparagraph (A) (e) DUTIES OF COMMISSION.— of United States and coalition support, in-
may not— (1) STUDY.— cluding the withdrawal of most or all United
(i) be a current member of Congress; (A) IN GENERAL.—The Commission shall States or coalition support;
(ii) be a former member of Congress who conduct a thorough study of all matters re- (x) the extent to which intelligence prod-
served in Congress after January 3, 2001; lating to combat operations, reconstruction ucts related to the state of the conflict in Af-
(iii) be a current or former registrant and security force assistance activities, in- ghanistan and the effectiveness of the Af-
under the Foreign Agents Registration Act telligence operations, and diplomatic activi- ghanistan National Defense Security Forces
of 1938 (22 U.S.C. 611 et seq.); ties of the United States pertaining to the complied with intelligence community-wide
(iv) have previously investigated Afghani- Afghanistan during the period beginning analytic tradecraft standards and fully re-
stan policy or the war in Afghanistan September 1, 1996, and ending August 30, 2021. flected the divergence of analytic views
through employment in the office of a rel- (B) MATTERS STUDIED.—The matters stud- across the intelligence community;
evant inspector general; ied by the Commission shall include— (xi) an evaluation of whether any element
(v) have been the sole owner or had a ma- (i) for the time period specified under sub- of the United States Government inappropri-
jority stake in a company that held any paragraph (A)— ately restricted access to data from elements
United States or coalition defense contract (I) the policy objectives of the United of the intelligence community, Congress, or
providing goods or services to activities by States Government, including— the Special Inspector General for Afghani-
the United States Government or coalition (aa) military objectives; stan Reconstruction (SIGAR) or any other
in Afghanistan during the applicable period; (bb) diplomatic objectives; oversight body such as other inspectors gen-
or (cc) development objectives; and eral or the Gpvernment Accountability Of-
(vi) have served, with direct involvement (dd) intelligence objectives; fice, including through the use of overclassi-
in actions by the United States Government (II) significant decisions made by the fication; and
in Afghanistan during the time the relevant United States, including the development of (xii) the extent to which public representa-
official served, as— options presented to policymakers; tions of the situation in Afghanistan before
(I) a cabinet secretary or national security (III) the efficacy of efforts by the United Congress by United States Government offi-
adviser to the President; or States Government in meeting the objec- cials were not consistent with the most re-
(II) a four-star flag officer, Under Sec- tives described in clause (i), including an cent formal assessment of the intelligence
retary, or more senior official in the Depart- analysis of — community at the time those representa-
ment of Defense or the Department of State. (aa) military efforts; tions were made.
(D) DATE.— (bb) diplomatic efforts; (2) REPORT REQUIRED.—
(i) IN GENERAL.—The appointments of the (cc) development efforts; and (A) IN GENERAL.—
members of the Commission shall be made (dd) intelligence efforts; and (i) ANNUAL REPORT.—
not later than 60 days after the date of en- (IV) the efficacy of counterterrorism ef- (I) IN GENERAL.—Not later than 1 year after
actment of this Act. forts against al Qaeda, the Islamic State the date of the initial meeting of the Com-
(ii) FAILURE TO MAKE APPOINTMENT.—If an Khorasan Province, and other foreign ter- mission, and annually thereafter, the Com-
appointment under subparagraph (A) is not rorist organizations in degrading the will mission shall submit to the appropriate con-
made by the appointment date specified in and capabilities of such organizations— gressional committees a report describing
ctelli on DSK11ZRN23PROD with SENATE
clause (i)— (aa) to mount external attacks against the the progress of the activities of the Commis-
(I) the authority to make such appoint- United States mainland or its allies and sion as of the date of such report, including
ment shall expire; and partners; or any findings, recommendations, or lessons
(II) the number of members of the Commis- (bb) to threaten regional stability in Af- learned endorsed by the Commission.
sion shall be reduced by the number equal to ghanistan and neighboring countries. (II) ADDENDA.—Any member of the Com-
the number of appointments not made. (ii) the efficacy of metrics, measures of ef- mission may submit an addendum to a re-
(3) PERIOD OF APPOINTMENT; VACANCIES.— fectiveness, and milestones used to assess port required under subclause (I) setting
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00086 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.051 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8493
forth the separate views of such member other departments and agencies of the Fed- fice of the Secretary of Defense, is hereby in-
with respect to any matter considered by the eral Government. creased by $3,000,000.
Commission. (4) GIFTS.—The Commission may accept, (2) OFFSET.—The amount authorized to be
(III) BRIEFING.—On the date of the submis- use, and dispose of gifts or donations of serv- appropriated by section 4301 for Operation
sion of the first annual report, the Commis- ices, goods, and property from non-Federal and Maintenance, Afghanistan Security
sion shall brief Congress. entities for the purposes of aiding and facili- Forces Fund, for Afghanistan Air Force,
(ii) FINAL REPORT.— tating the work of the Commission. The au- Line 090, is hereby reduced by $3,000,000.
(I) SUBMISSION.—Not later than 3 years thority in this subsection does not extend to
after the date of the initial meeting of the gifts of money. Gifts accepted under this au- SA 4804. Mr. YOUNG submitted an
Commission, the Commission shall submit to thority shall be documented, and conflicts of amendment intended to be proposed to
Congress a report that contains a detailed interest or the appearance of conflicts of in- amendment SA 3867 submitted by Mr.
statement of the findings, recommendations, terest shall be avoided. Subject to the au- REED and intended to be proposed to
and lessons learned endorsed by the Commis- thority in this section, commissioners shall the bill H.R. 4350, to authorize appro-
sion. otherwise comply with rules set forth by the priations for fiscal year 2022 for mili-
(II) ADDENDA.—Any member of the Com- Select Committee on Ethics of the Senate
mission may submit an addendum to the re-
tary activities of the Department of
and the Committee on Ethics of the House of
port required under subclause (I) setting Defense, for military construction, and
Representatives governing employees of the
forth the separate views of such member Senate and the House of Representatives. for defense activities of the Depart-
with respect to any matter considered by the (5) LEGISLATIVE ADVISORY COMMITTEE.—The ment of Energy, to prescribe military
Commission. Commission shall operate as a legislative ad- personnel strengths for such fiscal
(III) EXTENSION.—The Commission may visory committee and shall not be subject to year, and for other purposes; which was
submit the report required under subclause the provisions of the Federal Advisory Com- ordered to lie on the table; as follows:
(I) at a date that is not more than 1 year mittee Act (Public Law 92–463; 5 U.S.C. App) At the end of subtitle E of title XII, add
later than the date specified in such clause if or section 552b, United States Code (com- the following:
agreed to by the chairperson and ranking monly known as the Government in the Sun- SEC. 1253. REPORT ON GEOSTRATEGIC INTER-
member of each of the appropriate congres- shine Act). ESTS AND NATIONAL SECURITY IM-
sional committees. (g) COMMISSION PERSONNEL MATTERS.— PLICATIONS RELATED TO TRADE IN
(B) FORM.—The report required by para- (1) COMPENSATION OF MEMBERS.—A member INDO-PACIFIC REGION.
graph (1)(B) shall be submitted and publicly (a) IN GENERAL.—Not later than 150 days
of the Commission who is not an officer or
released on a Government website in unclas- after the date of the enactment of this Act,
employee of the Federal Government shall
sified form but may contain a classified the United States Trade Representative, in
be compensated at a rate equal to the daily
annex. coordination with the Secretary of Defense,
equivalent of the annual rate of basic pay
(C) SUBSEQUENT REPORTS ON DECLASSIFICA- the Secretary of State, the Secretary of
prescribed for level IV of the Executive
TION.— Commerce, and the Secretary of Homeland
Schedule under section 5315 of title 5, United
(i) IN GENERAL.—Not later than 4 years Security, shall submit to Congress and make
States Code, for each day (including travel
after the date that the report required by available to the public a report on
time) during which the member is engaged in
subparagraph (A)(ii) is submitted, each rel- geostrategic interests and national security
the performance of the duties of the Com- implications related to trade in the Indo-Pa-
evant agency of jurisdiction shall submit to
the committee of jurisdiction a report on the mission. cific region.
efforts of such agency to declassify such (2) TRAVEL EXPENSES.—A member of the (b) ELEMENTS.—The report required by sub-
annex. Commission shall be allowed travel expenses, section (a) shall include an assessment of the
(ii) CONTENTS.—Each report required by including per diem in lieu of subsistence, at following:
clause (i) shall include— rates authorized for employees of agencies (1) How reductions in tariffs, revisions in
(I) a list of the items in the classified under subchapter I of chapter 57 of title 5, government procurement rules, and other
annex that the agency is working to declas- United States Code, while away from their market access commitments by countries in
sify at the time of the report and an esti- homes or regular places of business in the the Indo-Pacific region could potentially af-
mate of the timeline for declassification of performance of services for the Commission. fect United States producers and supply
such items; (3) STAFF.— chains deemed critical for national security
(II) a broad description of items in the (A) STATUS AS FEDERAL EMPLOYEES.—Not- purposes.
annex that the agency is declining to declas- withstanding the requirements of section (2) How agreements by those countries, in-
sify at the time of the report; and 2105 of title 5, United States Code, including cluding with respect to strengthening invest-
(III) any justification for withholding de- the required supervision under subsection ment and intellectual property rights, could
classification of certain items in the annex (a)(3) of such section, the members of the potentially affect the development by the
and an estimate of the timeline for declas- commission shall be deemed to be Federal United States of critical new technologies.
sification of such items. employees. (3) How agreements by those countries re-
(f) POWERS OF COMMISSION.— (B) EXECUTIVE DIRECTOR.—The Commission lating to digital trade could potentially af-
(1) HEARINGS.—The Commission may hold shall appoint and fix the rate of basic pay for fect United States cybersecurity, including
such hearings, take such testimony, and re- an Executive Director in accordance with potential agreements entered into with the
ceive such evidence as the Commission con- section 3161(d) of title 5, United States Code. United States to promote cybersecurity and
siders necessary to carry out its purpose and (C) PAY.—The Executive Director, with the open data flows and to combat discrimina-
functions under this section. approval of the Commission, may appoint tory practices and government censorship.
(2) ASSISTANCE FROM FEDERAL AGENCIES.— and fix the rate of basic pay for additional (4) How tariff and nontariff barriers im-
(A) INFORMATION.— personnel as staff of the Commission in ac- posed by those countries and trade agree-
(i) IN GENERAL.—The Commission may se- cordance with section 3161(d) of title 5, ments by those countries could broadly af-
cure directly from a Federal department or United States Code. fect geostrategic United States interests,
agency such information as the Commission (4) DETAIL OF GOVERNMENT EMPLOYEES.—A partnerships, and alliances.
considers necessary to carry out this section. Federal Government employee may be de- (5) Current and predicted foreign direct in-
(ii) FURNISHING INFORMATION.—Upon re- tailed to the Commission without reimburse- vestment in the Indo-Pacific region by the
ceipt of a written request by the Co-Chair- ment, and such detail shall be without inter- People’s Republic of China.
persons of the Commission, the head of the ruption or loss of civil service status or (6) How agreements by those countries
department or agency shall expeditiously privilege. could counter the semiconductor policies of
furnish the information to the Commission. (5) PROCUREMENT OF TEMPORARY AND INTER- the Government of the People’s Republic of
(B) SPACE FOR COMMISSION.—Not later than MITTENT SERVICES.—The Co-Chairpersons of China, particularly those policies that could
30 days after the date of the enactment of the Commission may procure temporary and lead to the transfer of intellectual property,
this Act, the Administrator of General Serv- intermittent services under section 3109(b) of research and development, and manufac-
ices, in consultation with the Commission, title 5, United States Code, at rates for indi- turing to the People’s Republic of China.
shall identify and make available suitable viduals that do not exceed the daily equiva- (c) PUBLIC HEARING.—The Trade Represent-
excess space within the Federal space inven- lent of the annual rate of basic pay pre- ative and the officials specified in subsection
tory to house the operations of the Commis- scribed for level V of the Executive Schedule (a) shall jointly conduct a public hearing and
sion. If the Administrator of General Serv- under section 5316 of that title. invite witnesses to testify with respect to
ices is not able to make such suitable excess (h) TERMINATION OF COMMISSION.—The the elements described in subsection (b).
ctelli on DSK11ZRN23PROD with SENATE
space available within such 30-day period, Commission shall terminate 90 days after the
date on which the Commission submits the SA 4805. Ms. CORTEZ MASTO sub-
the Commission may lease space to the ex-
tent that funds are available for such pur- report required under subsection (e)(2)(A)(ii). mitted an amendment intended to be
pose. (i) AUTHORIZATION OF APPROPRIATIONS.— proposed to amendment SA 3867 sub-
(3) POSTAL SERVICES.—The Commission (1) INCREASE.—The amount authorized to mitted by Mr. REED and intended to be
may use the United States mails in the same be appropriated by section 4301 for Operation proposed to the bill H.R. 4350, to au-
manner and under the same conditions as and Maintenance, Defense-wide, for the Of- thorize appropriations for fiscal year
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00087 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.051 S18NOPT1
S8494 CONGRESSIONAL RECORD — SENATE November 18, 2021
2022 for military activities of the De- SEC. lll. MODIFICATIONS TO REQUIREMENTS cational institution located in a foreign
FOR EDUCATIONAL INSTITUTIONS country.’’.
partment of Defense, for military con- PARTICIPATING IN THE EDU-
struction, and for defense activities of (2) EXAMINATION OF RECORDS.—Section
CATIONAL ASSISTANCE PROGRAMS
OF THE DEPARTMENT OF VETERANS 3690(c) of title 38, United States Code, is
the Department of Energy, to prescribe
AFFAIRS. amended—
military personnel strengths for such (A) by striking ‘‘Notwithstanding’’ and in-
(a) WAIVER OF VERIFICATION OF ENROLL-
fiscal year, and for other purposes; MENT FOR CERTAIN EDUCATIONAL INSTITU- serting ‘‘(1) Except as provided in paragraph
which was ordered to lie on the table; TIONS.—Section 3313(l) of title 38, United (2), notwithstanding’’; and
as follows: States Code, is amended by adding at the end (B) by adding at the end the following new
At the appropriate place in title X, insert the following new paragraph: paragraph:
‘‘(4) WAIVER.—The Secretary may waive ‘‘(2) Paragraph (1) does not apply to the
the following:
the requirements of this subsection for an records and accounts—
Subtitle ll—Veterans Matters educational institution that the Secretary ‘‘(A) of an educational institution located
SEC. lll. EXTENSIONS OF CERTAIN PROVI- has determined uses a flat tuition and fee in a foreign country; and
SIONS OF LAW RELATING TO BENE- structure that would make the use of a sec- ‘‘(B) that pertain to an individual who is
FITS PROVIDED UNDER DEPART- ond verification under this subsection unnec- not receiving educational assistance under
MENT OF VETERANS AFFAIRS EDU- essary.’’. this chapter.’’.
CATIONAL ASSISTANCE PROGRAMS (b) LIMITATIONS ON AUTHORITY TO DIS- SEC. lll. CONTINUATION OF DEPARTMENT OF
DURING COVID–19 PANDEMIC. APPROVE OF COURSES.— VETERANS AFFAIRS EDUCATIONAL
(a) EXTENSION OF STUDENT VETERAN (1) IN GENERAL.—Subsection (f) of section ASSISTANCE BENEFITS FOR CER-
3679 of title 38, United States Code, is amend- TAIN PROGRAMS OF EDUCATION
CORONAVIRUS RESPONSE ACT OF 2020.—Sec-
CONVERTED TO DISTANCE LEARN-
tion 2 of the Student Veteran Coronavirus ed— ING BY REASON OF EMERGENCIES
Response Act of 2020 (Public Law 116–140; 38 (A) in paragraph (2)(B), AND HEALTH-RELATED SITUATIONS.
U.S.C. 3031 note), as amended by section (i) by inserting ‘‘, except for the recruit- (a) IN GENERAL.—In the case of a program
5202(a) of the Department of Veterans Affairs ment of foreign students residing in foreign of education approved by a State approving
Expiring Authorities Act of 2020 (division E countries who are not eligible to receive agency, or the Secretary of Veterans Affairs
of Public Law 116–159), is further amended by Federal student assistance’’ after ‘‘assist- when acting in the role of a State approving
striking ‘‘December 21, 2021’’ and inserting ance’’; and agency, that is converted from being offered
‘‘June 1, 2022’’. (ii) by adding at the end the following new on-site at an educational institution to being
(b) EXTENSION OF PAYMENT OF WORK-STUDY subparagraph: offered by distance learning by reason of an
ALLOWANCES DURING EMERGENCY SITUA- ‘‘(C) In determining whether a violation of emergency or health-related situation, as de-
TION.—Section 3 of the Student Veteran subparagraph (B) has occurred, the State ap- termined by the Secretary, the Secretary
Coronavirus Response Act of 2020 (38 U.S.C. proving agency, or the Secretary when act- may continue to provide educational assist-
3485 note) is amended by striking ‘‘During ing in the place of the State approving agen- ance under the laws administered by the Sec-
the covered period’’ and inserting ‘‘During cy, shall construe the requirements of this retary without regard to such conversion, in-
the period beginning on March 1, 2020, and paragraph in accordance with the regula- cluding with respect to paying any—
ending on June 1, 2022’’. tions and guidance prescribed by the Sec- (1) monthly housing stipends under chapter
retary of Education under section 487(a)(20) 33 of title 38, United States Code; or
(c) EXTENSION OF PERIOD FOR CONTINUATION
of the Higher Education Act of 1965 (20 U.S.C. (2) payments or subsistence allowances
OF DEPARTMENT OF VETERANS AFFAIRS EDU-
1094(a)(20)).’’; under chapters 30, 31, 32, and 35 of such title
CATIONAL ASSISTANCE BENEFITS FOR CERTAIN
(B) by redesignating paragraph (7) as para- and chapters 1606 and 1607 of title 10, United
PROGRAMS OF EDUCATION CONVERTED TO DIS-
graph (8); and States Code.
TANCE LEARNING BY REASON OF EMERGENCIES
(C) by inserting after paragraph (6) the fol- (b) APPLICABILITY PERIOD.—Subsection (a)
AND HEALTH-RELATED SITUATIONS.—Section
lowing new paragraph (7): shall apply during the period beginning on
1(b) of Public Law 116–128 (38 U.S.C. 3001 note ‘‘(7) This subsection shall not apply to an
prec.), as amended by section 5202(b) of the December 21, 2021, and ending on June 1, 2022.
educational institution— (c) DEFINITIONS.—In this section:
Department of Veterans Affairs Expiring Au- ‘‘(A) located in a foreign country; or
thorities Act of 2020 (division E of Public (1) EDUCATIONAL INSTITUTION.—The term
‘‘(B) that provides to a covered individual ‘‘educational institution’’ has the meaning
Law 116–159), is further amended by striking consumer information regarding costs of the
‘‘December 21, 2021’’ and inserting ‘‘June 1, given that term in section 3452 of title 38,
program of education (including financial United States Code, and includes an institu-
2022’’. aid available to such covered individual) tion of higher learning (as defined in such
(d) EXTENSION OF MODIFICATION OF TIME using a form or template developed by the section).
LIMITATIONS ON USE OF ENTITLEMENT TO Secretary of Education.’’. (2) PROGRAM OF EDUCATION.—The term
MONTGOMERY GI BILL AND VOCATIONAL REHA- (2) APPLICATION DATE.—The Secretary of ‘‘program of education’’ has the meaning
BILITATION AND TRAINING.—Section 1105 of Veterans Affairs may not carry out sub- given that term in section 3002 of title 38,
the Johnny Isakson and David P. Roe, M.D. section (f) of section 3679 of title 38, United United States Code.
Veterans Health Care and Benefits Improve- States Code, until August 1, 2022, except (3) STATE APPROVING AGENCY.—The term
ment Act of 2020 (Public Law 116–315) is that, beginning on June 15, 2022, an edu- ‘‘State approving agency’’ has the meaning
amended by striking ‘‘December 21, 2021’’ cational institution may submit an applica- given that term in section 3671 of title 38,
each place it appears and inserting ‘‘June 1, tion for a waiver under paragraph (5) of such United States Code.
2022’’. subsection. SEC. lll. BUDGETARY EFFECTS.
(e) EXTENSION OF CONTINUATION OF DEPART- (3) CONFORMING AMENDMENTS.—Subsection (a) IN GENERAL.—Amounts provided to
MENT OF VETERANS AFFAIRS EDUCATIONAL AS- (c) of section 3696 of such title is amended— carry out the amendments made by this sub-
SISTANCE BENEFITS DURING COVID–19 EMER- (A) by inserting ‘‘(1)’’ before ‘‘An edu- title are designated as an emergency require-
GENCY.—Section 1102(e) of the Johnny Isak- cational’’; ment pursuant to section 4(g) of the Statu-
son and David P. Roe, M.D. Veterans Health (B) by inserting ‘‘, except for the recruit- tory Pay-As-You-Go Act of 2010 (2 U.S.C.
Care and Benefits Improvement Act of 2020 ment of foreign students residing in foreign 933(g)).
(Public Law 116–315) is amended by striking countries who are not eligible to receive (b) DESIGNATION IN SENATE.—In the Senate,
‘‘December 21, 2021’’ and inserting ‘‘June 1, Federal student assistance’’ after ‘‘assist- amounts provided to carry out the amend-
2022’’. ance’’; and ments made by this subtitle are designated
(f) EXTENSION OF PROVISIONS RELATING TO (C) by adding at the end the following new as an emergency requirement pursuant to
EFFECTS OF CLOSURE OF EDUCATIONAL INSTI- paragraph: section 4112(a) of H. Con. Res. 71 (115th Con-
TUTION AND MODIFICATION OF COURSES BY ‘‘(2) In determining whether a violation of gress), the concurrent resolution on the
REASON OF COVID–19 EMERGENCY.—Section paragraph (1) has occurred, the Under Sec-
budget for fiscal year 2018.
1103(h) of such Act is amended by striking retary for Benefits shall construe the re- ---
‘‘December 21, 2021’’ and inserting ‘‘June 1, quirements of this paragraph in accordance SA 4806. Ms. SMITH (for herself and
2022’’. with the regulations and guidance prescribed
by the Secretary of Education under section Mr. YOUNG) submitted an amendment
(g) EXTENSION OF PROVISION RELATING TO intended to be proposed to amendment
487(a)(20) of the Higher Education Act of 1965
PAYMENT OF EDUCATIONAL ASSISTANCE IN (20 U.S.C. 1094(a)(20)).’’. SA 3867 submitted by Mr. REED and in-
CASES OF WITHDRAWAL.—Section 1104(a) of (c) EXEMPTION OF FOREIGN SCHOOLS FROM tended to be proposed to the bill H.R.
ctelli on DSK11ZRN23PROD with SENATE
such Act is amended by striking ‘‘December CERTAIN REQUIREMENTS.—
21, 2021’’ and inserting ‘‘June 1, 2022’’.
4350, to authorize appropriations for
(1) INFORMATION RELATING TO TESTS.—Sec- fiscal year 2022 for military activities
(h) EXTENSION OF PROVISION RELATING TO tion 3689(c) of title 38, United States Code, is
APPRENTICESHIP OR ON-JOB TRAINING RE- of the Department of Defense, for mili-
amended by adding at the end the following
QUIREMENTS.—Section 1106(b) of such Act is new paragraph: tary construction, and for defense ac-
amended by striking ‘‘December 21, 2021’’ and ‘‘(3) Subparagraph (G) of paragraph (1) tivities of the Department of Energy,
inserting ‘‘June 1, 2022’’. shall not apply with respect to an edu- to prescribe military personnel
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00088 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.054 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8495
strengths for such fiscal year, and for ment of Defense, the Department of Com- (c) AUTHORIZATION OF APPROPRIATIONS.—To
other purposes; which was ordered to merce, and other departments and agencies carry out this section, there is authorized to
lie on the table; as follows: as appropriate, shall develop, publish, and be appropriated such sums as may be nec-
submit to Congress a One Health Framework essary.
At the appropriate place, insert the fol-
(referred to in this section as the ‘‘frame- SEC. l04. GAO REPORT.
lowing:
work’’) for coordinated Federal activities Not later than 2 years after the date of the
TITLE ll—EMERGENCY PREPAREDNESS under the One Health Program. submission of the addendum under section
SEC. l01. SHORT TITLE. (2) CONTENTS OF FRAMEWORK.—The frame- l03(b)(3), the Comptroller General of the
This title may be cited as the ‘‘Advancing work described in paragraph (1) shall de- United States shall submit to Congress a re-
Emergency Preparedness Through One scribe existing efforts and contain rec- port that—
Health Act of 2021’’. ommendations for building upon and comple- (1) details existing collaborative efforts be-
SEC. l02. FINDINGS. menting the activities of the Department of tween the Department of the Interior, the
Congress finds the following: the Interior, the Centers for Disease Control Centers for Disease Control and Prevention,
(1) The term ‘‘One Health’’ reflects the and Prevention, the Food and Drug Adminis- the Food and Drug Administration, the De-
interconnectedness of human health, animal tration, the Office of the Assistant Secretary partment of Agriculture, the United States
health, and the environment. As technology for Preparedness and Response, the Depart- Agency for International Development, the
and population growth facilitates increased ment of Agriculture, the United States Environmental Protection Agency, the Na-
interaction of human settlements with wild- Agency for International Development, the tional Institutes of Health, the Department
life habitats and as international travel and Environmental Protection Agency, the Na- of Homeland Security, and other depart-
trade increases, the interface between these tional Institutes of Health, the Department ments and agencies to prevent and respond
elements will also continue to rise. of Homeland Security, and other depart- to zoonotic disease outbreaks in animals and
(2) When zoonotic diseases spill over to hu- ments and agencies, as appropriate, and humans; and
mans, there are often enormous health and shall— (2) contains an evaluation of the frame-
economic costs. The World Bank estimates (A) assess, identify, and describe, as appro- work and the specific activities requested to
that, between 1997 and 2009, the global costs priate, existing activities of Federal agencies achieve the framework.
from six zoonotic outbreaks exceeded and departments under the One Health Pro- ---
$80,000,000,000 and the Centers for Disease gram and consider whether all relevant agen- SA 4807. Ms. SMITH (for herself, Mr.
Control and Prevention estimates that there cies are adequately represented; CASSIDY, and Ms. WARREN) submitted
are annually 2,500,000,000 cases of zoonotic (B) for the 10-year period beginning in the an amendment intended to be proposed
infections globally, resulting in 2,700,000 year the framework is submitted, establish to amendment SA 3867 submitted by
deaths. specific Federal goals and priorities that Mr. REED and intended to be proposed
(3) There are also immense effects on the most effectively advance— to the bill H.R. 4350, to authorize ap-
agriculture sector. In 2014 and 2015, a high (i) scientific understanding of the connec- propriations for fiscal year 2022 for
pathogenic avian influenza (HPAI) outbreak tions between human, animal, and environ-
in the United States led to the cull of nearly mental health;
military activities of the Department
50,000,000 birds, and imposed up to approxi- (ii) coordination and collaboration between of Defense, for military construction,
mately $3,300,000,000 in losses for poultry and agencies involved in the framework includ- and for defense activities of the De-
egg farmers, animal feed producers, baked ing sharing data and information, engaging partment of Energy, to prescribe mili-
good production, and other related indus- in joint fieldwork, and engaging in joint lab- tary personnel strengths for such fiscal
tries. oratory studies related to One Health; year, and for other purposes; which was
(4) Public health preparedness depends on (iii) identification of priority zoonotic dis- ordered to lie on the table; as follows:
agriculture in a variety of ways. For exam- eases and priority areas of study; At the end of subtitle G of title X, add the
ple, a wide range of vaccines, including those (iv) surveillance of priority zoonotic dis- following:
for influenza, yellow fever, rabies, and mea- eases and their transmission between ani-
SEC. 1064. STUDY AND REPORT ON THE REDIS-
sles-mumps-rubella (MMR), are primarily mals and humans; TRIBUTION OF COVID–19 VACCINE
cultivated in poultry eggs. Egg shortages re- (v) prevention of priority zoonotic diseases DOSES THAT WOULD OTHERWISE
sulting from zoonotic disease outbreaks and their transmission between animals and EXPIRE TO FOREIGN COUNTRIES
could impose serious risks to vaccine manu- humans; AND ECONOMIES.
facturing efforts. (vi) protocol development to improve joint (a) STUDY.—
(5) It is estimated that approximately 80 outbreak response to and recovery from (1) IN GENERAL.—The Secretary of Health
percent of potential pathogens likely to be zoonotic disease outbreaks in animals and and Human Services, in consultation with
used in bioterrorism or biowarfare are com- humans; and the Secretary of State and the Adminis-
mon zoonotic pathogens. (vii) workforce development to prevent and trator of the United States Agency for Inter-
(6) While existing Federal Government ini- respond to zoonotic disease outbreaks in ani- national Development, shall conduct a study
tiatives related to One Health span multiple mals and humans; to identify and analyze the logistical pre-
agencies, including the Centers for Disease (C) describe specific activities required to requisites for the collection of unused and
Control and Prevention One Health office achieve the goals and priorities described in unexpired doses of the COVID–19 vaccine in
and the Department of Agriculture Animal subparagraph (B), and propose a timeline for the United States and for the distribution of
and Plant Health Inspection Services’ One achieving these goals; such doses to foreign countries and econo-
Health Coordination Center, additional (D) identify and expand partnerships, as mies.
interagency coordination is necessary to appropriate, among Federal agencies, States, (2) MATTERS STUDIED.—The matters studied
help better prevent, prepare for, and respond Indian tribes, academic institutions, non- by the Secretary of Health and Human Serv-
to zoonotic disease outbreaks. governmental organizations, and private en- ices under paragraph (1) shall include—
SEC. l03. INTERAGENCY ONE HEALTH PRO- tities in order to develop new approaches for (A) options for the collection of unused and
GRAM. reducing hazards to human and animal unexpired doses of the COVID–19 vaccine
(a) IN GENERAL.—The Secretary of the In- health and to strengthen understanding of from entities in the United States;
terior, the Secretary of Health and Human the value of an integrated approach under (B) methods for the collection and ship-
Services, and the Secretary of Agriculture the One Health Program to addressing public ment of such doses to foreign countries and
(referred to in this title as the ‘‘Secre- health threats in a manner that prevents du- economies;
taries’’), in coordination with the United plication; (C) methods for ensuring the appropriate
States Agency for International Develop- (E) identify best practices related to State storage and handling of such doses during
ment, the Environmental Protection Agen- and local-level research coordination, field and following the distribution and delivery
cy, the Department of Homeland Security, activities, and disease outbreak prepared- of the doses to such countries and econo-
the Department of Defense, the Department ness, response, and recovery related to One mies;
of Commerce, and other departments and Health; and (D) the capacity and capability of foreign
agencies as appropriate, shall develop, pub- (F) provide recommendations to Congress countries and economies receiving such
lish, and submit to Congress a national One regarding additional action or legislation doses to distribute and administer the doses
Health Framework (referred to in this title that may be required to assist in estab- while assuring their safety and quality;
as the ‘‘framework’’) for coordinated Federal lishing the One Health Program. (E) the minimum supply of doses of the
Activities under the One Health Program. (3) ADDENDUM.—Not later than 3 years COVID–19 vaccine necessary to be retained
ctelli on DSK11ZRN23PROD with SENATE
(b) NATIONAL ONE HEALTH FRAMEWORK.— after the creation of the framework, the Sec- within the United States; and
(1) IN GENERAL.—Not later than 1 year after retaries, in coordination with the agencies (F) other Federal agencies with which the
the date of enactment of this Act, the Secre- described in paragraph (1), shall submit to heads of the relevant agencies should coordi-
taries, in cooperation with the United States Congress an addendum to the framework nate to accomplish the tasks described in
Agency for International Development, the that describes the progress made in advanc- subparagraphs (A) through (E) and the de-
Environmental Protection Agency, the De- ing the activities described in the frame- gree of coordination necessary between such
partment of Homeland Security, the Depart- work. agencies.
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00089 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.054 S18NOPT1
S8496 CONGRESSIONAL RECORD — SENATE November 18, 2021
(b) REPORT REQUIRED.—Not later than 180 (5) Efforts to empower women and girls in istan during the past two decades, particu-
days after the date of the enactment of this Afghanistan continue to serve the national larly as related to the social, economic and
Act, the Secretary of Health and Human interests of Afghanistan and the United political empowerment of women and girls in
Services, in consultation with the other States because women are sources of peace society;
heads of the relevant agencies, shall submit and economic progress. (5) the continued provision of humani-
to the appropriate congressional committees (6) With the return of Taliban control, the tarian assistance in Afghanistan should be
a report on the results of the study con- United States has little ability to preserve targeted toward the most vulnerable, includ-
ducted under subsection (a). the human rights of women and girls in Af- ing for the protection, education, and well-
(c) DEFINITIONS.—In this section: ghanistan, and those women and girls may being of women and girls;
(1) APPROPRIATE CONGRESSIONAL COMMIT- again face the intimidation and (6) immediate and ongoing humanitarian
TEES.—The term ‘‘appropriate congressional marginalization they faced under the last needs in Afghanistan can only be met by a
committees’’ means— Taliban regime. humanitarian response that includes formal
(A) the Committee on Health, Education, (7) Women and girls in Afghanistan are agreements between local nongovernmental
Labor, and Pensions, and the Committee on again facing gender-based violence, includ- organizations and international partners
Foreign Relations of the Senate; and ing— that promotes the safe access and participa-
(B) the Committee on Energy and Com- (A) forced marriage; tion of female staff at all levels and across
merce, and the Committee on Foreign Af- (B) intimate partner and domestic vio- functional roles among all humanitarian ac-
fairs of the House of Representatives. lence; tors; and
(2) RELEVANT AGENCIES.—The term ‘‘rel- (C) sexual harassment; (7) a lack of aid would exacerbate the cur-
evant agencies’’ means— (D) sexual violence, including rape; and rent humanitarian crisis and harm the well-
(A) the Department of Health and Human (E) emotional and psychological violence. being of women and girls in Afghanistan.
Services; (8) Gender-based violence has always been (c) POLICY OF THE UNITED STATES REGARD-
(B) the Department of State; and a significant problem in Afghanistan and is ING THE RIGHTS OF WOMEN AND GIRLS OF AF-
(C) the United States Agency for Inter- expected to become more widespread with GHANISTAN.—
national Development. the Taliban in control. In 2020, even before (1) IN GENERAL.—It is the policy of the
--- the Taliban assumed control of the country, United States—
SA 4808. Mrs. FEINSTEIN (for her- some studies projected that 87 percent of Af- (A) to continue to support the internation-
ghan women and girls will experience at ally recognized human rights of women and
self, Ms. ERNST, Mr. DURBIN, Ms. COL-
least one form of gender-based violence in girls in Afghanistan following the with-
LINS, Ms. HIRONO, Ms. ROSEN, Mr.
their lifetime, with 62 percent experiencing drawal of the United States Armed Forces
PETERS, Mr. CORNYN, and Ms. multiple incidents of such violence. from Afghanistan, including through mecha-
DUCKWORTH) submitted an amendment (9) Prior to the Taliban takeover in August nisms to hold all parties publicly account-
intended to be proposed to amendment 2021, approximately 7,000,000 people in Af- able for violations of international humani-
SA 3867 submitted by Mr. REED and in- ghanistan lacked or had limited access to tarian law and violations of such rights
tended to be proposed to the bill H.R. emergency and primary health services as a against women and girls;
4350, to authorize appropriations for result of inadequate public health coverage, (B) to strongly oppose any weakening of
weak health systems, and conflict-related the political or economic rights of women
fiscal year 2022 for military activities interruptions in care. and girls in Afghanistan;
of the Department of Defense, for mili- (10) Women and girls faced additional chal- (C) to use the voice and influence of the
tary construction, and for defense ac- lenges, as their access to prenatal, child- United States at the United Nations to pro-
tivities of the Department of Energy, birth, and postpartum care was limited due mote, respect, and uphold the internation-
to prescribe military personnel to a shortage of female medical staff, cul- ally recognized human rights of the women
strengths for such fiscal year, and for tural barriers, stigma and fears of reprisals and girls of Afghanistan, including the right
other purposes; which was ordered to following sexual violence, or other barriers to safely work;
to mobility, including security fears. (D) to identify individuals who violate the
lie on the table; as follows:
(11) Only approximately 50 percent of preg- internationally recognized human rights of
At the end of subtitle B of title XII, add nant women and girls in Afghanistan deliver women and girls in Afghanistan, such as by
the following: their children in a health facility with a pro- committing acts of murder, lynching, and
SEC. 1216. STATUS OF WOMEN AND GIRLS IN AF- fessional attendant, which increases the risk grievous domestic violence against women,
GHANISTAN. of complications in childbirth and prevent- and to press for bringing those individuals to
(a) FINDINGS.—Congress finds the fol- able maternal mortality. justice; and
lowing: (12) Food insecurity in Afghanistan is also (E) to systematically consult with Afghan
(1) Since May 2021, the escalation of vio- posing a variety of threats to women and women and girls on their needs and priorities
lent conflict in Afghanistan has forcibly dis- girls, as malnutrition weakens their immune in the development, implementation, and
placed an estimated 655,000 civilians, and 80 systems and makes them more susceptible to monitoring of humanitarian action, includ-
percent of those forced to flee are women and infections, complications during pregnancy, ing women and girls who are part of the Af-
children. and risks during childbirth. ghan diaspora community.
(2) Since regaining control of Afghanistan (13) With the combined impacts of ongoing (d) HUMANITARIAN ASSISTANCE AND AFGHAN
in August 2021, the Taliban have taken ac- conflict and COVID–19, Afghan households WOMEN.—The Administrator of the United
tions reminiscent of their brutal rule in the increasingly resort to child marriage, forced States Agency for International Develop-
late 1990s, including by cracking down on marriage, and child labor to address food in- ment should work to ensure that Afghan
protesters, detaining and beating journalists, security and other effects of extreme pov- women are employed and enabled to work in
reestablishing the Ministry for the Pro- erty. the delivery of humanitarian assistance in
motion of Virtue and Prevention of Vice, and (14) In Afghanistan, the high prevalence of Afghanistan, to the extent practicable.
requiring women to study at universities in anemia among adolescent girls reduces their (e) REPORT ON WOMEN AND GIRLS IN AF-
gender-segregated classrooms while wearing ability to survive childbirth, especially when GHANISTAN.—
Islamic attire. coupled with high rates of child marriage (1) IN GENERAL.—Not later than 180 days
(3) Until the Taliban assumed control of and forced marriage and barriers to access- after the date of the enactment of this Act,
the country in August 2021, the women and ing prenatal and childbirth services. and every 180 days thereafter through 2024,
girls of Afghanistan had achieved much since (b) SENSE OF CONGRESS.—It is the sense of the Secretary of State shall submit to the
2001, even as insecurity, poverty, under- Congress that— appropriate committees of Congress, and
development, and patriarchal norms contin- (1) since 2001, organizations and networks make available to the public, a report that
ued to limit their rights and opportunities in promoting the empowerment of women and includes the following:
much of Afghanistan. girls have been important engines of social, (A) An assessment of the status of women
(4) Through strong support from the United economic, and political development in Af- and girls in Afghanistan following the depar-
States and the international community— ghanistan; ture of United States and partner military
(A) female enrollment in public schools in (2) any future political order in Afghani- forces, including with respect to access to
Afghanistan continued to increase through stan should secure the political, economic, primary and secondary education, jobs, pri-
2015, with an estimated high of 50 percent of and social gains made by Afghan women and mary and emergency health care, and legal
school age girls attending; and work to increase the equal treatment of protections and status.
(B) by 2019— women and girls; (B) An assessment of the political and civic
ctelli on DSK11ZRN23PROD with SENATE
(i) women held political leadership posi- (3) respecting the internationally recog- participation of women and girls in Afghani-
tions, and women served as ambassadors; and nized human rights of all people is essential stan.
(ii) women served as professors, judges, to securing lasting peace and sustainable de- (C) An assessment of the prevalence of gen-
prosecutors, defense attorneys, police, mili- velopment in Afghanistan; der-based violence in Afghanistan.
tary members, health professionals, journal- (4) in cooperation with international part- (D) A report on funds for United States for-
ists, humanitarian and developmental aid ners, the United States must endeavor to eign assistance obligated or expended during
workers, and entrepreneurs. preserve the hard-won gains made in Afghan- the period covered by the report to advance
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00090 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.055 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8497
gender equality and the internationally rec- and civilian employees of the Department of nate the Unidentified Aerial Phenomenon
ognized human rights of women and girls in Defense in identifying, preventing, respond- Task Force or subordinate it to the Office.
Afghanistan, including funds directed toward ing to, reporting, and mitigating the risk of (b) FACILITATION OF REPORTING AND DATA
local organizations promoting such rights of extremist activities. SHARING.—The Director and the Secretary
women and girls, that includes the following: (2) CONTENT.—The training and education shall each, in coordination with each other,
(i) The amounts awarded to principal re- described in paragraph (1) shall include spe- require that—
cipients and sub-recipients for such purposes cific material for activities determined by (1) each element of the intelligence com-
during the reporting period. the Senior Official for Countering Extre- munity and the Department, with any data
(ii) A description of each program for mism as high risk for extremist activities, that may be relevant to the investigation of
which such funds are used for such purposes. including recruitment activities and sepa- unidentified aerial phenomena, make such
(2) ASSESSMENT.— rating members of the Armed Forces. data available immediately to the Office;
(A) INPUT.—The assessment described in (3) REQUIREMENTS.—The Secretary of De- and
paragraph (1)(A) shall include the input of— fense, in consultation with the Secretary of (2) military and civilian personnel em-
(i) Afghan women and girls; Homeland Security, shall provide the train- ployed by or under contract to the Depart-
(ii) organizations employing and working ing and education described paragraph (1)— ment or an element of the intelligence com-
with Afghan women and girls; and (A) to a member of the Armed Forces, ci- munity shall have access to procedures by
(iii) humanitarian organizations, including vilian employee of the Department of De- which they shall report incidents or informa-
faith-based organizations, providing assist- fense, or an individual in a pre-commis- tion, including adverse physiological effects,
ance in Afghanistan. sioning program no less than once a year; involving or associated with unidentified
(B) SAFETY AND CONFIDENTIALITY.—In car- (B) to a member of the Armed Forces aerial phenomena directly to the Office.
rying out the assessment described in para- whose discharge (regardless of character of (c) DUTIES.—The duties of the Office estab-
graph (1)(A), the Secretary shall, to the max- discharge) or release from active duty is an- lished under subsection (a) shall include the
imum extent practicable, ensure the safety ticipated as of a specific date within the following:
and confidentiality of personal information time period specified under section 1142(a)(3) (1) Developing procedures to synchronize
of each individual who provides information of title, United States Code; and standardize the collection, reporting,
from within Afghanistan. (C) to a member of the Armed Forces per- and analysis of incidents, including adverse
(3) DEFINITION OF APPROPRIATE COMMITTEES forming recruitment activities within the 30 physiological effects, regarding unidentified
OF CONGRESS.—In this subsection, the term days prior to commencing such activities; aerial phenomena across the Department and
‘‘appropriate committees of Congress’’ and in consultation with the intelligence com-
means— (D) additionally as determined by the Sec- munity.
(A) the Committee on Foreign Relations retary of Defense. (2) Developing processes and procedures to
and the Committee on Appropriations of the (c) PROGRESS REPORT.—Not later than 180 ensure that such incidents from each compo-
Senate; and days after the date of the enactment of this nent of the Department and each element of
(B) the Committee on Foreign Affairs and Act, the Secretary of Defense shall submit to the intelligence community are reported and
the Committee on Appropriations of the the Committees on Armed Services of the incorporated in a centralized repository.
House of Representatives. Senate and House of Representatives a re- (3) Establishing procedures to require the
port on the status of the implementation of timely and consistent reporting of such inci-
SA 4809. Mr. WARNER submitted an this section. dents.
amendment intended to be proposed to (4) Evaluating links between unidentified
amendment SA 3867 submitted by Mr. SA 4810. Mrs. GILLIBRAND (for her- aerial phenomena and adversarial foreign
REED and intended to be proposed to self, Mr. RUBIO, Mr. HEINRICH, Mr. governments, other foreign governments, or
the bill H.R. 4350, to authorize appro- BLUNT, and Mr. GRAHAM) submitted an nonstate actors.
priations for fiscal year 2022 for mili- amendment intended to be proposed to (5) Evaluating the threat that such inci-
tary activities of the Department of amendment SA 3867 submitted by Mr. dents present to the United States.
REED and intended to be proposed to (6) Consulting with other departments and
Defense, for military construction, and agencies of the Federal Government, as ap-
for defense activities of the Depart- the bill H.R. 4350, to authorize appro-
priations for fiscal year 2022 for mili- propriate, including the Federal Aviation
ment of Energy, to prescribe military Administration, the National Aeronautics
personnel strengths for such fiscal tary activities of the Department of
and Space Administration, the Department
year, and for other purposes; which was Defense, for military construction, and of Homeland Security, the National Oceanic
ordered to lie on the table; as follows: for defense activities of the Depart- and Atmospheric Administration, and the
At the end of subtitle E of title V, add the
ment of Energy, to prescribe military Department of Energy.
following: personnel strengths for such fiscal (7) Consulting with allies and partners of
SEC. 576.COUNTERING EXTREMISM IN THE year, and for other purposes; which was the United States, as appropriate, to better
ARMED FORCES. ordered to lie on the table; as follows: assess the nature and extent of unidentified
(a) IN GENERAL.—The Secretary of Defense At the appropriate place in title XV, insert aerial phenomena.
shall— the following: (8) Preparing reports for Congress, in both
(1) promulgate policy that prohibits and SEC. lll. ESTABLISHMENT OF STRUCTURE classified and unclassified form, as required
defines participation in extremist activities; AND AUTHORITIES TO ADDRESS UN- by subsections (h) and (i).
(2) develop and implement programs, re- IDENTIFIED AERIAL PHENOMENA. (d) EMPLOYMENT OF LINE ORGANIZATIONS
sources, and activities to counter extremism (a) ESTABLISHMENT OF ANOMALY SURVEIL- FOR FIELD INVESTIGATIONS OF UNIDENTIFIED
within the Armed Forces, including screen- LANCE, TRACKING, AND RESOLUTION OFFICE.— AERIAL PHENOMENA.—
ing of publicly available information and In- (1) IN GENERAL.—Not later than 180 days (1) IN GENERAL.—The Secretary shall, in co-
sider Threat Programs; after the date of the enactment of this Act, ordination with the Director, designate line
(3) collect and report data on incidents, al- the Secretary of Defense shall, in coordina- organizations within the Department of De-
legations, investigations, disciplinary ac- tion with the Director of National Intel- fense and the intelligence community that
tions, and separations related to extremism, ligence, establish an office within an appro- possess appropriate expertise, authorities,
as well as publication of reports on these priate component of the Department of De- accesses, data, systems, platforms, and capa-
data in a regular, public, and transparent fense, or within a joint organization of the bilities to rapidly respond to, and conduct
manner; and Department of Defense and the Office of the field investigations of, incidents involving
(4) designate a senior official, to be known Director of National Intelligence, to as- unidentified aerial phenomena under the di-
as the ‘‘Senior Official for Countering Extre- sume— rection of the Office.
mism’’, within the Department of Defense as (A) the duties of the Unidentified Aerial (2) PERSONNEL, EQUIPMENT, AND RE-
responsible for facilitation and coordination Phenomenon Task Force, as in effect on the SOURCES.—The Secretary, in coordination
of the activities described in this subsection day before the date of the enactment of this with the Director, shall take such actions as
with personnel and readiness officials, law Act; and may be necessary to ensure that the des-
enforcement organizations, security organi- (B) such other duties as are required by ignated organization or organizations have
zations, insider threat programs, and watch this section. available adequate personnel with requisite
lists related to extremism in the Armed (2) DESIGNATION.—The office established expertise, equipment, transportation, and
Forces. under paragraph (1) shall be known as the other resources necessary to respond rapidly
ctelli on DSK11ZRN23PROD with SENATE
(b) TRAINING AND EDUCATION.— ‘‘Anomaly Surveillance, Tracking, and Reso- to incidents or patterns of observations of
(1) IN GENERAL.—The Secretary of each lution Office’’ (in this section referred to as unidentified aerial phenomena of which the
military department, in coordination with the ‘‘Office’’). Office becomes aware.
the Senior Official for Countering Extre- (3) TERMINATION OR SUBORDINATION OF (e) UTILIZATION OF LINE ORGANIZATIONS FOR
mism, shall develop and implement training PRIOR TASK FORCE.—Upon the establishment SCIENTIFIC, TECHNOLOGICAL, AND OPER-
and education programs and related mate- of the Anomaly Surveillance, Tracking, and ATIONAL ANALYSES OF DATA ON UNIDENTIFIED
rials to assist members of the Armed Forces Resolution Office, the Secretary shall termi- AERIAL PHENOMENA.—
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00091 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.055 S18NOPT1
S8498 CONGRESSIONAL RECORD — SENATE November 18, 2021
(1) IN GENERAL.—The Secretary, in coordi- (i) geospatial intelligence (3) SUBSEQUENT BRIEFINGS.—Each briefing
nation with the Director, shall designate one (ii) signals intelligence; provided subsequent to the first briefing de-
or more line organizations that will be pri- (iii) human intelligence; and scribed in paragraph (2) shall include, at a
marily responsible for scientific, technical, (iv) measurement and signals intelligence. minimum, all events relating to unidentified
and operational analysis of data gathered by (C) The number of reported incidents of un- aerial phenomena that occurred during the
field investigations conducted under sub- identified aerial phenomena over restricted previous 180 days, and events relating to un-
section (d), or data from other sources, in- air space of the United States. identified aerial phenomena that were not
cluding testing of materials, medical studies, (D) An analysis of such incidents identified included in an earlier briefing due to delay
and development of theoretical models to under subparagraph (C). in an incident reaching the reporting system
better understand and explain unidentified (E) Identification of potential aerospace or or other such factors.
aerial phenomena. other threats posed by unidentified aerial (4) INSTANCES IN WHICH DATA WAS NOT
(2) AUTHORITY.—The Secretary and the Di- phenomena to the national security of the SHARED.—For each briefing period, the Chair-
rector shall promulgate such directives as United States. man and Vice Chairman or Ranking Member
necessary to ensure that the designated line (F) An assessment of any activity regard- of the Committee on Armed Services and the
organizations have authority to draw on spe- ing unidentified aerial phenomena that can Select Committee on Intelligence of the Sen-
cial expertise of persons outside the Federal be attributed to one or more adversarial for- ate and the Committee on Armed Services
Government with appropriate security clear- eign governments. and the Permanent Select Committee on In-
ances. (G) Identification of any incidents or pat- telligence of the House of Representatives
(f) INTELLIGENCE COLLECTION AND ANALYSIS terns regarding unidentified aerial phe- shall receive an enumeration of any in-
PLAN.— nomena that indicate a potential adversarial stances in which data related to unidentified
(1) IN GENERAL.—The head of the Office foreign government may have achieved a aerial phenomena was denied to the Office
shall supervise the development and execu- breakthrough aerospace capability. because of classification restrictions on that
tion of an intelligence collection and anal- (H) An update on the coordination by the data or for any other reason.
ysis plan on behalf of the Secretary and the United States with allies and partners on ef-
Director to gain as much knowledge as pos- forts to track, understand, and address un- (l) AERIAL AND TRANSMEDIUM PHENOMENA
sible regarding the technical and operational identified aerial phenomena. ADVISORY COMMITTEE.—
characteristics, origins, and intentions of (I) An update on any efforts to capture or (1) ESTABLISHMENT.—(A) Not later than Oc-
unidentified aerial phenomena, including the exploit discovered unidentified aerial phe- tober 1, 2022, the Secretary and the Director
development, acquisition, deployment, and nomena. shall establish an advisory committee for
operation of technical collection capabilities (J) An assessment of any health-related ef- the purpose of—
necessary to detect, identify, and scientif- fects for individuals who have encountered (i) advising the Office in the execution of
ically characterize unidentified aerial phe- unidentified aerial phenomena. the duties of the Office as provided by this
nomena. (K) The number of reported incidents, and subsection; and
(2) USE OF RESOURCES AND CAPABILITIES.—In descriptions thereof, of unidentified aerial (ii) advising the Secretary and the Director
developing the plan required by paragraph phenomena associated with military nuclear regarding the gathering and analysis of data,
(1), the head of the Office shall consider and assets, including strategic nuclear weapons and scientific research and development per-
propose, as appropriate, the use of any re- and nuclear-powered ships and submarines. taining to unidentified aerial phenomena.
source, capability, asset, or process of the (L) In consultation with the Administrator (B) The advisory committee established
Department and the intelligence commu- of the National Nuclear Security Adminis- under subparagraph (A) shall be known as
nity. tration, the number of reported incidents, the ‘‘Aerial and Transmedium Phenomena
(g) SCIENCE PLAN.—The head of the Office and descriptions thereof, of unidentified aer- Advisory Committee’’ (in this subparagraph
shall supervise the development and execu- ial phenomena associated with facilities or the ‘‘Committee’’).
tion of a science plan on behalf of the Sec- assets associated with the production, trans- (2) MEMBERSHIP.—(A) Subject to subpara-
retary and the Director to develop and test, portation, or storage of nuclear weapons or graph (B), the Committee shall be composed
as practicable, scientific theories to account components thereof. of members as follows:
for characteristics and performance of un- (M) In consultation with the Chairman of (i) 20 members selected by the Secretary as
identified aerial phenomena that exceed the the Nuclear Regulatory Commission, the follows:
known state of the art in science or tech- number of reported incidents, and descrip- (I) Three members selected from among in-
nology, including in the areas of propulsion, tions thereof, of unidentified aerial phe- dividuals recommended by the Adminis-
aerodynamic control, signatures, structures, nomena or drones of unknown origin associ- trator of the National Astronautics and
materials, sensors, countermeasures, weap- ated with nuclear power generating stations, Space Administration.
ons, electronics, and power generation, and nuclear fuel storage sites, or other sites or (II) Two members selected from among in-
to provide the foundation for potential fu- facilities regulated by the Nuclear Regu- dividuals recommended by the Adminis-
ture investments to replicate any such ad- latory Commission. trator of the Federal Aviation Administra-
vanced characteristics and performance. (N) The names of the line organizations
(h) ASSIGNMENT OF PRIORITY.—The Direc- tion.
that have been designated to perform the (III) Two members selected from among in-
tor, in consultation with, and with the rec-
specific functions imposed by subsections (d) dividuals recommended by the President of
ommendation of the Secretary, shall assign
and (e) of this section, and the specific func- the National Academies of Sciences.
an appropriate level of priority within the
tions for which each such line organization (IV) Two members selected from among in-
National Intelligence Priorities Framework
has been assigned primary responsibility. dividuals recommended by the President of
to the requirement to understand, charac-
(3) FORM.— Each report submitted under the National Academy of Engineering.
terize, and respond to unidentified aerial
paragraph (1) shall be submitted in unclassi- (V) One member selected from among indi-
phenomena.
(i) AUTHORIZATION OF APPROPRIATIONS.— fied form, but may include a classified viduals recommended by the President of the
There is authorized to be appropriated such annex. National Academy of Medicine.
sums as may be necessary to carry out the (k) SEMIANNUAL BRIEFINGS.— (VI) Three members selected from among
work of the Office, including— (1) IN GENERAL.—Not later than 90 days individuals recommended by the Director of
(1) general intelligence gathering and in- after the date of the enactment of this Act the Galileo Project at Harvard University.
telligence analysis; and and not less frequently than semiannually (VII) Two members selected from among
(2) strategic defense, space defense, defense thereafter until December 31, 2026, the head individuals recommended by the Board of Di-
of controlled air space, defense of ground, of the Office shall provide the classified rectors of the Scientific Coalition for Un-
air, or naval assets, and related purposes. briefings on unidentified aerial phenomena identified Aerospace Phenomena Studies.
(j) ANNUAL REPORT.— to— (VIII) Two members selected from among
(1) REQUIREMENT.—Not later than October (A) the Committee on Armed Services, the individuals recommended by the President of
31, 2022, and annually thereafter until Octo- Select Committee on Intelligence, and the the American Institute of Astronautics and
ber 31, 2026, the Secretary in consultation Committee on Appropriations of the Senate; Aeronautics.
with the Director, shall submit to the appro- and (IX) Two members selected from among in-
priate committees of Congress a report on (B) the Committee on Armed Services, the dividuals recommended by the Director of
unidentified aerial phenomena. Permanent Select Committee on Intel- the Optical Technology Center at Montana
(2) ELEMENTS.—Each report under para- ligence, and the Committee on Appropria- State University.
graph (1) shall include, with respect to the tions of the House of Representatives. (X) One member selected from among indi-
ctelli on DSK11ZRN23PROD with SENATE
year covered by the report, the following in- (2) FIRST BRIEFING.—The first briefing pro- viduals recommended by the president of the
formation: vided under paragraph (1) shall include all American Society for Photogrammetry and
(A) An analysis of data and intelligence re- incidents involving unidentified aerial phe- Remote Sensing.
ceived through reports of unidentified aerial nomena that were reported to the Unidenti- (ii) Up to five additional members, as the
phenomena. fied Aerial Phenomena Task Force or to the Secretary, in consultation with the Director,
(B) An analysis of data relating to uniden- Office after June 24, 2021, regardless of the considers appropriate, selected from among
tified aerial phenomena collected through— date of occurrence of the incident. individuals with requisite expertise, at least
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00092 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.056 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8499
3 of whom shall not be employees of any Fed- mittee on Foreign Relations, and the Com- partment of Defense, for military con-
eral Government agency or Federal Govern- mittee on Appropriations of the Senate; and struction, and for defense activities of
ment contractor. (B) the Committee on Armed Services, the the Department of Energy, to prescribe
(B) No individual may be appointed to the Permanent Select Committee on Intel- military personnel strengths for such
Committee under subparagraph (A) unless ligence, the Committee on Foreign Affairs,
the Secretary and the Directly jointly deter- and the Committee on Appropriations of the
fiscal year, and for other purposes;
mine that the individual— House of Representatives. which was ordered to lie on the table;
(i) qualifies for a security clearance at the (2) The term ‘‘intelligence community’’ as follows:
secret level or higher; has the meaning given such term in section At the appropriate place, insert the fol-
(ii) possesses scientific, medical, or tech- 3 of the National Security Act of 1947 (50 lowing:
nical expertise pertinent to some aspect of U.S.C. 3003). SEC. llll. PROHIBITING TSP INVESTMENT IN
the investigation and analysis of unidenti- (3) The term ‘‘transmedium objects or de- CHINA.
fied aerial phenomena; and vices’’ means objects or devices that are ob- (a) FINDINGS.—Congress finds the fol-
(iii) has previously conducted research or served to transition between space and the lowing:
writing that demonstrates scientific, techno- atmosphere, or between the atmosphere and (1) The Thrift Savings Fund invests more
logical, or operational knowledge regarding bodies of water, that are not immediately than $700,000,000,000 on behalf of plan partici-
aspects of the subject matter, including pro- identifiable. pants. As the guardian of the retirement
pulsion, aerodynamic control, signatures, (4) The term ‘‘unidentified aerial phe- funds of approximately 6,000,000 Federal ci-
structures, materials, sensors, counter- nomena’’ means— vilian and military plan participants, it is
measures, weapons, electronics, power gen- (A) airborne objects that are not imme- critical that sums in the Thrift Savings
eration, field investigations, forensic exam- diately identifiable; Fund are not invested in securities linked to
ination of particular cases, analysis of open (B) transmedium objects or devices; and the economy of the People’s Republic of
source and classified information regarding (C) submerged objects or devices that are China.
domestic and foreign research and com- not immediately identifiable and that dis- (2) Companies headquartered in the Peo-
mentary, and historical information per- play behavior or performance characteristics ple’s Republic of China have repeatedly com-
taining to unidentified aerial phenomena. suggesting that they may be related to the mitted corporate espionage, violated sanc-
(C) The Secretary and Director may termi- subjects described in subparagraph (A) or tions imposed by the United States, flouted
nate the membership of any individual on (B). international property laws, committed
the Committee upon a finding by the Sec- theft, and failed to comply with audit and
retary and the Director jointly that the SA 4811. Mr. TUBERVILLE (for him- regulatory standards designed to safeguard
member no longer meets the criteria speci- self and Mr. BRAUN) submitted an investors.
fied in this subsection. amendment intended to be proposed to (3) The Thrift Savings Plan is known for
(3) CHAIRPERSON.—The Secretary shall, in its low management fees and comprehensive
amendment SA 3867 submitted by Mr. array of investment strategies. The provi-
coordination with the Director, designate a
REED and intended to be proposed to sions of this section, and the amendments
temporary Chairperson of the Committee,
but at the earliest practicable date the Com- the bill H.R. 4350, to authorize appro- made by this section, will not increase fees
mittee shall elect a Chairperson from among priations for fiscal year 2022 for mili- imposed on participants of the Thrift Sav-
its members, who will serve a term of 2 tary activities of the Department of ings Plan.
years, and is eligible for re-election. Defense, for military construction, and (4) The November 2017 selection of the
(4) EXPERT ASSISTANCE, ADVICE, AND REC- for defense activities of the Depart- MSCI ACWI Index by the Federal Retirement
OMMENDATIONS.—(A) The Committee may, ment of Energy, to prescribe military Thrift Investment Board, initially scheduled
upon invitation of the head of the Office, to be effective in 2020, would violate the
personnel strengths for such fiscal terms of subsection (i) of section 8438 of title
provide expert assistance or advice to any
year, and for other purposes; which was 5, United States Code, as added by subsection
line organization designated to carry out
field investigations or data analysis as au- ordered to lie on the table; as follows: (b)(1) of this section.
thorized by subsections (d) and (e). At the appropriate place, insert the fol- (b) PROHIBITION ON ANY TSP FUND INVEST-
(B) The Committee, on its own initiative, lowing: ING IN ENTITIES BASED IN THE PEOPLE’S RE-
or at the request of the Director, the Sec- SEC. lll. PROHIBITING THE INTERNAL REV- PUBLIC OF CHINA.—
retary, or the head of the Office, may provide ENUE SERVICE FROM REQUIRING FI- (1) IN GENERAL.—Section 8438 of title 5,
advice and recommendations regarding best NANCIAL INSTITUTIONS TO REPORT United States Code, is amended by adding at
ON FINANCIAL TRANSACTIONS OF the end the following:
practices with respect to the gathering and CUSTOMERS. ‘‘(i) Notwithstanding any other provision
analysis of data on unidentified aerial phe-
(a) IN GENERAL.—Subject to subsection (b), of this section, no fund established or over-
nomena in general, or commentary regarding
the Internal Revenue Service shall not be seen by the Board may include an invest-
specific incidents, cases, or classes of uniden-
permitted to create or implement any new ment in any security of—
tified aerial phenomena.
financial account information reporting pro- ‘‘(1) an entity based in the People’s Repub-
(5) REPORT.—Not later than December 31,
gram that— lic of China; or
2022, and not later than December 31 of each
(1) was not in effect as of October 1, 2021, ‘‘(2) any subsidiary that is owned or oper-
year thereafter, the Committee shall submit
and ated by an entity described in paragraph
a report summarizing its activities and rec-
(2) would require financial institutions to (1).’’.
ommendations to the following:
report data on financial accounts in an infor- (2) DIVESTITURE OF ASSETS.—Not later than
(A) The Secretary.
mation return listing balances, transactions, 30 days after the date of enactment of this
(B) The Director.
transfers, or inflows or outflows of any kind. Act, the Federal Retirement Thrift Invest-
(C) The head of the Office.
(b) RULE OF CONSTRUCTION.— ment Board established under section 8472(a)
(D) The Committee on Armed Services, the
(1) IN GENERAL.—Nothing in this section of title 5, United States Code, shall—
Select Committee on Intelligence, and the
shall preempt, limit, or supersede, or be con- (A) review whether any sums in the Thrift
Committee on Appropriations of the Senate.
strued to preempt, limit, or supersede, any Savings Fund are invested in violation of
(E) The Committee on Armed Services, the
provision of, or requirement under, the Bank subsection (i) of section 8438 of that title, as
Permanent Select Committee on Intel-
Secrecy Act or any regulations promulgated added by paragraph (1) of this subsection;
ligence, and the Committee on Appropria-
under such Act. (B) if any sums are invested in the manner
tions of the House of Representatives.
(2) DEFINITION.—For purposes of this sub- described in subparagraph (A), divest those
(6) RELATION TO FACA.—For purposes of the
section, the term ‘‘Bank Secrecy Act’’ sums in a manner that is consistent with the
Federal Advisory Committee Act (5 U.S.C.
means— legal and fiduciary duties provided under
App.), the Committee shall be considered an
(A) section 21 of the Federal Deposit Insur- chapter 84 of that title, or any other applica-
advisory committee (as defined in section 3
ance Act (12 U.S.C. 1829b), ble provision of law; and
of such Act, except as otherwise provided in
(B) chapter 2 of title I of Public Law 91–508 (C) reinvest any sums divested under sub-
the section or as jointly deemed warranted
(12 U.S.C. 1951 et seq.), and paragraph (B) in investments that do not
by the Secretary and the Director under sec-
(C) subchapter II of chapter 53 of title 31, violate subsection (i) of section 8438 of that
tion 4(b)(3) of such Act.
United States Code. title, as added by paragraph (1) of this sub-
(7) TERMINATION OF COMMITTEE.—The Com-
section.
mittee shall terminate on the date that is
SA 4812. Mr. TUBERVILLE sub- (c) PROHIBITION ON INVESTMENT OF TSP
ctelli on DSK11ZRN23PROD with SENATE
six years after the date of the establishment FUNDS IN ENTITIES BASED IN THE PEOPLE’S
of the Committee. mitted an amendment intended to be
proposed to amendment SA 3867 sub- REPUBLIC OF CHINA THROUGH THE TSP MU-
(m) DEFINITIONS.—In this section: TUAL FUND WINDOW.—Section 8438(b)(5) of
(1) The term ‘‘appropriate committees of mitted by Mr. REED and intended to be title 5, United States Code, is amended by
Congress’’ means— proposed to the bill H.R. 4350, to au- adding at the end the following:
(A) the Committee on Armed Services, the thorize appropriations for fiscal year ‘‘(E) A mutual fund accessible through a
Select Committee on Intelligence, the Com- 2022 for military activities of the De- mutual fund window authorized under this
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00093 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.056 S18NOPT1
S8500 CONGRESSIONAL RECORD — SENATE November 18, 2021
paragraph may not include an investment in thorization Act for Fiscal Year 2021 (6 U.S.C. public health and safety, and to have a more
any security of— 1500(c)(1)(H)). accurate picture of the cyber threat to crit-
‘‘(i) an entity based in the People’s Repub- ‘‘(3) COVERED CYBER INCIDENT.—The term ical infrastructure and the people of the
lic of China; or ‘covered cyber incident’ means a substantial United States;
‘‘(ii) any subsidiary that is owned or oper- cyber incident experienced by a covered enti- ‘‘(2) receive, aggregate, analyze, and secure
ated by an entity described in clause (i).’’. ty that satisfies the definition and criteria reports to lead the identification of tactics,
--- established by the Director in the final rule techniques, and procedures used to perpet-
SA 4813. Mr. SCOTT of Florida sub- issued pursuant to section 2232(b). uate cyber incidents and ransomware at-
mitted an amendment intended to be ‘‘(4) COVERED ENTITY.—The term ‘covered tacks;
proposed to amendment SA 3867 sub- entity’ means— ‘‘(3) coordinate and share information with
‘‘(A) any Federal contractor; or appropriate Federal departments and agen-
mitted by Mr. REED and intended to be
‘‘(B) an entity that owns or operates crit- cies to identify and track ransom payments,
proposed to the bill H.R. 4350, to au- including those utilizing virtual currencies;
ical infrastructure that satisfies the defini-
thorize appropriations for fiscal year tion established by the Director in the final ‘‘(4) leverage information gathered about
2022 for military activities of the De- rule issued pursuant to section 2232(b). cybersecurity incidents to—
partment of Defense, for military con- ‘‘(5) CYBER INCIDENT.—The term ‘cyber in- ‘‘(A) enhance the quality and effectiveness
struction, and for defense activities of cident’ has the meaning given the term ‘inci- of information sharing and coordination ef-
the Department of Energy, to prescribe dent’ in section 2200. forts with appropriate entities, including
military personnel strengths for such ‘‘(6) CYBER THREAT.—The term ‘cyber agencies, sector coordinating councils, infor-
threat’— mation sharing and analysis organizations,
fiscal year, and for other purposes; technology providers, critical infrastructure
‘‘(A) has the meaning given the term ‘cy-
which was ordered to lie on the table; owners and operators, cybersecurity and in-
bersecurity threat’ in section 2200; and
as follows: ‘‘(B) does not include any activity related cident response firms, and security research-
At the end, add the following: to good faith security research, including ers; and
DIVISION E—CYBER INCIDENT REPORT- participation in a bug-bounty program or a ‘‘(B) provide appropriate entities, includ-
ING ACT OF 2021 AND CISA TECHNICAL vulnerability disclosure program. ing agencies, sector coordinating councils,
CORRECTIONS AND IMPROVEMENTS ‘‘(7) FEDERAL CONTRACTOR.—The term ‘Fed- information sharing and analysis organiza-
ACT OF 2021 eral contractor’ means a business, nonprofit tions, technology providers, cybersecurity
organization, or other private sector entity and incident response firms, and security re-
TITLE LI—CYBER INCIDENT REPORTING
that holds a Federal Government contract or searchers, with timely, actionable, and
ACT OF 2021
subcontract at any tier, grant, cooperative anonymized reports of cyber incident cam-
SEC. 5101. SHORT TITLE. paigns and trends, including, to the max-
agreement, or other transaction agreement,
This title may be cited as the ‘‘Cyber Inci- imum extent practicable, related contextual
unless that entity is a party only to—
dent Reporting Act of 2021’’. information, cyber threat indicators, and de-
‘‘(A) a service contract to provide house-
SEC. 5102. DEFINITIONS.
keeping or custodial services; or fensive measures, pursuant to section 2235;
In this title: ‘‘(B) a contract to provide products or serv- ‘‘(5) establish mechanisms to receive feed-
(1) COVERED CYBER INCIDENT; COVERED ENTI- ices unrelated to information technology back from stakeholders on how the Agency
TY; CYBER INCIDENT.—The terms ‘‘covered can most effectively receive covered cyber
that is below the micro-purchase threshold,
cyber incident’’, ‘‘covered entity’’, and incident reports, ransom payment reports,
as defined in section 2.101 of title 48, Code of
‘‘cyber incident’’ have the meanings given and other voluntarily provided information;
Federal Regulations, or any successor regu-
those terms in section 2230 of the Homeland ‘‘(6) facilitate the timely sharing, on a vol-
lation.
Security Act of 2002, as added by section 5103 untary basis, between relevant critical infra-
‘‘(8) FEDERAL ENTITY; INFORMATION SYSTEM;
of this title. structure owners and operators of informa-
SECURITY CONTROL.—The terms ‘Federal enti-
(2) DIRECTOR.—The term ‘‘Director’’ means tion relating to covered cyber incidents and
ty’, ‘information system’, and ‘security con-
the Director of the Cybersecurity and Infra- ransom payments, particularly with respect
trol’ have the meanings given those terms in
structure Security Agency. to ongoing cyber threats or security
section 102 of the Cybersecurity Act of 2015 (6
(3) INFORMATION SYSTEM; RANSOM PAYMENT; vulnerabilities and identify and disseminate
U.S.C. 1501). ways to prevent or mitigate similar inci-
RANSOMWARE ATTACK; SECURITY VULNER-
‘‘(9) SIGNIFICANT CYBER INCIDENT.—The dents in the future;
ABILITY.—The terms ‘‘information system’’,
term ‘significant cyber incident’ means a cy- ‘‘(7) for a covered cyber incident, including
‘‘ransom payment’’, ‘‘ransomware attack’’, bersecurity incident, or a group of related
and ‘‘security vulnerability’’ have the mean- a ransomware attack, that also satisfies the
cybersecurity incidents, that the Secretary definition of a significant cyber incident, or
ings given those terms in section 2200 of the determines is likely to result in demon-
Homeland Security Act of 2002, as added by is part of a group of related cyber incidents
strable harm to the national security inter- that together satisfy such definition, con-
section 5203 of this division. ests, foreign relations, or economy of the
SEC. 5103. CYBER INCIDENT REPORTING. duct a review of the details surrounding the
United States or to the public confidence, covered cyber incident or group of those inci-
(a) CYBER INCIDENT REPORTING.—Title XXII civil liberties, or public health and safety of
of the Homeland Security Act of 2002 (6 dents and identify and disseminate ways to
the people of the United States. prevent or mitigate similar incidents in the
U.S.C. 651 et seq.) is amended— ‘‘(10) SMALL ORGANIZATION.—The term future;
(1) in section 2209(b) (6 U.S.C. 659(b)), as so ‘small organization’— ‘‘(8) with respect to covered cyber incident
redesignated by section 5203(b) of this divi- ‘‘(A) means— reports under section 2232(a) and 2233 involv-
sion— ‘‘(i) a small business concern, as defined in ing an ongoing cyber threat or security vul-
(A) in paragraph (11), by striking ‘‘and’’ at section 3 of the Small Business Act (15 U.S.C. nerability, immediately review those reports
the end; 632); or for cyber threat indicators that can be
(B) in paragraph (12), by striking the pe- ‘‘(ii) any nonprofit organization, including anonymized and disseminated, with defen-
riod at the end and inserting ‘‘; and’’; and faith-based organizations and houses of wor- sive measures, to appropriate stakeholders,
(C) by adding at the end the following: ship, or other private sector entity with in coordination with other divisions within
‘‘(13) receiving, aggregating, and analyzing fewer than 200 employees (determined on a the Agency, as appropriate;
reports related to covered cyber incidents (as full-time equivalent basis); and ‘‘(9) publish quarterly unclassified, public
defined in section 2230) submitted by covered ‘‘(B) does not include— reports that may be based on the unclassi-
entities (as defined in section 2230) and re- ‘‘(i) a business, nonprofit organization, or fied information contained in the briefings
ports related to ransom payments submitted other private sector entity that is a covered required under subsection (c);
by entities in furtherance of the activities entity; or ‘‘(10) proactively identify opportunities
specified in sections 2202(e), 2203, and 2231, ‘‘(ii) a Federal contractor. and perform analyses, consistent with the
this subsection, and any other authorized ac- ‘‘SEC. 2231. CYBER INCIDENT REVIEW. protections in section 2235, to leverage and
tivity of the Director, to enhance the situa-
‘‘(a) ACTIVITIES.—The Center shall— utilize data on ransomware attacks to sup-
tional awareness of cybersecurity threats
‘‘(1) receive, aggregate, analyze, and se- port law enforcement operations to identify,
across critical infrastructure sectors.’’; and
cure, using processes consistent with the track, and seize ransom payments utilizing
(2) by adding at the end the following:
processes developed pursuant to the Cyberse- virtual currencies, to the greatest extent
‘‘Subtitle C—Cyber Incident Reporting curity Information Sharing Act of 2015 (6 practicable;
‘‘SEC. 2230. DEFINITIONS. U.S.C. 1501 et seq.) reports from covered enti- ‘‘(11) proactively identify opportunities,
ctelli on DSK11ZRN23PROD with SENATE
‘‘In this subtitle: ties related to a covered cyber incident to as- consistent with the protections in section
‘‘(1) CENTER.—The term ‘Center’ means the sess the effectiveness of security controls, 2235, to leverage and utilize data on cyber in-
center established under section 2209. identify tactics, techniques, and procedures cidents in a manner that enables and
‘‘(2) COUNCIL.—The term ‘Council’ means adversaries use to overcome those controls strengthens cybersecurity research carried
the Cyber Incident Reporting Council de- and other cybersecurity purposes, including out by academic institutions and other pri-
scribed in section 1752(c)(1)(H) of the William to support law enforcement investigations, vate sector organizations, to the greatest ex-
M. (Mac) Thornberry National Defense Au- to assess potential impact of incidents on tent practicable;
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00094 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.059 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8501
‘‘(12) on a not less frequently than annual to the Director not later than 24 hours after ‘‘(A) the consequences that disruption to
basis, analyze public disclosures made pursu- the ransom payment has been made. or compromise of such an entity could cause
ant to parts 229 and 249 of title 17, Code of ‘‘(3) SUPPLEMENTAL REPORTS.—A covered to national security, economic security, or
Federal Regulations, or any subsequent doc- entity shall promptly submit to the Director public health and safety;
ument submitted to the Securities and Ex- an update or supplement to a previously sub- ‘‘(B) the likelihood that such an entity
change Commission by entities experiencing mitted covered cyber incident report if new may be targeted by a malicious cyber actor,
cyber incidents and compare such disclosures or different information becomes available including a foreign country; and
to reports received by the Center; and or if the covered entity makes a ransom pay- ‘‘(C) the extent to which damage, disrup-
‘‘(13) in accordance with section 2235 and ment after submitting a covered cyber inci- tion, or unauthorized access to such an enti-
subsection (b) of this section, as soon as pos- dent report required under paragraph (1). ty, including the accessing of sensitive cy-
sible but not later than 24 hours after receiv- ‘‘(4) PRESERVATION OF INFORMATION.—Any bersecurity vulnerability information or
ing a covered cyber incident report, ransom covered entity subject to requirements of penetration testing tools or techniques, will
payment report, voluntarily submitted infor- paragraph (1), (2), or (3) shall preserve data likely enable the disruption of the reliable
mation pursuant to section 2233, or informa- relevant to the covered cyber incident or operation of critical infrastructure.
tion received pursuant to a request for infor- ransom payment in accordance with proce- ‘‘(2) A clear description of the types of sub-
mation or subpoena under section 2234, make dures established in the final rule issued pur- stantial cyber incidents that constitute cov-
available the information to appropriate suant to subsection (b). ered cyber incidents, which shall—
Sector Risk Management Agencies and other ‘‘(5) EXCEPTIONS.— ‘‘(A) at a minimum, require the occurrence
appropriate Federal agencies. ‘‘(A) REPORTING OF COVERED CYBER INCI- of—
‘‘(b) INTERAGENCY SHARING.—The National DENT WITH RANSOM PAYMENT.—If a covered ‘‘(i) the unauthorized access to an informa-
Cyber Director, in consultation with the Di- cyber incident includes a ransom payment tion system or network with a substantial
rector and the Director of the Office of Man- such that the reporting requirements under loss of confidentiality, integrity, or avail-
agement and Budget— paragraphs (1) and (2) apply, the covered en- ability of such information system or net-
‘‘(1) may establish a specific time require- tity may submit a single report to satisfy work, or a serious impact on the safety and
ment for sharing information under sub- the requirements of both paragraphs in ac- resiliency of operational systems and proc-
section (a)(13); and cordance with procedures established in the esses;
‘‘(2) shall determine the appropriate Fed- final rule issued pursuant to subsection (b). ‘‘(ii) a disruption of business or industrial
eral agencies under subsection (a)(13). ‘‘(B) SUBSTANTIALLY SIMILAR REPORTED IN- operations due to a cyber incident; or
‘‘(c) PERIODIC BRIEFING.—Not later than 60 FORMATION.—The requirements under para- ‘‘(iii) an occurrence described in clause (i)
days after the effective date of the final rule graphs (1), (2), and (3) shall not apply to an
required under section 2232(b), and on the or (ii) due to loss of service facilitated
entity required by law, regulation, or con- through, or caused by, a compromise of a
first day of each month thereafter, the Di- tract to report substantially similar infor-
rector, in consultation with the National cloud service provider, managed service pro-
mation to another Federal agency within a vider, or other third-party data hosting pro-
Cyber Director, the Attorney General, and substantially similar timeframe.
the Director of National Intelligence, shall vider or by a supply chain compromise;
‘‘(C) DOMAIN NAME SYSTEM.—The require- ‘‘(B) consider—
provide to the majority leader of the Senate,
ments under paragraphs (1), (2) and (3) shall ‘‘(i) the sophistication or novelty of the
the minority leader of the Senate, the
not apply to an entity or the functions of a tactics used to perpetrate such an incident,
Speaker of the House of Representatives, the
covered entity that the Director determines as well as the type, volume, and sensitivity
minority leader of the House of Representa-
constitute critical infrastructure owned, op- of the data at issue;
tives, the Committee on Homeland Security
and Governmental Affairs of the Senate, and erated, or governed by multi-stakeholder or- ‘‘(ii) the number of individuals directly or
the Committee on Homeland Security of the ganizations that develop, implement, and en- indirectly affected or potentially affected by
House of Representatives a briefing that force policies concerning the Domain Name such an incident; and
characterizes the national cyber threat land- System, such as the Internet Corporation for ‘‘(iii) potential impacts on industrial con-
scape, including the threat facing Federal Assigned Names and Numbers or the Inter- trol systems, such as supervisory control and
agencies and covered entities, and applicable net Assigned Numbers Authority. data acquisition systems, distributed control
intelligence and law enforcement informa- ‘‘(6) MANNER, TIMING, AND FORM OF RE- systems, and programmable logic control-
tion, covered cyber incidents, and PORTS.—Reports made under paragraphs (1), lers; and
ransomware attacks, as of the date of the (2), and (3) shall be made in the manner and ‘‘(C) exclude—
briefing, which shall— form, and within the time period in the case ‘‘(i) any event where the cyber incident is
‘‘(1) include the total number of reports of reports made under paragraph (3), pre- perpetuated by good faith security research
submitted under sections 2232 and 2233 dur- scribed in the final rule issued pursuant to or in response to an invitation by the owner
ing the preceding month, including a break- subsection (b). or operator of the information system for
down of required and voluntary reports; ‘‘(7) EFFECTIVE DATE.—Paragraphs (1) third parties to find vulnerabilities in the in-
‘‘(2) include any identified trends in cov- through (4) shall take effect on the dates pre- formation system, such as through a vulner-
ered cyber incidents and ransomware attacks scribed in the final rule issued pursuant to ability disclosure program or the use of au-
over the course of the preceding month and subsection (b). thorized penetration testing services; and
as compared to previous reports, including ‘‘(b) RULEMAKING.— ‘‘(ii) the threat of disruption as extortion,
any trends related to the information col- ‘‘(1) NOTICE OF PROPOSED RULEMAKING.—Not as described in section 2201(9)(A).
lected in the reports submitted under sec- later than 2 years after the date of enact- ‘‘(3) A requirement that, if a covered cyber
tions 2232 and 2233, including— ment of this section, the Director, in con- incident or a ransom payment occurs fol-
‘‘(A) the infrastructure, tactics, and tech- sultation with Sector Risk Management lowing an exempted threat described in para-
niques malicious cyber actors commonly Agencies, the Department of Justice, and graph (2)(C)(ii), the entity shall comply with
use; and other Federal agencies, shall publish in the the requirements in this subtitle in report-
‘‘(B) intelligence gaps that have impeded, Federal Register a notice of proposed rule- ing the covered cyber incident or ransom
or currently are impeding, the ability to making to implement subsection (a). payment.
counter covered cyber incidents and ‘‘(2) FINAL RULE.—Not later than 18 months ‘‘(4) A clear description of the specific re-
ransomware threats; after publication of the notice of proposed quired contents of a report pursuant to sub-
‘‘(3) include a summary of the known uses rulemaking under paragraph (1), the Director section (a)(1), which shall include the fol-
of the information in reports submitted shall issue a final rule to implement sub- lowing information, to the extent applicable
under sections 2232 and 2233; and section (a). and available, with respect to a covered
‘‘(4) be unclassified, but may include a ‘‘(3) SUBSEQUENT RULEMAKINGS.— cyber incident:
classified annex. ‘‘(A) IN GENERAL.—The Director is author- ‘‘(A) A description of the covered cyber in-
‘‘SEC. 2232. REQUIRED REPORTING OF CERTAIN ized to issue regulations to amend or revise cident, including—
CYBER INCIDENTS. the final rule issued pursuant to paragraph ‘‘(i) identification and a description of the
‘‘(a) IN GENERAL.— (2). function of the affected information sys-
‘‘(1) COVERED CYBER INCIDENT REPORTS.—A ‘‘(B) PROCEDURES.—Any subsequent rules tems, networks, or devices that were, or are
covered entity that is a victim of a covered issued under subparagraph (A) shall comply reasonably believed to have been, affected by
cyber incident shall report the covered cyber with the requirements under chapter 5 of such incident;
incident to the Director not later than 72 title 5, United States Code, including the ‘‘(ii) a description of the unauthorized ac-
hours after the covered entity reasonably be- issuance of a notice of proposed rulemaking cess with substantial loss of confidentiality,
ctelli on DSK11ZRN23PROD with SENATE
lieves that the covered cyber incident has oc- under section 553 of such title. integrity, or availability of the affected in-
curred. ‘‘(c) ELEMENTS.—The final rule issued pur- formation system or network or disruption
‘‘(2) RANSOM PAYMENT REPORTS.—A covered suant to subsection (b) shall be composed of of business or industrial operations;
entity, except for an individual or a small or- the following elements: ‘‘(iii) the estimated date range of such in-
ganization, that makes a ransom payment as ‘‘(1) A clear description of the types of en- cident; and
the result of a ransomware attack against tities that constitute covered entities, based ‘‘(iv) the impact to the operations of the
the covered entity shall report the payment on— covered entity.
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00095 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.058 S18NOPT1
S8502 CONGRESSIONAL RECORD — SENATE November 18, 2021
‘‘(B) Where applicable, a description of the ‘‘(A) entities to submit reports required by compliance with the reporting requirements
vulnerabilities, tactics, techniques, and pro- paragraphs (1), (2), and (3) of subsection (a), under subsection (a).
cedures used to perpetuate the covered cyber including the manner and form thereof, ‘‘(E) Specific outreach to cybersecurity
incident. which shall include, at a minimum, a con- vendors, incident response providers, cyber-
‘‘(C) Where applicable, any identifying or cise, user-friendly web-based form; security insurance entities, and other enti-
contact information related to each actor ‘‘(B) the Agency to carry out the enforce- ties that may support covered entities or
reasonably believed to be responsible for ment provisions of section 2233, including ransomware attack victims.
such incident. with respect to the issuance, service, with- ‘‘(F) An overview of the privacy and civil
‘‘(D) Where applicable, identification of the drawal, and enforcement of subpoenas, ap- liberties requirements in this subtitle.
category or categories of information that peals and due process procedures, the suspen- ‘‘(3) COORDINATION.—In conducting the out-
were, or are reasonably believed to have sion and debarment provisions in section reach and education campaign required
been, accessed or acquired by an unauthor- 2234(c), and other aspects of noncompliance; under paragraph (1), the Director may co-
ized person. ‘‘(C) implementing the exceptions provided ordinate with—
‘‘(E) The name and other information that in subsection (a)(5); and ‘‘(A) the Critical Infrastructure Partner-
clearly identifies the entity impacted by the ‘‘(D) protecting privacy and civil liberties ship Advisory Council established under sec-
covered cyber incident. consistent with processes adopted pursuant tion 871;
‘‘(F) Contact information, such as tele- to section 105(b) of the Cybersecurity Act of ‘‘(B) information sharing and analysis or-
phone number or electronic mail address, 2015 (6 U.S.C. 1504(b)) and anonymizing and ganizations;
safeguarding, or no longer retaining, infor- ‘‘(C) trade associations;
that the Center may use to contact the cov-
mation received and disclosed through cov- ‘‘(D) information sharing and analysis cen-
ered entity or an authorized agent of such
ered cyber incident reports and ransom pay- ters;
covered entity, or, where applicable, the
ment reports that is known to be personal ‘‘(E) sector coordinating councils; and
service provider of such covered entity act-
information of a specific individual or infor- ‘‘(F) any other entity as determined appro-
ing with the express permission of, and at
mation that identifies a specific individual priate by the Director.
the direction of, the covered entity to assist
that is not directly related to a cybersecu-
with compliance with the requirements of ‘‘(f) ORGANIZATION OF REPORTS.—Notwith-
rity threat.
this subtitle. ‘‘(9) A clear description of the types of en- standing chapter 35 of title 44, United States
‘‘(5) A clear description of the specific re- tities that constitute other private sector Code (commonly known as the ‘Paperwork
quired contents of a report pursuant to sub- entities for purposes of section 2230(b)(7). Reduction Act’), the Director may request
section (a)(2), which shall be the following ‘‘(d) THIRD PARTY REPORT SUBMISSION AND information within the scope of the final
information, to the extent applicable and RANSOM PAYMENT.— rule issued under subsection (b) by the alter-
available, with respect to a ransom payment: ‘‘(1) REPORT SUBMISSION.—An entity, in- ation of existing questions or response fields
‘‘(A) A description of the ransomware at- cluding a covered entity, that is required to and the reorganization and reformatting of
tack, including the estimated date range of submit a covered cyber incident report or a the means by which covered cyber incident
the attack. ransom payment report may use a third reports, ransom payment reports, and any
‘‘(B) Where applicable, a description of the party, such as an incident response company, voluntarily offered information is submitted
vulnerabilities, tactics, techniques, and pro- insurance provider, service provider, infor- to the Center.
cedures used to perpetuate the ransomware mation sharing and analysis organization, or ‘‘SEC. 2233. VOLUNTARY REPORTING OF OTHER
attack. law firm, to submit the required report CYBER INCIDENTS.
‘‘(C) Where applicable, any identifying or under subsection (a).
contact information related to the actor or ‘‘(2) RANSOM PAYMENT.—If an entity im- ‘‘(a) IN GENERAL.—Entities may volun-
actors reasonably believed to be responsible pacted by a ransomware attack uses a third tarily report incidents or ransom payments
for the ransomware attack. party to make a ransom payment, the third to the Director that are not required under
‘‘(D) The name and other information that party shall not be required to submit a ran- paragraph (1), (2), or (3) of section 2232(a), but
clearly identifies the entity that made the som payment report for itself under sub- may enhance the situational awareness of
ransom payment. section (a)(2). cyber threats.
‘‘(E) Contact information, such as tele- ‘‘(3) DUTY TO REPORT.—Third-party report- ‘‘(b) VOLUNTARY PROVISION OF ADDITIONAL
phone number or electronic mail address, ing under this subparagraph does not relieve INFORMATION IN REQUIRED REPORTS.—Enti-
that the Center may use to contact the enti- a covered entity or an entity that makes a ties may voluntarily include in reports re-
ty that made the ransom payment or an au- ransom payment from the duty to comply quired under paragraph (1), (2), or (3) of sec-
thorized agent of such covered entity, or, with the requirements for covered cyber inci- tion 2232(a) information that is not required
where applicable, the service provider of dent report or ransom payment report sub- to be included, but may enhance the situa-
such covered entity acting with the express mission. tional awareness of cyber threats.
permission of, and at the direction of, that ‘‘(4) RESPONSIBILITY TO ADVISE.—Any third
entity to assist with compliance with the re- party used by an entity that knowingly ‘‘(c) APPLICATION OF PROTECTIONS.—The
quirements of this subtitle. makes a ransom payment on behalf of an en- protections under section 2235 applicable to
‘‘(F) The date of the ransom payment. tity impacted by a ransomware attack shall covered cyber incident reports shall apply in
‘‘(G) The ransom payment demand, includ- advise the impacted entity of the respon- the same manner and to the same extent to
ing the type of virtual currency or other sibilities of the impacted entity regarding reports and information submitted under
commodity requested, if applicable. reporting ransom payments under this sec- subsections (a) and (b).
‘‘(H) The ransom payment instructions, in- tion. ‘‘SEC. 2234. NONCOMPLIANCE WITH REQUIRED
cluding information regarding where to send ‘‘(e) OUTREACH TO COVERED ENTITIES.— REPORTING.
the payment, such as the virtual currency ‘‘(1) IN GENERAL.—The Director shall con-
address or physical address the funds were duct an outreach and education campaign to ‘‘(a) PURPOSE.—In the event that an entity
requested to be sent to, if applicable. inform likely covered entities, entities that that is required to submit a report under sec-
‘‘(I) The amount of the ransom payment. offer or advertise as a service to customers tion 2232(a) fails to comply with the require-
‘‘(6) A clear description of the types of data to make or facilitate ransom payments on ment to report, the Director may obtain in-
required to be preserved pursuant to sub- behalf of entities impacted by ransomware formation about the incident or ransom pay-
section (a)(4) and the period of time for attacks, potential ransomware attack vic- ment by engaging the entity directly to re-
which the data is required to be preserved. tims, and other appropriate entities of the quest information about the incident or ran-
‘‘(7) Deadlines for submitting reports to requirements of paragraphs (1), (2), and (3) of som payment, and if the Director is unable
the Director required under subsection (a)(3), subsection (a). to obtain information through such engage-
which shall— ‘‘(2) ELEMENTS.—The outreach and edu- ment, by issuing a subpoena to the entity,
‘‘(A) be established by the Director in con- cation campaign under paragraph (1) shall pursuant to subsection (c), to gather infor-
sultation with the Council; include the following: mation sufficient to determine whether a
‘‘(B) consider any existing regulatory re- ‘‘(A) An overview of the final rule issued covered cyber incident or ransom payment
porting requirements similar in scope, pur- pursuant to subsection (b). has occurred, and, if so, whether additional
pose, and timing to the reporting require- ‘‘(B) An overview of mechanisms to submit action is warranted pursuant to subsection
ments to which such a covered entity may to the Center covered cyber incident reports (d).
also be subject, and make efforts to har- and information relating to the disclosure, ‘‘(b) INITIAL REQUEST FOR INFORMATION.—
monize the timing and contents of any such retention, and use of incident reports under ‘‘(1) IN GENERAL.—If the Director has rea-
ctelli on DSK11ZRN23PROD with SENATE
reports to the maximum extent practicable; this section. son to believe, whether through public re-
and ‘‘(C) An overview of the protections af- porting or other information in the posses-
‘‘(C) balance the need for situational forded to covered entities for complying with sion of the Federal Government, including
awareness with the ability of the covered en- the requirements under paragraphs (1), (2), through analysis performed pursuant to
tity to conduct incident response and inves- and (3) of subsection (a). paragraph (1) or (2) of section 2231(a), that an
tigations. ‘‘(D) An overview of the steps taken under entity has experienced a covered cyber inci-
‘‘(8) Procedures for— section 2234 when a covered entity is not in dent or made a ransom payment but failed to
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00096 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.058 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8503
report such incident or payment to the Cen- ransom payment report submitted to the ‘‘(2) AGENCY ACTIONS AFTER RECEIPT.—
ter within 72 hours in accordance with sec- Center by an entity that makes a ransom ‘‘(A) RAPID, CONFIDENTIAL SHARING OF
tion 2232(a), the Director shall request addi- payment or third party under section 2232 CYBER THREAT INDICATORS.—Upon receiving a
tional information from the entity to con- shall not be used by any Federal, State, covered cyber incident or ransom payment
firm whether or not a covered cyber incident Tribal, or local government to investigate or report submitted pursuant to this section,
or ransom payment has occurred. take another law enforcement action against the center shall immediately review the re-
‘‘(2) TREATMENT.—Information provided to the entity that makes a ransom payment or port to determine whether the incident that
the Center in response to a request under third party. is the subject of the report is connected to
paragraph (1) shall be treated as if it was ‘‘(3) RULE OF CONSTRUCTION.—Nothing in an ongoing cyber threat or security vulner-
submitted through the reporting procedures this subtitle shall be construed to provide an ability and where applicable, use such report
established in section 2232. entity that submits a covered cyber incident to identify, develop, and rapidly disseminate
‘‘(c) AUTHORITY TO ISSUE SUBPOENAS AND report or ransom payment report under sec- to appropriate stakeholders actionable,
DEBAR.— tion 2232 any immunity from law enforce- anonymized cyber threat indicators and de-
‘‘(1) IN GENERAL.—If, after the date that is ment action for making a ransom payment fensive measures.
72 hours from the date on which the Director otherwise prohibited by law. ‘‘(B) STANDARDS FOR SHARING SECURITY
made the request for information in sub- ‘‘(e) CONSIDERATIONS.—When determining VULNERABILITIES.—With respect to informa-
section (b), the Director has received no re- whether to exercise the authorities provided tion in a covered cyber incident or ransom
sponse from the entity from which such in- under this section, the Director shall take payment report regarding a security vulner-
formation was requested, or received an in- into consideration— ability referred to in paragraph (1)(B)(ii), the
adequate response, the Director may issue to ‘‘(1) the size and complexity of the entity; Director shall develop principles that govern
such entity a subpoena to compel disclosure ‘‘(2) the complexity in determining if a the timing and manner in which information
of information the Director deems necessary covered cyber incident has occurred; and relating to security vulnerabilities may be
to determine whether a covered cyber inci- ‘‘(3) prior interaction with the Agency or shared, consistent with common industry
dent or ransom payment has occurred and awareness of the entity of the policies and best practices and United States and inter-
obtain the information required to be re- procedures of the Agency for reporting cov- national standards.
ported pursuant to section 2232 and any im- ered cyber incidents and ransom payments.
‘‘(3) PRIVACY AND CIVIL LIBERTIES.—Infor-
plementing regulations. ‘‘(f) EXCLUSIONS.—This section shall not
apply to a State, local, Tribal, or territorial mation contained in covered cyber incident
‘‘(2) CIVIL ACTION.— and ransom payment reports submitted to
‘‘(A) IN GENERAL.—If an entity fails to com- government entity.
‘‘(g) REPORT TO CONGRESS.—The Director the Center or the Agency pursuant to section
ply with a subpoena, the Director may refer
shall submit to Congress an annual report on 2232 shall be retained, used, and dissemi-
the matter to the Attorney General to bring
the number of times the Director— nated, where permissible and appropriate, by
a civil action in a district court of the
‘‘(1) issued an initial request for informa- the Federal Government in accordance with
United States to enforce such subpoena.
tion pursuant to subsection (b); processes to be developed for the protection
‘‘(B) VENUE.—An action under this para-
‘‘(2) issued a subpoena pursuant to sub- of personal information consistent with
graph may be brought in the judicial district
section (c); or processes adopted pursuant to section 105 of
in which the entity against which the action
‘‘(3) referred a matter to the Attorney Gen- the Cybersecurity Act of 2015 (6 U.S.C. 1504)
is brought resides, is found, or does business.
‘‘(C) CONTEMPT OF COURT.—A court may eral for a civil action pursuant to subsection and in a manner that protects from unau-
punish a failure to comply with a subpoena (c)(2). thorized use or disclosure any information
issued under this subsection as contempt of ‘‘(h) PUBLICATION OF THE ANNUAL REPORT.— that may contain—
court. The Director shall publish a version of the ‘‘(A) personal information of a specific in-
‘‘(3) NON-DELEGATION.—The authority of annual report required under subsection (g) dividual; or
the Director to issue a subpoena under this on the website of the Agency, which shall in- ‘‘(B) information that identifies a specific
subsection may not be delegated. clude, at a minimum, the number of times individual that is not directly related to a
‘‘(4) DEBARMENT OF FEDERAL CONTRAC- the Director— cybersecurity threat.
TORS.—If a covered entity that is a Federal
‘‘(1) issued an initial request for informa- ‘‘(4) DIGITAL SECURITY.—The Center and the
tion pursuant to subsection (b); or Agency shall ensure that reports submitted
contractor fails to comply with a subpoena
‘‘(2) issued a subpoena pursuant to sub- to the Center or the Agency pursuant to sec-
issued under this subsection—
section (c). tion 2232, and any information contained in
‘‘(A) the Director may refer the matter to ‘‘(i) ANONYMIZATION OF REPORTS.—The Di-
the Administrator of General Services; and those reports, are collected, stored, and pro-
rector shall ensure any victim information tected at a minimum in accordance with the
‘‘(B) upon receiving a referral from the Di- contained in a report required to be pub-
rector, the Administrator of General Serv- requirements for moderate impact Federal
lished under subsection (h) be anonymized information systems, as described in Federal
ices may impose additional available pen- before the report is published.
alties, including suspension or debarment. Information Processing Standards Publica-
‘‘SEC. 2235. INFORMATION SHARED WITH OR PRO- tion 199, or any successor document.
‘‘(5) AUTHENTICATION.— VIDED TO THE FEDERAL GOVERN-
‘‘(A) IN GENERAL.—Any subpoena issued ‘‘(5) PROHIBITION ON USE OF INFORMATION IN
MENT.
REGULATORY ACTIONS.—A Federal, State,
electronically pursuant to this subsection ‘‘(a) DISCLOSURE, RETENTION, AND USE.—
shall be authenticated with a cryptographic local, or Tribal government shall not use in-
‘‘(1) AUTHORIZED ACTIVITIES.—Information
digital signature of an authorized represent- formation about a covered cyber incident or
provided to the Center or Agency pursuant
ative of the Agency, or other comparable to section 2232 or 2233 may be disclosed to, ransom payment obtained solely through re-
successor technology, that allows the Agen- retained by, and used by, consistent with porting directly to the Center or the Agency
cy to demonstrate that such subpoena was otherwise applicable provisions of Federal in accordance with this subtitle to regulate,
issued by the Agency and has not been al- law, any Federal agency or department, com- including through an enforcement action,
tered or modified since such issuance. ponent, officer, employee, or agent of the the activities of the covered entity or entity
‘‘(B) INVALID IF NOT AUTHENTICATED.—Any Federal Government solely for— that made a ransom payment.
subpoena issued electronically pursuant to ‘‘(A) a cybersecurity purpose; ‘‘(b) NO WAIVER OF PRIVILEGE OR PROTEC-
this subsection that is not authenticated in ‘‘(B) the purpose of identifying— TION.—The submission of a report to the Cen-
accordance with subparagraph (A) shall not ‘‘(i) a cyber threat, including the source of ter or the Agency under section 2232 shall
be considered to be valid by the recipient of the cyber threat; or not constitute a waiver of any applicable
such subpoena. ‘‘(ii) a security vulnerability; privilege or protection provided by law, in-
‘‘(d) ACTIONS BY ATTORNEY GENERAL AND ‘‘(C) the purpose of responding to, or other- cluding trade secret protection and attorney-
FEDERAL REGULATORY AGENCIES.— wise preventing or mitigating, a specific client privilege.
‘‘(1) IN GENERAL.—Notwithstanding section threat of death, a specific threat of serious ‘‘(c) EXEMPTION FROM DISCLOSURE.—Infor-
2235(a) and subsection (b)(2) of this section, if bodily harm, or a specific threat of serious mation contained in a report submitted to
the Attorney General or the appropriate economic harm, including a terrorist act or the Office under section 2232 shall be exempt
Federal regulatory agency determines, based use of a weapon of mass destruction; from disclosure under section 552(b)(3)(B) of
on information provided in response to a sub- ‘‘(D) the purpose of responding to, inves- title 5, United States Code (commonly
poena issued pursuant to subsection (c), that tigating, prosecuting, or otherwise pre- known as the ‘Freedom of Information Act’)
the facts relating to the covered cyber inci- venting or mitigating, a serious threat to a and any State, Tribal, or local provision of
dent or ransom payment at issue may con- minor, including sexual exploitation and law requiring disclosure of information or
stitute grounds for a regulatory enforcement threats to physical safety; or records.
ctelli on DSK11ZRN23PROD with SENATE
action or criminal prosecution, the Attorney ‘‘(E) the purpose of preventing, inves- ‘‘(d) EX PARTE COMMUNICATIONS.—The sub-
General or the appropriate Federal regu- tigating, disrupting, or prosecuting an of- mission of a report to the Agency under sec-
latory agency may use that information for fense arising out of a cyber incident reported tion 2232 shall not be subject to a rule of any
a regulatory enforcement action or criminal pursuant to section 2232 or 2233 or any of the Federal agency or department or any judi-
prosecution. offenses listed in section 105(d)(5)(A)(v) of the cial doctrine regarding ex parte communica-
‘‘(2) APPLICATION TO CERTAIN ENTITIES AND Cybersecurity Act of 2015 (6 U.S.C. tions with a decision-making official.
THIRD PARTIES.—A covered cyber incident or 1504(d)(5)(A)(v)). ‘‘(e) LIABILITY PROTECTIONS.—
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00097 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.058 S18NOPT1
S8504 CONGRESSIONAL RECORD — SENATE November 18, 2021
‘‘(1) IN GENERAL.—No cause of action shall ceiving the report, unless a shorter period is ness of a covered cyber incident or ransom
lie or be maintained in any court by any per- required by an agreement made between the payment.
son or entity and any such action shall be Cybersecurity Infrastructure Security Agen- SEC. 5105. RANSOMWARE VULNERABILITY WARN-
promptly dismissed for the submission of a cy and the recipient Federal agency. The Di- ING PILOT PROGRAM.
report pursuant to section 2232(a) that is sub- rector shall share and coordinate each report
pursuant to section 2231(b) of the Homeland (a) PROGRAM.—Not later than 1 year after
mitted in conformance with this subtitle and
Security Act of 2002, as added by section 5103 the date of enactment of this Act, the Direc-
the rule promulgated under section 2232(b),
of this title. tor shall establish a ransomware vulner-
except that this subsection shall not apply
(2) RULE OF CONSTRUCTION.—The require- ability warning program to leverage existing
with regard to an action by the Federal Gov-
ments described in paragraph (1) shall not be authorities and technology to specifically
ernment pursuant to section 2234(c)(2).
construed to be a violation of any provision develop processes and procedures for, and to
‘‘(2) SCOPE.—The liability protections pro-
of law or policy that would otherwise pro- dedicate resources to, identifying informa-
vided in subsection (e) shall only apply to or
hibit disclosure within the executive branch. tion systems that contain security
affect litigation that is solely based on the
(3) PROTECTION OF INFORMATION.—The Di- vulnerabilities associated with common
submission of a covered cyber incident re-
rector shall comply with any obligations of ransomware attacks, and to notify the own-
port or ransom payment report to the Center
the recipient Federal agency described in ers of those vulnerable systems of their secu-
or the Agency.
paragraph (1) to protect information, includ- rity vulnerability.
‘‘(3) RESTRICTIONS.—Notwithstanding para-
graph (2), no report submitted to the Agency ing with respect to privacy, confidentiality, (b) IDENTIFICATION OF VULNERABLE SYS-
pursuant to this subtitle or any communica- or information security, if those obligations TEMS.—The pilot program established under
tion, document, material, or other record, would impose greater protection require- subsection (a) shall—
created for the sole purpose of preparing, ments than this title or the amendments (1) identify the most common security
drafting, or submitting such report, may be made by this title. vulnerabilities utilized in ransomware at-
received in evidence, subject to discovery, or (4) FOIA EXEMPTION.—Any report received tacks and mitigation techniques; and
otherwise used in any trial, hearing, or other by the Director pursuant to paragraph (1) (2) utilize existing authorities to identify
proceeding in or before any court, regulatory shall be exempt from disclosure under sec- Federal and other relevant information sys-
body, or other authority of the United tion 552(b)(3) of title 5, United States Code tems that contain the security
States, a State, or a political subdivision (commonly known as the ‘‘Freedom of Infor- vulnerabilities identified in paragraph (1).
thereof, provided that nothing in this sub- mation Act’’). (c) ENTITY NOTIFICATION.—
title shall create a defense to discovery or (b) CREATION OF COUNCIL.—Section 1752(c) (1) IDENTIFICATION.—If the Director is able
otherwise affect the discovery of any com- of the William M. (Mac) Thornberry National to identify the entity at risk that owns or
munication, document, material, or other Defense Authorization Act for Fiscal Year operates a vulnerable information system
record not created for the sole purpose of 2021 (6 U.S.C. 1500(c)) is amended— identified in subsection (b), the Director may
preparing, drafting, or submitting such re- (1) in paragraph (1)— notify the owner of the information system.
port. (A) in subparagraph (G), by striking ‘‘and’’ (2) NO IDENTIFICATION.—If the Director is
‘‘(f) SHARING WITH NON-FEDERAL ENTI- at the end; not able to identify the entity at risk that
TIES.—The Agency shall anonymize the vic-
(B) by redesignating subparagraph (H) as owns or operates a vulnerable information
tim who reported the information when subparagraph (I); and system identified in subsection (b), the Di-
making information provided in reports re- (C) by inserting after subparagraph (G) the rector may utilize the subpoena authority
ceived under section 2232 available to critical following: pursuant to section 2209 of the Homeland Se-
infrastructure owners and operators and the ‘‘(H) lead an intergovernmental Cyber Inci- curity Act of 2002 (6 U.S.C. 659) to identify
general public. dent Reporting Council, in coordination with and notify the entity at risk pursuant to the
‘‘(g) PROPRIETARY INFORMATION.—Informa- the Director of the Office of Management procedures within that section.
tion contained in a report submitted to the and Budget, the Attorney General, and the (3) REQUIRED INFORMATION.—A notification
Agency under section 2232 shall be consid- Director of the Cybersecurity and Infrastruc- made under paragraph (1) shall include infor-
ered the commercial, financial, and propri- ture Security Agency and in consultation mation on the identified security vulner-
etary information of the covered entity when with Sector Risk Management Agencies (as ability and mitigation techniques.
so designated by the covered entity. defined in section 2201 of the Homeland Secu-
(d) PRIORITIZATION OF NOTIFICATIONS.—To
‘‘(h) STORED COMMUNICATIONS ACT.—Noth- rity Act of 2002 (6 U.S.C. 651)) and other ap-
the extent practicable, the Director shall
ing in this subtitle shall be construed to per- propriate Federal agencies, to coordinate,
prioritize covered entities for identification
mit or require disclosure by a provider of a deconflict, and harmonize Federal incident
and notification activities under the pilot
remote computing service or a provider of an reporting requirements, including those
program established under this section.
electronic communication service to the issued through regulations, for covered enti-
ties (as defined in section 2230 of such Act) (e) LIMITATION ON PROCEDURES.—No proce-
public of information not otherwise per- dure, notification, or other authorities uti-
mitted or required to be disclosed under and entities that make a ransom payment
(as defined in such section 2201 (6 U.S.C. lized in the execution of the pilot program
chapter 121 of title 18, United States Code established under subsection (a) shall require
(commonly known as the ‘Stored Commu- 651)); and’’; and
(2) by adding at the end the following: an owner or operator of a vulnerable infor-
nications Act’).’’. mation system to take any action as a result
(b) TECHNICAL AND CONFORMING AMEND- ‘‘(3) RULE OF CONSTRUCTION.—Nothing in
paragraph (1)(H) shall be construed to pro- of a notice of a security vulnerability made
MENT.—The table of contents in section 1(b)
vide any additional regulatory authority to pursuant to subsection (c).
of the Homeland Security Act of 2002 (Public
Law 107–296; 116 Stat. 2135) is amended by in- any Federal entity.’’. (f) RULE OF CONSTRUCTION.—Nothing in this
serting after the items relating to subtitle B (c) HARMONIZING REPORTING REQUIRE- section shall be construed to provide addi-
MENTS.—The National Cyber Director shall, tional authorities to the Director to identify
of title XXII the following:
in consultation with the Director, the Attor- vulnerabilities or vulnerable systems.
‘‘Subtitle C—Cyber Incident Reporting ney General, the Cyber Incident Reporting (g) TERMINATION.—The pilot program es-
‘‘Sec. 2230. Definitions. Council described in section 1752(c)(1)(H) of tablished under subsection (a) shall termi-
‘‘Sec. 2231. Cyber Incident Review. the William M. (Mac) Thornberry National nate on the date that is 4 years after the
‘‘Sec. 2232. Required reporting of certain Defense Authorization Act for Fiscal Year date of enactment of this Act.
cyber incidents. 2021 (6 U.S.C. 1500(c)(1)(H)), and the Director
‘‘Sec. 2233. Voluntary reporting of other of the Office of Management and Budget, to SEC. 5106. RANSOMWARE THREAT MITIGATION
cyber incidents. the maximum extent practicable— ACTIVITIES.
‘‘Sec. 2234. Noncompliance with required re- (1) periodically review existing regulatory (a) JOINT RANSOMWARE TASK FORCE.—
porting. requirements, including the information re- (1) IN GENERAL.—Not later than 180 days
‘‘Sec. 2235. Information shared with or pro- quired in such reports, to report cyber inci- after the date of enactment of this Act, the
vided to the Federal Govern- dents and ensure that any such reporting re- National Cyber Director, in consultation
ment.’’. quirements and procedures avoid conflicting, with the Attorney General and the Director
SEC. 5104. FEDERAL SHARING OF INCIDENT RE- duplicative, or burdensome requirements; of the Federal Bureau of Investigation, shall
PORTS. and establish and chair the Joint Ransomware
(a) CYBER INCIDENT REPORTING SHARING.— (2) coordinate with the Director, the Attor- Task Force to coordinate an ongoing nation-
(1) IN GENERAL.—Notwithstanding any ney General, and regulatory authorities that wide campaign against ransomware attacks,
other provision of law or regulation, any receive reports relating to cyber incidents to and identify and pursue opportunities for
ctelli on DSK11ZRN23PROD with SENATE
Federal agency, including any independent identify opportunities to streamline report- international cooperation.
establishment (as defined in section 104 of ing processes, and where feasible, facilitate (2) COMPOSITION.—The Joint Ransomware
title 5, United States Code), that receives a interagency agreements between such au- Task Force shall consist of participants from
report from an entity of a cyber incident, in- thorities to permit the sharing of such re- Federal agencies, as determined appropriate
cluding a ransomware attack, shall provide ports, consistent with applicable law and by the National Cyber Director in consulta-
the report to the Director as soon as pos- policy, without impacting the ability of such tion with the Secretary of Homeland Secu-
sible, but not later than 24 hours after re- agencies to gain timely situational aware- rity.
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00098 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.058 S18NOPT1
November 18, 2021 CONGRESSIONAL RECORD — SENATE S8505
(3) RESPONSIBILITIES.—The Joint land Security Act of 2002, as added by section (B) an evaluation of the impact on im-
Ransomware Task Force, utilizing only ex- 5103(a) of this title, by proactively identi- pacted entities, homeland security, and the
isting authorities of each participating agen- fying opportunities to use cyber incident national economy of the ransomware crimi-
cy, shall coordinate across the Federal Gov- data to inform and enable cybersecurity re- nal ecosystem of incidents and ransom pay-
ernment the following activities: search within the academic and private sec- ments, including a discussion on the scope of
(A) Prioritization of intelligence-driven op- tor. impact of incidents that were not reported to
erations to disrupt specific ransomware ac- (c) REPORT ON RANSOMWARE VULNERABILITY the Federal Government;
tors. WARNING PILOT PROGRAM.—Not later than 1 (C) an evaluation of the burden, financial
(B) Consult with relevant private sector, year after the date of enactment of this Act, and otherwise, on entities required to report
State, local, Tribal, and territorial govern- and annually thereafter for the duration of cyber incidents under this title, including an
ments and international stakeholders to the pilot program established under section analysis of entities that meet the definition
identify needs and establish mechanisms for 5105, the Director shall submit to the Com- of a small organization and would be exempt
providing input into the Task Force. mittee on Homeland Security and Govern- from ransom payment reporting but not for
(C) Identifying, in consultation with rel- mental Affairs of the Senate and the Com- being a covered entity; and
evant entities, a list of highest threat mittee on Homeland Security of the House of (D) a description of the consequences and
ransomware entities updated on an ongoing Representatives a report, which may include effects of the exemptions.
basis, in order to facilitate— a classified annex, on the effectiveness of the (f) REPORT ON EFFECTIVENESS OF ENFORCE-
(i) prioritization for Federal action by ap- MENT MECHANISMS.—Not later than 1 year
pilot program, which shall include a discus-
propriate Federal agencies; and sion of the following: after the date on which the Director issues
(ii) identify metrics for success of said ac- the final rule required under section 2232(b)
(1) The effectiveness of the notifications
tions. of the Homeland Security Act of 2002, as
under section 5105(c) in mitigating security
(D) Disrupting ransomware criminal ac- added by section 5103 of this title, the Direc-
vulnerabilities and the threat of
tor shall submit to the Committee on Home-
tors, associated infrastructure, and their fi- ransomware.
land Security and Governmental Affairs of
nances. (2) Identification of the most common the Senate and the Committee on Homeland
(E) Facilitating coordination and collabo- vulnerabilities utilized in ransomware. Security of the House of Representatives a
ration between Federal entities and relevant (3) The number of notifications issued dur- report on the effectiveness of the enforce-
entities, including the private sector, to im- ing the preceding year. ment mechanisms within section 2234 of the
prove Federal actions against ransomware (4) To the extent practicable, the number Homeland Security Act of 2002, as added by
threats. of vulnerable devices or systems mitigated section 5103 of this title.
(F) Collection, sharing, and analysis of under this pilot by the Agency during the
TITLE LII—CISA TECHNICAL CORREC-
ransomware trends to inform Federal ac- preceding year. TIONS AND IMPROVEMENTS ACT OF 2021
tions. (d) REPORT ON HARMONIZATION OF REPORT-
(G) Creation of after-action reports and SEC. 5201. SHORT TITLE.
ING REGULATIONS.—
other lessons learned from Federal actions This title may be cited as the ‘‘CISA Tech-
(1) IN GENERAL.—Not later than 180 days
that identify successes and failures to im- nical Corrections and Improvements Act of
after the date on which the National Cyber
prove subsequent actions. 2021’’.
Director convenes the Council described in
(H) Any other activities determined appro- SEC. 5202. REDESIGNATIONS.
section 1752(c)(1)(H) of the William M. (Mac)
priate by the task force to mitigate the (a) IN GENERAL.—Subtitle A of title XXII of
Thornberry National Defense Authorization
threat of ransomware attacks against Fed- the Homeland Security Act of 2002 (6 U.S.C.
Act for Fiscal Year 2021 (6 U.S.C.
eral and non-Federal entities. 651 et seq.) is amended—
1500(c)(1)(H)), the National Cyber Director
(b) CLARIFYING PRIVATE SECTOR LAWFUL (1) by redesignating section 2217 (6 U.S.C.
shall submit to the appropriate congres-
DEFENSIVE MEASURES.—Not later than 180 665f) as section 2220;
sional committees a report that includes— (2) by redesignating section 2216 (6 U.S.C.
days after the date of enactment of this Act, (A) a list of duplicative Federal cyber inci-
the National Cyber Director, in coordination 665e) as section 2219;
dent reporting requirements on covered enti- (3) by redesignating the fourth section 2215
with the Secretary of Homeland Security ties and entities that make a ransom pay-
and the Attorney General, shall submit to (relating to Sector Risk Management Agen-
ment; cies) (6 U.S.C. 665d) as section 2218;
the Committee on Homeland Security and (B) a description of any challenges in har- (4) by redesignating the third section 2215
Governmental Affairs and the Committee on monizing the duplicative reporting require- (relating to the Cybersecurity State Coordi-
the Judiciary of the Senate and the Com- ments; nator) (6 U.S.C. 665c) as section 2217; and
mittee on Homeland Security, the Com- (C) any actions the National Cyber Direc- (5) by redesignating the second section 2215
mittee on the Judiciary, and the Committee tor intends to take to facilitate harmonizing (relating to the Joint Cyber Planning Office)
on Oversight and Reform of the House of the duplicative reporting requirements; and (6 U.S.C. 665b) as section 2216.
Representatives a report that describes de- (D) any proposed legislative changes nec- (b) TECHNICAL AND CONFORMING AMEND-
fensive measures that private sector actors essary to address the duplicative reporting. MENTS.—Section 2202(c) of the Homeland Se-
can take when countering ransomware at- (2) RULE OF CONSTRUCTION.—Nothing in curity Act of 2002 (6 U.S.C. 652(c)) is amend-
tacks and what laws need to be clarified to paragraph (1) shall be construed to provide ed—
enable that action. any additional regulatory authority to any (1) in paragraph (11), by striking ‘‘and’’ at
(c) RULE OF CONSTRUCTION.—Nothing in Federal agency. the end;
this section shall be construed to provide (e) GAO REPORTS.— (2) in the first paragraph (12)—
any additional authority to any Federal (1) IMPLEMENTATION OF THIS TITLE.—Not (A) by striking ‘‘section 2215’’ and insert-
agency. later than 2 years after the date of enact- ing ‘‘section 2217’’; and
SEC. 5107. CONGRESSIONAL REPORTING. ment of this Act, the Comptroller General of (B) by striking ‘‘and’’ at the end; and
(a) REPORT ON STAKEHOLDER ENGAGE- the United States shall submit to the Com- (3) by redesignating the second and third
MENT.—Not later than 30 days after the date mittee on Homeland Security and Govern- paragraphs (12) as paragraphs (13) and (14),
on which the Director issues the final rule mental Affairs of the Senate and the Com- respectively.
under section 2232(b) of the Homeland Secu- mittee on Homeland Security of the House of (c) ADDITIONAL TECHNICAL AMENDMENT.—
rity Act of 2002, as added by section 5103(b) of Representatives a report on the implementa- (1) AMENDMENT.—Section 904(b)(1) of the
this title, the Director shall submit to the tion of this title and the amendments made DOTGOV Act of 2020 (title IX of division U of
Committee on Homeland Security and Gov- by this title. Public Law 116–260) is amended, in the mat-
ernmental Affairs of the Senate and the (2) EXEMPTIONS TO REPORTING.—Not later ter preceding subparagraph (A), by striking
Committee on Homeland Security of the than 1 year after the date on which the Di- ‘‘Homeland Security Act’’ and inserting
House of Representatives a report that de- rector issues the final rule required under ‘‘Homeland Security Act of 2002’’.
scribes how the Director engaged stake- section 2232(b) of the Homeland Security Act (2) EFFECTIVE DATE.—The amendment
holders in the development of the final rule. of 2002, as added by section 5103 of this title, made by paragraph (1) shall take effect as if
(b) REPORT ON OPPORTUNITIES TO the Comptroller General of the United States enacted as part of the DOTGOV Act of 2020
STRENGTHEN SECURITY RESEARCH.—Not later shall submit to the Committee on Homeland (title IX of division U of Public Law 116–260).
than 1 year after the date of enactment of Security and Governmental Affairs of the SEC. 5203. CONSOLIDATION OF DEFINITIONS.
this Act, the Director shall submit to the Senate and the Committee on Homeland Se- (a) IN GENERAL.—Title XXII of the Home-
Committee on Homeland Security and Gov- curity of the House of Representatives a re- land Security Act of 2002 (6 U.S.C. 651) is
ernmental Affairs of the Senate and the port on the exemptions to reporting under amended by inserting before the subtitle A
ctelli on DSK11ZRN23PROD with SENATE
Committee on Homeland Security of the paragraphs (2) and (5) of section 2232(a) of the heading the following:
House of Representatives a report describing Homeland Security Act of 2002, as added by ‘‘SEC. 2200. DEFINITIONS.
how the National Cybersecurity and Commu- section 5103 of this title, which shall in- ‘‘Except as otherwise specifically provided,
nications Integration Center established clude— in this title:
under section 2209 of the Homeland Security (A) to the extent practicable, an evalua- ‘‘(1) AGENCY.—The term ‘Agency’ means
Act of 2002 (6 U.S.C. 659) has carried out ac- tion of the quantity of incidents not reported the Cybersecurity and Infrastructure Secu-
tivities under section 2231(a)(9) of the Home- to the Federal Government; rity Agency.
VerDate Sep 11 2014 06:22 Nov 19, 2021 Jkt 029060 PO 00000 Frm 00099 Fmt 0624 Sfmt 0634 E:\CR\FM\A18NO6.058 S18NOPT1
S8506 CONGRESSIONAL RECORD — SENATE November 18, 2021
‘‘(2) AGENCY INFORMATION.—The term ‘‘(8) CYBERSECURITY PURPOSE.—The term ‘‘(B) communicating or disclosing critical
‘agency information’ means information col- ‘cybersecurity purpose’ means the purpose of infrastructure information, including cyber-
lected or maintained by or on behalf of an protecting an information system or infor- security risks and incidents, to help prevent,
agency. mation that is stored on, processed by, or detect, mitigate, or recover from the effects
‘‘(3) AGENCY INFORMATION SYSTEM.—The transiting an information system from a cy- of a interference, compromise, or a incapaci-
term ‘agency information system’ means an bersecurity threat or security vulnerability. tation problem related to critical infrastruc-
information system used or operated by an ‘‘(9) CYBERSECURITY RISK.—The term ‘cy- ture, including cybersecurity risks and inci-
agency or by another entity on behalf of an bersecurity risk’— dents, or protected systems; and
agency. ‘‘(A) means threats to and vulnerabilities ‘‘(C) voluntarily disseminating critical in-
‘‘(4) APPROPRIATE CONGRESSIONAL COMMIT- of information or information systems and frastructure information, including cyberse-
TEES.—The term ‘appropriate congressional any related consequences caused by or re- curity risks and incidents, to its members,
committees’ means— sulting from unauthorized access, use, dis- State, local, and Federal Governments, or
‘‘(A) the Committee on Homeland Security closure, degradation, disruption, modifica- any other entities that may be of assistance
and Governmental Affairs of the Senate; and tion, or destruction of such information or in carrying out the purposes specified in sub-
‘‘(B) the Committee on Homeland Security information systems, including such related paragraphs (A) and (B).
of the House of Representatives. consequences caused by an act of terrorism; ‘‘(15) INFORMATION SYSTEM.—The term ‘in-
‘‘(5) CLOUD SERVICE PROVIDER.—The term and formation system’ has the meaning given the
‘cloud service provider’ means an entity of- ‘‘(B) does not include any action that sole- term in section 3502 of title 44, United States
fering products or services related to cloud ly involves a violation of a consumer term of Code.
computing, as defined by the National Insti- service or a consumer licensing agreement. ‘‘(16) INTELLIGENCE COMMUNITY.—The term
tutes of Standards and Technology in NIST ‘‘(10) CYBERSECURITY THREAT.— ‘intelligence community’ has the meaning
Special Publication 800–145 and any amend- ‘‘(A) IN GENERAL.—Except as provided in given the term in section 3(4) of the National
atory or superseding document relating subparagraph (B), the term ‘cybersecurity Security Act of 1947 (50 U.S.C. 3003(4)).
thereto. threat’ means an action, not protected by ‘‘(17) MANAGED SERVICE PROVIDER.—The
‘‘(6) CRITICAL INFRASTRUCTURE INFORMA- the First Amendment to the Constitution of term ‘managed service provider’ means an
TION.—The term ‘critical infrastructure in- the United States, on or through an informa- entity that delivers services, such as net-
formation’ means information not custom- tion system that may result in an unauthor- work, application, infrastructure, or security
arily in the public domain and related to the ized effort to adversely impact the security, services, via ongoing and regular support and
security of critical infrastructure or pro- availability, confidentiality, or integrity of active administration on the premises of a
tected systems, including— an information system or information that customer, in the data center of the entity
‘‘(A) actual, potential, or threatened inter- is stored on, processed by, or transiting an (such as hosting), or in a third party data
ference with, attack on, compromise of, or information system. center.
incapacitation of critical infrastructure or ‘‘(B) EXCLUSION.—The term ‘cybersecurity ‘‘(18) MONITOR.—The term ‘monitor’ means
protected systems by either physical or com- threat’ does not include any action that sole- to acquire, identify, or scan, or to possess,
puter-based attack or other similar conduct ly involves a violation of a consumer term of information that is stored on, processed by,
(including the misuse of or unauthorized ac- service or a consumer licensing agreement. or transiting an information system.
cess to all types of communications and data ‘‘(11) DEFENSIVE MEASURE.— ‘‘(19) NATIONAL CYBERSECURITY ASSET RE-
transmission systems) that violates Federal, ‘‘(A) IN GENERAL.—Except as provided in SPONSE ACTIVITIES.—The term ‘national cy-
State, or local law, harms interstate com- subparagraph (B), the term ‘defensive meas- bersecurity asset response activities’
merce of the United States, or threatens ure’ means an action, device, procedure, sig- means—
public health or safety; nature, technique, or other measure applied ‘‘(A) furnishing cybersecurity technical as-
‘‘(B) the ability of any critical infrastruc- to an information system or information sistance to entities affected by cybersecurity
ture or protected system to resist such inter- that is stored on, processed by, or transiting risks to protect assets, mitigate
ference, compromise, or incapacitation, in- an information system that detects, pre- vulnerabilities, and reduce impacts of cyber
cluding any planned or past assessment, pro- vents, or mitigates a known or suspected cy- incidents;
jection, or estimate of the vulnerability of bersecurity threat or security vulnerability. ‘‘(B) identifying other entities that may be
critical infrastructure or a protected system, ‘‘(B) EXCLUSION.—The term ‘defensive at risk of an incident and assessing risk to
including security testing, risk evaluation measure’ does not include a measure that de- the same or similar vulnerabilities;
thereto, risk management planning, or risk stroys, renders unusable, provides unauthor- ‘‘(C) assessing potential cybersecurity
audit; or ized access to, or substantially harms an in- risks to a sector or region, including poten-
‘‘(C) any planned or past operational prob- formation system or information stored on, tial cascading effects, and developing courses
lem or solution regarding critical infrastruc- processed by, or transiting such information of action to mitigate such risks;
ture or protected systems, including repair, system not owned by— ‘‘(D) facilitating information sharing and
recovery, reconstruction, insurance, or con- ‘‘(i) the entity operating the measure; or operational coordination with threat re-
tinuity, to the extent it is related to such in- ‘‘(ii) another entity or Federal entity that sponse; and
terference, compromise, or incapacitation. is authorized to provide consent and has pro- ‘‘(E) providing guidance on how best to uti-
‘‘(7) CYBER THREAT INDICATOR.—The term vided consent to that private entity for oper- lize Federal resources and capabilities in a
‘cyber threat indicator’ means information ation of such measure. timely, effective manner to speed recovery
that is necessary to describe or identify— ‘‘(12) HOMELAND SECURITY ENTERPRISE.— from cybersecurity risks.
‘‘(A) malicious reconnaissance, including The term ‘Homeland Security Enterprise’ ‘‘(20) NATIONAL SECURITY SYSTEM.—The
anomalous patterns of communications that means relevant governmental and non- term ‘national security system’ has the
appear to be transmitted for the purpose of governmental entities involved in homeland meaning given the term in section 11103 of
gathering technical information related to a security, including Federal, State, local, and title 40, United States Code.
cybersecurity threat or security vulner- Tribal government officials, private sector ‘‘(21) RANSOM PAYMENT.—The term ‘ransom
ability; representatives, academics, and other policy payment’ means the transmission of any
‘‘(B) a method of defeating a security con- experts. money or other property or asset, including
trol or exploitation of a security vulner- ‘‘(13) INCIDENT.—The term ‘incident’ means virtual currency, or any portion thereof,
ability; an occurrence that actually or imminently which has at any time been delivered as ran-
‘‘(C) a security vulnerability, including jeopardizes, without lawful authority, the in- som in connection with a ransomware at-
anomalous activity that appears to indicate tegrity, confidentiality, or availability of in- tack.
the existence of a security vulnerability; formation on an information system, or ac- ‘‘(22) RANSOMWARE ATTACK.—The term
‘‘(D) a method of causing a user with le- tually or imminently jeopardizes, without ‘ransomware attack’—
gitimate access to an information system or lawful authority, an information system. ‘‘(A) means a cyber incident that includes
information that is stored on, processed by, ‘‘(14) INFORMATION SHARING AND ANALYSIS the use or threat of use of unauthorized or
or transiting an information system to un- ORGANIZATION.—The term ‘Information Shar- malicious code on an information system, or
wittingly enable the defeat of a security con- ing and Analysis Organization’ means any the use or threat of use of another digital
trol or exploitation of a security vulner- formal or informal entity or collaboration mechanism such as a denial of service at-
ability; created or employed by public or private sec- tack, to interrupt or disrupt the operations
‘‘(E) malicious cyber command and con- tor organizations, for purposes of— of an information system or compromise the
trol; ‘‘(A) gathering and analyzing critical infra- confidentiality, availability, or integrity of
‘‘(F) the actual or potential harm caused structure information, including informa- electronic data stored on, processed by, or
ctelli on DSK11ZRN23PROD with SENATE
by an incident, including a description of the tion related to cybersecurity risks and inci- transiting an information system to extort a
information exfiltrated as a result of a par- dents, in order to better understand security demand for a ransom payment; and
ticular cybersecurity threat; problems and interdependencies related to ‘‘(B) does not include any such event where
‘‘(G) any other attribute of a cybersecurity critical infrastructure, including cybersecu- the demand for payment is made by a Fed-
threat, if disclosure of such attribute is not rity risks and incidents, and protected sys- eral Government entity, good faith security
otherwise prohibited by law; or tems, so as to ensure the availability, integ- research, or in response to an invitation by
‘‘(H) any combination thereof. rity, and reliability thereof; the owner or operator of the information
Full text truncated for size; the complete document is in the PDF above.File and source
- File
- CREC_crec-2021-11-18_crec-2021-11-18-pt1-pgs8456.pdf
- Size
- 1,323,185 bytes
- SHA-256
- c152df44c19dc3b8d38c45b2defb5877f2685e22eef09f1ff324c8fcd5471a63
- Original
- www.govinfo.gov