§29.5. Requirements for protection. — Inbound Citations

(3) Any planned or past operational problem or solution regarding critical infrastructure or protected systems, including repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to such interference, compromise, or incapacitation.

CII Act means the Critical Infrastructure Information Act of 2002 in 6 U.S.C. 671-674; Sections 2222-2225 of the Homeland Security Act of 2002, Public Law 107-296, 116 Stat. 2135, as amended by Subtitle B of the Cybersecurity and Infrastructure Security Act of 2018, Public Law 115-278, 132 Stat. 4168.

CISA means the Cybersecurity and Infrastructure Security Agency.

Department or DHS means the Department of Homeland Security.

Director means the Director of the CISA, any successors to that position within the Department, or any designee.

Executive Assistant Director means the Executive Assistant Director for the Infrastructure Security Division of the CISA, any successors to that position within the Department, or any designee.

Information Sharing and Analysis Organization or ISAO has the same meaning stated in 6 U.S.C. 671(5) and means any formal or informal entity or collaboration created or employed by public or private sector organizations for purposes of:

(b) All information submitted in accordance with the procedures set forth in § 29.5 of this part will be presumed to be and will be treated as PCII, enjoying the protections of the CII Act, from the time the information is received by the PCII Program Office or a PCII Program Manager's Designee. The information must remain protected unless and until the PCII Program Office renders a final decision that the information is not PCII. The PCII Program Office will, with respect to information that is not properly submitted, inform the submitting person or entity within thirty calendar days of receipt, by a means of communication to be prescribed by the PCII Program Manager, that the submittal was procedurally defective. The submitter will then have an additional thirty calendar days to remedy the deficiency from the date of receipt of such notification by the PCII Program Office. If the submitting person or entity does not cure the deficiency within thirty calendar days after the date of receipt of the notification provided by the PCII Program Office in this paragraph, the PCII Program Office may determine that the presumption of protection is terminated. Under such circumstances, the PCII Program Office may cure the deficiency by labeling the submission with the information required in § 29.5 or may notify the applicant that the submission does not qualify as PCII. No CII submission will lose its presumptive status as PCII except as provided in paragraph (g) of this section.

(A) Request that the submitting person or entity complete the requirements of § 29.5(a) or further explain the nature of the information and the submitting person or entity's basis for believing the information qualifies for protection under the CII Act;

(f) The PCII Program Manager has discretion to declare certain subject matter or types of information categorically protected as PCII and to set procedures for receipt and processing of such information. Information within a categorical inclusion will be considered validated upon receipt by the PCII Program Manager or any of the PCII Program Manager's Designees without further review, provided that the submitter provides the express statement required by § 29.5(a)(3). The PCII Program Manager's designees will provide to the PCII Program Office information submitted under a categorical inclusion.

(1) Contact the submitting person or entity, within thirty calendar days of receipt of the submission of CII, by the means of delivery prescribed in procedures developed by the PCII Program Manager. In the case of oral submissions, receipt will be acknowledged in writing within thirty calendar days after receipt by the PCII Program Office or a PCII Program Manager's Designee of a written statement, certification, and documents that memorialize the oral submission, as referenced in § 29.5(a)(3)(ii);

(A) Request that the submitting person or entity complete the requirements of § 29.5(a) or further explain the nature of the information and the submitting person or entity's basis for believing the information qualifies for protection under the CII Act;