Section 1 Short title
This Act may be cited as the “Cyber Valuing Individual Cybersecurity Through Interagency Measures Act” or the “Cyber VICTIM Act”.
Cyber Valuing Individual Cybersecurity Through Interagency Measures Act
A BILL
To provide for an interagency cyber victim coordinator to respond to data breaches and other cyber attacks on Federal employees.
Sec. 2 Interagency cyber victim response
Interagency cyber victim coordinator—
In general— Not later than 60 days after the date of the enactment of this Act, the President shall designate a Federal official to coordinate efforts to respond to data breaches and other cyber attacks on Federal employees. Such official shall have the title of interagency cyber victim response coordinator.
Duties— The coordinator designated under paragraph (1) shall have the following duties:
Coordinate activities of the Federal Government relating to incidents of data breaches in which the data of Federal employees, including Social Security numbers, personal financial information, addresses, and other private identifying information, has been compromised, to—
ensure victims receive appropriate response and assistance from the Federal Government; and
ensure synchronization of intelligence and responses among Federal law enforcement agencies to incidents of cyber attacks against Federal employees.
Chair an interagency working group consisting of appropriate personnel of the Federal Government with purview over response to cyber attacks against Federal employees.
Ensure sufficient representation of each Federal agency and department at any interagency working group established under subparagraph (B).
Develop processes and procedures to keep victims informed of efforts to—
mitigate damage from data breaches; and
prosecute perpetrators.
Annual report—
In general— On an annual basis, the Coordinator shall submit to the appropriate congressional committees a report that includes a summary of each data breach described in subsection (a)(1) that occurred during the year for which the report is submitted.
Form of report— Each report under paragraph (1) may be submitted in classified or unclassified form.
Comprehensive plan To address cyber attacks— Not later than 180 days after the date of the enactment of this Act, the President shall develop a comprehensive plan for the United States response to data breaches of personal information of Federal employees.
Definitions— In this section, the following definitions apply:
Appropriate congressional committees— The term “appropriate congressional committees” means—
the Committee on Armed Services, the Committee on the Judiciary, the Permanent Select Committee on Intelligence, and the Committee on Homeland Security of the House of Representatives; and
the Committee on Armed Services, the Committee on the Judiciary, the Select Committee on Intelligence, and the Committee on Homeland Security and Governmental Affairs of the Senate.
Data breach— The term “data breach” means an unauthorized intrusion of a Federal database resulting in a breach of personal information of a Federal employee, including—
the 2015 breaches of the Office of Personnel Management databases relating to background security checks and Federal employee background information; and
the November 2014 breach of the United States Postal Service employee database system.