---
kind: "section"
citation: "6 U.S.C. § 659"
title: "6"
title_heading: "Domestic Security"
number: "659"
heading: "National cybersecurity and communications integration center"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/659"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part A — Cybersecurity and Infrastructure Security"
---

# §659. National cybersecurity and communications integration center

- (a) **Definition—** The term “cybersecurity vulnerability” has the meaning given the term “[security vulnerability](/usc/6/650.md?p=25)” in [section 650 of this title](/usc/6/650.md).
- (b) **Center—** There is in the [Department](/usc/6/641.md?p=1) a national cybersecurity and communications integration [center](/usc/6/681.md?p=1) (referred to in this section as the “[Center](/usc/6/681.md?p=1)”) to carry out certain responsibilities of the [Director](/usc/6/650.md?p=10). The [Center](/usc/6/681.md?p=1) shall be located in the Cybersecurity and Infrastructure Security [Agency](/usc/6/650.md?p=1). The head of the [Center](/usc/6/681.md?p=1) shall report to the Executive Assistant [Director](/usc/6/650.md?p=10) for Cybersecurity.
- (c) **Functions—** The cybersecurity [functions](/usc/6/101.md?p=9) of the [Center](/usc/6/681.md?p=1) shall include—
  - (1) being a Federal civilian interface for the multi-directional and cross-sector [sharing](/usc/6/650.md?p=26) of information related to [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), [cybersecurity risks](/usc/6/650.md?p=7), [incidents](/usc/6/650.md?p=12), analysis, and warnings for Federal and non-[Federal entities](/usc/6/681.md?p=7), including the implementation of title I of the Cybersecurity Act of 2015 [[6 U.S.C. 1501](/usc/6/1501.md) et seq.];
  - (2) providing shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government and non-[Federal entities](/usc/6/681.md?p=7) to address [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12) to Federal and non-[Federal entities](/usc/6/681.md?p=7);
  - (3) coordinating the [sharing](/usc/6/650.md?p=26) of information related to [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), [cybersecurity risks](/usc/6/650.md?p=7), and [incidents](/usc/6/650.md?p=12) across the Federal Government;
  - (4) facilitating cross-sector coordination to address [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12), including [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12) that may be related or could have consequential impacts across multiple sectors;
  - (5)
    - (A) conducting integration and analysis, including cross-sector integration and analysis, of [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), [cybersecurity risks](/usc/6/650.md?p=7), and [incidents](/usc/6/650.md?p=12);
    - (B) [sharing](/usc/6/650.md?p=26) mitigation protocols to counter cybersecurity vulnerabilities pursuant to [subsection (n)](#n), as appropriate; and
    - (C) [sharing](/usc/6/650.md?p=26) the analysis conducted under [subparagraph (A)](#c-5-A) and mitigation protocols to counter cybersecurity vulnerabilities in accordance with [subparagraph (B)](#c-5-B), as appropriate, with Federal and non-[Federal entities](/usc/6/681.md?p=7);
  - (6) upon request, providing operational and timely technical assistance, risk management support, and [incident](/usc/6/650.md?p=12) response capabilities to Federal and non-[Federal entities](/usc/6/681.md?p=7) with respect to [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), [cybersecurity risks](/usc/6/650.md?p=7), and [incidents](/usc/6/650.md?p=12), which may include attribution, mitigation, and remediation, which may take the form of continuous monitoring and detection of [cybersecurity risks](/usc/6/650.md?p=7) to [critical infrastructure](/usc/6/101.md?p=4) [entities](/usc/6/301c.md?p=2) that own or operate industrial control systems that support national critical [functions](/usc/6/101.md?p=9);
  - (7) providing information and recommendations on security and resilience measures to Federal and non-[Federal entities](/usc/6/681.md?p=7), including information and recommendations to—
    - (A) facilitate information security;
    - (B) strengthen [information systems](/usc/6/650.md?p=14) against [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12); and
    - (C) share [cyber threat indicators](/usc/6/650.md?p=5) and [defensive measures](/usc/6/650.md?p=9-A);
  - (8) engaging with international partners, in consultation with other appropriate [agencies](/usc/6/650.md?p=1), to—
    - (A) collaborate on [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), and information related to [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12); and
    - (B) enhance the security and resilience of global cybersecurity;
  - (9) [sharing](/usc/6/650.md?p=26) [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), mitigation protocols to counter cybersecurity vulnerabilities, as appropriate, and other information related to [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12) with Federal and non-[Federal entities](/usc/6/681.md?p=7), including across sectors of [critical infrastructure](/usc/6/101.md?p=4) and with [State](/usc/6/101.md?p=17) and major urban area fusion [centers](/usc/6/681.md?p=1), as appropriate;
  - (10) participating, as appropriate, in national exercises run by the [Department](/usc/6/641.md?p=1);
  - (11) in coordination with the [Emergency](/usc/6/701.md?p=6) Communications Division of the [Department](/usc/6/641.md?p=1), assessing and evaluating consequence, vulnerability, and threat information regarding [cyber incidents](/usc/6/681.md?p=5) to public safety communications to help facilitate continuous improvements to the security and resiliency of such communications;
  - (12) detecting, identifying, and receiving information for a [cybersecurity purpose](/usc/6/650.md?p=6) about [security vulnerabilities](/usc/6/650.md?p=25) relating to [critical infrastructure](/usc/6/101.md?p=4) in [information systems](/usc/6/650.md?p=14) and devices; and
  - (13) receiving, aggregating, and analyzing reports related to [covered cyber incidents](/usc/6/681.md?p=3) (as defined in [section 681 of this title](/usc/6/681.md)) submitted by [covered entities](/usc/6/681.md?p=4) (as defined in [section 681 of this title](/usc/6/681.md)) and reports related to [ransom payments](/usc/6/681.md?p=8) (as defined in [section 681 of this title](/usc/6/681.md)) submitted by [covered entities](/usc/6/681.md?p=4) (as defined in [section 681 of this title](/usc/6/681.md)) in furtherance of the activities specified in sections [652(e)](/usc/6/652.md?p=e), [653](/usc/6/653.md), and [681a](/usc/6/681a.md) of this title, this subsection, and any other authorized activity of the [Director](/usc/6/650.md?p=10), to enhance the situational awareness of [cybersecurity threats](/usc/6/650.md?p=8-A) across [critical infrastructure sectors](/usc/6/601.md?p=3).
- (d) **Composition—**
  - (1) **In general—** The [Center](/usc/6/681.md?p=1) shall be composed of—
    - (A) appropriate representatives of [Federal entities](/usc/6/681.md?p=7), such as—
      - (i) sector-specific [agencies](/usc/6/650.md?p=1);
      - (ii) civilian and law enforcement [agencies](/usc/6/650.md?p=1); and
      - (iii) elements of the [intelligence community](/usc/6/650.md?p=15);
    - (B) appropriate representatives of non-[Federal entities](/usc/6/681.md?p=7), such as—
      - (i) [State](/usc/6/101.md?p=17), local, and [tribal governments](/usc/6/601.md?p=14);
      - (ii) [Information Sharing and Analysis Organizations](/usc/6/650.md?p=13), including information [sharing](/usc/6/650.md?p=26) and analysis [centers](/usc/6/681.md?p=1);
      - (iii) owners and operators of critical [information systems](/usc/6/650.md?p=14); and
      - (iv) private [entities](/usc/6/301c.md?p=2), including cybersecurity specialists;
    - (C) components within the [Center](/usc/6/681.md?p=1) that carry out cybersecurity and communications activities;
    - (D) a designated Federal official for operational coordination with and across each sector;
    - (E) an [entity](/usc/6/301c.md?p=2) that collaborates with [State](/usc/6/101.md?p=17) and [local governments](/usc/6/101.md?p=13), including an [entity](/usc/6/301c.md?p=2) that collaborates with election officials, on [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12), and has entered into a [voluntary](/usc/6/671.md?p=6-A) information [sharing](/usc/6/650.md?p=26) relationship with the [Center](/usc/6/681.md?p=1); and
    - (F) other appropriate representatives or [entities](/usc/6/301c.md?p=2), as determined by the [Secretary](/usc/6/641.md?p=3).
  - (2) **Incidents—** In the event of an [incident](/usc/6/650.md?p=12), during exigent circumstances the [Secretary](/usc/6/641.md?p=3) may grant a Federal or non-[Federal entity](/usc/6/681.md?p=7) immediate temporary access to the [Center](/usc/6/681.md?p=1).
- (e) **Principles—** In carrying out the [functions](/usc/6/101.md?p=9) under [subsection (c)](#c), the [Center](/usc/6/681.md?p=1) shall ensure—
  - (1) to the extent practicable, that—
    - (A) timely, actionable, and relevant [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), and information related to [cybersecurity risks](/usc/6/650.md?p=7), [incidents](/usc/6/650.md?p=12), and analysis is shared;
    - (B) when appropriate, [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), and information related to [cybersecurity risks](/usc/6/650.md?p=7), [incidents](/usc/6/650.md?p=12), and analysis is integrated with other relevant information and tailored to the specific characteristics of a sector;
    - (C) activities are prioritized and conducted based on the level of risk;
    - (D) industry sector-specific, academic, and national laboratory expertise is sought and receives appropriate consideration;
    - (E) continuous, collaborative, and inclusive coordination occurs—
      - (i) across sectors; and
      - (ii) with—
        - (I) sector coordinating [councils](/usc/6/681.md?p=2);
        - (II) [Information Sharing and Analysis Organizations](/usc/6/650.md?p=13); and
        - (III) other appropriate non-Federal partners;
    - (F) as appropriate, the [Center](/usc/6/681.md?p=1) works to develop and use mechanisms for [sharing](/usc/6/650.md?p=26) information related to [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), [cybersecurity risks](/usc/6/650.md?p=7), and [incidents](/usc/6/650.md?p=12) that are technology-neutral, interoperable, real-time, cost-effective, and resilient;
    - (G) the [Center](/usc/6/681.md?p=1) works with other [agencies](/usc/6/650.md?p=1) to reduce unnecessarily duplicative [sharing](/usc/6/650.md?p=26) of information related to [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), [cybersecurity risks](/usc/6/650.md?p=7), and [incidents](/usc/6/650.md?p=12);
    - (H) the [Center](/usc/6/681.md?p=1) designates an [agency](/usc/6/650.md?p=1) contact for non-[Federal entities](/usc/6/681.md?p=7); and
    - (I) activities of the [Center](/usc/6/681.md?p=1) address the security of both information technology and operational technology, including industrial control systems;
  - (2) that information related to [cyber threat indicators](/usc/6/650.md?p=5), [defensive measures](/usc/6/650.md?p=9-A), [cybersecurity risks](/usc/6/650.md?p=7), and [incidents](/usc/6/650.md?p=12) is appropriately safeguarded against unauthorized access or disclosure; and
  - (3) that activities conducted by the [Center](/usc/6/681.md?p=1) comply with all policies, regulations, and laws that protect the privacy and civil liberties of [United States](/usc/6/101.md?p=19-A) persons, including by working with the Privacy Officer appointed under [section 142 of this title](/usc/6/142.md) to ensure that the [Center](/usc/6/681.md?p=1) follows the policies and procedures specified in subsections [(b)](/usc/6/105.md?p=b) and [(d)(5)(C)](/usc/6/105.md) of section 105 of the Cybersecurity Act of 2015 [[6 U.S.C. 1504](/usc/6/1504.md)].
- (f) **Cyber hunt and incident response teams—**
  - (1) **In general—** The [Center](/usc/6/681.md?p=1) shall maintain cyber hunt and [incident](/usc/6/650.md?p=12) response teams for the purpose of leading Federal [asset response activities](/usc/6/677a.md?p=1) and providing timely technical assistance to Federal and non-[Federal entities](/usc/6/681.md?p=7), including across all [critical infrastructure sectors](/usc/6/601.md?p=3), regarding actual or potential security [incidents](/usc/6/650.md?p=12), as appropriate and upon request, including—
    - (A) assistance to asset owners and operators in restoring services following a [cyber incident](/usc/6/681.md?p=5);
    - (B) identification and analysis of [cybersecurity risk](/usc/6/650.md?p=7) and unauthorized cyber activity;
    - (C) mitigation strategies to prevent, deter, and protect against [cybersecurity risks](/usc/6/650.md?p=7);
    - (D) recommendations to asset owners and operators for improving overall network and control systems security to lower [cybersecurity risks](/usc/6/650.md?p=7), and other recommendations, as appropriate; and
    - (E) such other capabilities as the [Secretary](/usc/6/641.md?p=3) determines appropriate.
  - (2) **Associated metrics—** The [Center](/usc/6/681.md?p=1) shall—
    - (A) define the goals and desired outcomes for each cyber hunt and [incident](/usc/6/650.md?p=12) response team; and
    - (B) develop metrics—
      - (i) to measure the effectiveness and efficiency of each cyber hunt and [incident](/usc/6/650.md?p=12) response team in achieving the goals and desired outcomes defined under [subparagraph (A)](#f-2-A); and
      - (ii) that—
        - (I) are quantifiable and actionable; and
        - (II) the [Center](/usc/6/681.md?p=1) shall use to improve the effectiveness and accountability of, and service delivery by, cyber hunt and [incident](/usc/6/650.md?p=12) response teams.
  - (3) **Cybersecurity specialists—** After notice to, and with the approval of, the [entity](/usc/6/301c.md?p=2) requesting action by or technical assistance from the [Center](/usc/6/681.md?p=1), the [Secretary](/usc/6/641.md?p=3) may include cybersecurity specialists from the private sector on a cyber hunt and [incident](/usc/6/650.md?p=12) response team.
- (g) **No right or benefit—**
  - (1) **In general—** The provision of assistance or information to, and inclusion in the [Center](/usc/6/681.md?p=1), or any team or activity of the [Center](/usc/6/681.md?p=1), of, governmental or private [entities](/usc/6/301c.md?p=2) under this section shall be at the sole and unreviewable discretion of the [Director](/usc/6/650.md?p=10).
  - (2) **Certain assistance or information—** The provision of certain assistance or information to, or inclusion in the [Center](/usc/6/681.md?p=1), or any team or activity of the [Center](/usc/6/681.md?p=1), of, one governmental or private [entity](/usc/6/301c.md?p=2) pursuant to this section shall not create a right or benefit, substantive or procedural, to similar assistance or information for any other governmental or private [entity](/usc/6/301c.md?p=2).
- (h) **Automated information sharing—**
  - (1) **In general—** The [Director](/usc/6/650.md?p=10), in coordination with industry and other stakeholders, shall develop capabilities making use of existing information technology industry standards and best practices, as appropriate, that support and rapidly advance the development, adoption, and implementation of automated mechanisms for the [sharing](/usc/6/650.md?p=26) of [cyber threat indicators](/usc/6/650.md?p=5) and [defensive measures](/usc/6/650.md?p=9-A) in accordance with title I of the Cybersecurity Act of 2015 [[6 U.S.C. 1501](/usc/6/1501.md) et seq.].
  - (2) **Annual report—** The [Director](/usc/6/650.md?p=10) shall submit to the Committee on [Homeland](/usc/6/101.md?p=1) Security and Governmental Affairs of the Senate and the Committee on [Homeland](/usc/6/101.md?p=1) Security of the House of Representatives an annual report on the status and progress of the development of the capabilities described in [paragraph (1)](#h-1). Such reports shall be required until such capabilities are fully implemented.
- (i) **Voluntary information sharing procedures—**
  - (1) **Procedures—**
    - (A) **In general—** The [Center](/usc/6/681.md?p=1) may enter into a [voluntary](/usc/6/671.md?p=6-A) information [sharing](/usc/6/650.md?p=26) relationship with any consenting non-[Federal entity](/usc/6/681.md?p=7) for the [sharing](/usc/6/650.md?p=26) of [cyber threat indicators](/usc/6/650.md?p=5) and [defensive measures](/usc/6/650.md?p=9-A) for [cybersecurity purposes](/usc/6/650.md?p=6) in accordance with this section. Nothing in this subsection may be construed to require any non-[Federal entity](/usc/6/681.md?p=7) to enter into any such information [sharing](/usc/6/650.md?p=26) relationship with the [Center](/usc/6/681.md?p=1) or any other [entity](/usc/6/301c.md?p=2). The [Center](/usc/6/681.md?p=1) may terminate a [voluntary](/usc/6/671.md?p=6-A) information [sharing](/usc/6/650.md?p=26) relationship under this subsection, at the sole and unreviewable discretion of the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), for any reason, including if the [Center](/usc/6/681.md?p=1) determines that the non-[Federal entity](/usc/6/681.md?p=7) with which the [Center](/usc/6/681.md?p=1) has entered into such a relationship has violated the terms of this subsection.
    - (B) **National security—** The [Secretary](/usc/6/641.md?p=3) may decline to enter into a [voluntary](/usc/6/671.md?p=6-A) information [sharing](/usc/6/650.md?p=26) relationship under this subsection, at the sole and unreviewable discretion of the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), for any reason, including if the [Secretary](/usc/6/641.md?p=3) determines that such is appropriate for national security.
  - (2) **Voluntary information sharing relationships—** A [voluntary](/usc/6/671.md?p=6-A) information [sharing](/usc/6/650.md?p=26) relationship under this subsection may be characterized as an agreement described in this paragraph.
    - (A) **Standard agreement—** For the use of a non-[Federal entity](/usc/6/681.md?p=7), the [Center](/usc/6/681.md?p=1) shall make available a standard agreement, consistent with this section, on the [Department](/usc/6/641.md?p=1)’s website.
    - (B) **Negotiated agreement—** At the request of a non-[Federal entity](/usc/6/681.md?p=7), and if determined appropriate by the [Center](/usc/6/681.md?p=1), at the sole and unreviewable discretion of the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), the [Department](/usc/6/641.md?p=1) shall negotiate a non-standard agreement, consistent with this section.
    - (C) **Existing agreements—** An agreement between the [Center](/usc/6/681.md?p=1) and a non-[Federal entity](/usc/6/681.md?p=7) that is entered into before December 18, 2015, or such an agreement that is in effect before such date, shall be deemed in compliance with the requirements of this subsection, notwithstanding any other provision or requirement of this subsection. An agreement under this subsection shall include the relevant privacy protections as in effect under the Cooperative Research and Development Agreement for Cybersecurity Information [Sharing](/usc/6/650.md?p=26) and Collaboration, as of December 31, 2014. Nothing in this subsection may be construed to require a non-[Federal entity](/usc/6/681.md?p=7) to enter into either a standard or negotiated agreement to be in compliance with this subsection.
- (j) **Direct reporting—** The [Secretary](/usc/6/641.md?p=3) shall develop policies and procedures for direct reporting to the [Secretary](/usc/6/641.md?p=3) by the [Director](/usc/6/650.md?p=10) of the [Center](/usc/6/681.md?p=1) regarding significant [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12).
- (k) **Reports on international cooperation—** Not later than 180 days after December 18, 2015, and periodically thereafter, the [Secretary](/usc/6/641.md?p=3) of [Homeland](/usc/6/101.md?p=1) Security shall submit to the Committee on [Homeland](/usc/6/101.md?p=1) Security and Governmental Affairs of the Senate and the Committee on [Homeland](/usc/6/101.md?p=1) Security of the House of Representatives a report on the range of efforts underway to bolster cybersecurity collaboration with relevant international partners in accordance with [subsection (c)(8)](#c-8).
- (l) **Outreach—** Not later than 60 days after December 18, 2015, the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall—
  - (1) disseminate to the public information about how to voluntarily share [cyber threat indicators](/usc/6/650.md?p=5) and [defensive measures](/usc/6/650.md?p=9-A) with the [Center](/usc/6/681.md?p=1); and
  - (2) enhance outreach to [critical infrastructure](/usc/6/101.md?p=4) owners and operators for purposes of such [sharing](/usc/6/650.md?p=26).
- (m) **Cybersecurity outreach—**
  - (1) **In general—** The [Secretary](/usc/6/641.md?p=3) may leverage small business development [centers](/usc/6/681.md?p=1) to provide assistance to small business concerns by disseminating information on [cyber threat indicators](/usc/6/650.md?p=5), defense measures, [cybersecurity risks](/usc/6/650.md?p=7), [incidents](/usc/6/650.md?p=12), analyses, and warnings to help small business concerns in developing or enhancing cybersecurity infrastructure, awareness of [cyber threat indicators](/usc/6/650.md?p=5), and cyber training programs for employees.
  - (2) **Definitions—** For purposes of this subsection, the terms “small business concern” and “small business development [center](/usc/6/681.md?p=1)” have the meaning given such terms, respectively, under [section 632 of title 15](/usc/15/632.md).
- (n) **Coordinated vulnerability disclosure—** The [Secretary](/usc/6/641.md?p=3), in coordination with industry and other stakeholders, may develop and adhere to [Department](/usc/6/641.md?p=1) policies and procedures for coordinating vulnerability disclosures.
- (o) **Protocols to counter certain cybersecurity vulnerabilities—** The [Director](/usc/6/650.md?p=10) may, as appropriate, identify, develop, and disseminate actionable protocols to mitigate cybersecurity vulnerabilities to [information systems](/usc/6/650.md?p=14) and industrial control systems, including in circumstances in which such vulnerabilities exist because software or hardware is no longer supported by a vendor.
- (p) **Subpoena authority—**
  - (1) **Definition—** In this subsection, the term “covered device or system”—
    - (A) means a device or system commonly used to perform industrial, commercial, scientific, or governmental [functions](/usc/6/101.md?p=9) or processes that relate to [critical infrastructure](/usc/6/101.md?p=4), including operational and industrial control systems, distributed control systems, and programmable logic controllers; and
    - (B) does not include personal devices and systems, such as consumer mobile devices, home computers, residential wireless routers, or residential internet enabled consumer devices.
  - (2) **Authority—**
    - (A) **In general—** If the [Director](/usc/6/650.md?p=10) identifies a system connected to the internet with a specific [security vulnerability](/usc/6/650.md?p=25) and has reason to believe such [security vulnerability](/usc/6/650.md?p=25) relates to [critical infrastructure](/usc/6/101.md?p=4) and affects a covered device or system, and the [Director](/usc/6/650.md?p=10) is unable to identify the [entity](/usc/6/301c.md?p=2) at risk that owns or operates such covered device or system, the [Director](/usc/6/650.md?p=10) may issue a subpoena for the production of information necessary to identify and notify such [entity](/usc/6/301c.md?p=2) at risk, in order to carry out a function authorized under [subsection (c)(12)](#c-12).
    - (B) **Limit on information—** A subpoena issued pursuant to [subparagraph (A)](#p-2-A) may seek information—
      - (i) only in the categories set forth in subparagraphs (A), (B), (D), and (E) of [section 2703(c)(2) of title 18](/usc/18/2703.md?p=c-2); and
      - (ii) for not more than 20 covered devices or systems.
    - (C) **Liability protections for disclosing providers—** The provisions of [section 2703(e) of title 18](/usc/18/2703.md?p=e), shall apply to any subpoena issued pursuant to [subparagraph (A)](#p-2-A).
  - (3) **Coordination—**
    - (A) **In general—** If the [Director](/usc/6/650.md?p=10) exercises the subpoena authority under this subsection, and in the interest of avoiding interference with ongoing law enforcement investigations, the [Director](/usc/6/650.md?p=10) shall coordinate the issuance of any such subpoena with the [Department](/usc/6/641.md?p=1) of Justice, including the Federal Bureau of Investigation, pursuant to interagency procedures which the [Director](/usc/6/650.md?p=10), in coordination with the Attorney General, shall develop not later than 60 days after January 1, 2021.
    - (B) **Contents—** The inter-[agency](/usc/6/650.md?p=1) procedures developed under this paragraph shall provide that a subpoena issued by the [Director](/usc/6/650.md?p=10) under this subsection shall be—
      - (i) issued to carry out a function described in [subsection (c)(12)](#c-12); and
      - (ii) subject to the limitations specified in this subsection.
  - (4) **Noncompliance—** If any person, partnership, corporation, association, or [entity](/usc/6/301c.md?p=2) fails to comply with any duly served subpoena issued pursuant to this subsection, the [Director](/usc/6/650.md?p=10) may request that the Attorney General seek enforcement of such subpoena in any judicial district in which such person, partnership, corporation, association, or [entity](/usc/6/301c.md?p=2) resides, is found, or transacts business.
  - (5) **Notice—** Not later than seven days after the date on which the [Director](/usc/6/650.md?p=10) receives information obtained through a subpoena issued pursuant to this subsection, the [Director](/usc/6/650.md?p=10) shall notify any [entity](/usc/6/301c.md?p=2) identified by information obtained pursuant to such subpoena regarding such subpoena and the identified vulnerability.
  - (6) **Authentication—**
    - (A) **In general—** Any subpoena issued pursuant to this subsection shall be authenticated with a cryptographic digital signature of an authorized representative of the [Agency](/usc/6/650.md?p=1), or other comparable successor technology, that allows the [Agency](/usc/6/650.md?p=1) to demonstrate that such subpoena was issued by the [Agency](/usc/6/650.md?p=1) and has not been altered or modified since such issuance.
    - (B) **Invalid if not authenticated—** Any subpoena issued pursuant to this subsection that is not authenticated in accordance with [subparagraph (A)](#p-6-A) shall not be considered to be valid by the recipient of such subpoena.
  - (7) **Procedures—** Not later than 90 days after January 1, 2021, the [Director](/usc/6/650.md?p=10) shall establish internal procedures and associated training, applicable to employees and operations of the [Agency](/usc/6/650.md?p=1), regarding subpoenas issued pursuant to this subsection, which shall address the following:
    - (A) The protection of and restriction on dissemination of nonpublic information obtained through such a subpoena, including a requirement that the [Agency](/usc/6/650.md?p=1) not disseminate nonpublic information obtained through such a subpoena that identifies the party that is subject to such subpoena or the [entity](/usc/6/301c.md?p=2) at risk identified by information obtained, except that the [Agency](/usc/6/650.md?p=1) may share the nonpublic information with the [Department](/usc/6/641.md?p=1) of Justice for the purpose of enforcing such subpoena in accordance with [paragraph (4)](#p-4), and may share with a [Federal agency](/usc/6/677a.md?p=4) the nonpublic information of the [entity](/usc/6/301c.md?p=2) at risk if—
      - (i) the [Agency](/usc/6/650.md?p=1) identifies or is notified of a cybersecurity [incident](/usc/6/650.md?p=12) involving such [entity](/usc/6/301c.md?p=2), which relates to the vulnerability which led to the issuance of such subpoena;
      - (ii) the [Director](/usc/6/650.md?p=10) determines that [sharing](/usc/6/650.md?p=26) the nonpublic information with another Federal [department](/usc/6/641.md?p=1) or [agency](/usc/6/650.md?p=1) is necessary to allow such [department](/usc/6/641.md?p=1) or [agency](/usc/6/650.md?p=1) to take a law enforcement or national security action, consistent with the interagency procedures under [paragraph (3)(A)](#p-3-A), or actions related to mitigating or otherwise resolving such [incident](/usc/6/650.md?p=12);
      - (iii) the [entity](/usc/6/301c.md?p=2) to which the information pertains is notified of the [Director](/usc/6/650.md?p=10)’s determination, to the extent practicable consistent with national security or law enforcement interests, consistent with such interagency procedures; and
      - (iv) the [entity](/usc/6/301c.md?p=2) consents, except that the [entity](/usc/6/301c.md?p=2)’s consent shall not be required if another Federal [department](/usc/6/641.md?p=1) or [agency](/usc/6/650.md?p=1) identifies the [entity](/usc/6/301c.md?p=2) to the [Agency](/usc/6/650.md?p=1) in connection with a suspected cybersecurity [incident](/usc/6/650.md?p=12).
    - (B) The restriction on the use of information obtained through such a subpoena for a [cybersecurity purpose](/usc/6/650.md?p=6).
    - (C) The retention and destruction of nonpublic information obtained through such a subpoena, including—
      - (i) destruction of such information that the [Director](/usc/6/650.md?p=10) determines is unrelated to [critical infrastructure](/usc/6/101.md?p=4) immediately upon providing notice to the [entity](/usc/6/301c.md?p=2) pursuant to [paragraph (5)](#p-5); and
      - (ii) destruction of any personally identifiable information not later than 6 months after the date on which the [Director](/usc/6/650.md?p=10) receives information obtained through such a subpoena, unless otherwise agreed to by the individual identified by the subpoena respondent.
    - (D) The processes for providing notice to each party that is subject to such a subpoena and each [entity](/usc/6/301c.md?p=2) identified by information obtained under such a subpoena.
    - (E) The processes and criteria for conducting [critical infrastructure](/usc/6/101.md?p=4) security risk assessments to determine whether a subpoena is necessary prior to being issued pursuant to this subsection.
    - (F) The information to be provided to an [entity](/usc/6/301c.md?p=2) at risk at the time of the notice of the vulnerability, which shall include—
      - (i) a discussion or statement that responding to, or subsequent engagement with, the [Agency](/usc/6/650.md?p=1), is [voluntary](/usc/6/671.md?p=6-A); and
      - (ii) to the extent practicable, information regarding the process through which the [Director](/usc/6/650.md?p=10) identifies [security vulnerabilities](/usc/6/650.md?p=25).
  - (8) **Limitation on procedures—** The internal procedures established pursuant to [paragraph (7)](#p-7) may not require an owner or operator of [critical infrastructure](/usc/6/101.md?p=4) to take any action as a result of a notice of vulnerability made pursuant to this chapter.
  - (9) **Review of procedures—** Not later than 1 year after January 1, 2021, the Privacy Officer of the [Agency](/usc/6/650.md?p=1) shall—
    - (A) review the internal procedures established pursuant to [paragraph (7)](#p-7) to ensure that—
      - (i) such procedures are consistent with fair information practices; and
      - (ii) the operations of the [Agency](/usc/6/650.md?p=1) comply with such procedures; and
    - (B) notify the Committee on [Homeland](/usc/6/101.md?p=1) Security and Governmental Affairs of the Senate and the Committee on [Homeland](/usc/6/101.md?p=1) Security of the House of Representatives of the results of the review under [subparagraph (A)](#p-9-A).
  - (10) **Publication of information—** Not later than 120 days after establishing the internal procedures under [paragraph (7)](#p-7), the [Director](/usc/6/650.md?p=10) shall publish information on the website of the [Agency](/usc/6/650.md?p=1) regarding the subpoena process under this subsection, including information regarding the following:
    - (A) Such internal procedures.
    - (B) The purpose for subpoenas issued pursuant to this subsection.
    - (C) The subpoena process.
    - (D) The criteria for the [critical infrastructure](/usc/6/101.md?p=4) security risk assessment conducted prior to issuing a subpoena.
    - (E) Policies and procedures on retention and [sharing](/usc/6/650.md?p=26) of data obtained by subpoenas.
    - (F) Guidelines on how [entities](/usc/6/301c.md?p=2) contacted by the [Director](/usc/6/650.md?p=10) may respond to notice of a subpoena.
  - (11) **Annual reports—** The [Director](/usc/6/650.md?p=10) shall annually submit to the Committee on [Homeland](/usc/6/101.md?p=1) Security and Governmental Affairs of the Senate and the Committee on [Homeland](/usc/6/101.md?p=1) Security of the House of Representatives a report (which may include a classified annex but with the presumption of declassification) on the use of subpoenas issued pursuant to this subsection, which shall include the following:
    - (A) A discussion of the following:
      - (i) The effectiveness of the use of such subpoenas to mitigate [critical infrastructure](/usc/6/101.md?p=4) [security vulnerabilities](/usc/6/650.md?p=25).
      - (ii) The [critical infrastructure](/usc/6/101.md?p=4) security risk assessment process conducted for subpoenas issued under this subsection.
      - (iii) The number of subpoenas so issued during the preceding year.
      - (iv) To the extent practicable, the number of vulnerable covered devices or systems mitigated under this subsection by the [Agency](/usc/6/650.md?p=1) during the preceding year.
      - (v) The number of [entities](/usc/6/301c.md?p=2) notified by the [Director](/usc/6/650.md?p=10) under this subsection, and their responses, during the preceding year.
    - (B) For each subpoena issued pursuant to this subsection, the following:
      - (i) Information relating to the source of the [security vulnerability](/usc/6/650.md?p=25) detected, identified, or received by the [Director](/usc/6/650.md?p=10).
      - (ii) Information relating to the steps taken to identify the [entity](/usc/6/301c.md?p=2) at risk prior to issuing the subpoena.
      - (iii) A description of the outcome of the subpoena, including discussion on the resolution or mitigation of the [critical infrastructure](/usc/6/101.md?p=4) [security vulnerability](/usc/6/650.md?p=25).
  - (12) **Publication of the annual reports—** The [Director](/usc/6/650.md?p=10) shall publish a version of the annual report required under [paragraph (11)](#p-11) on the website of the [Agency](/usc/6/650.md?p=1), which shall, at a minimum, include the findings described in clauses (iii), (iv), and (v) of subparagraph (A) of such paragraph.
  - (13) **Prohibition on use of information for unauthorized purposes—** Any information obtained pursuant to a subpoena issued under this subsection may not be provided to any other Federal [department](/usc/6/641.md?p=1) or [agency](/usc/6/650.md?p=1) for any purpose other than a [cybersecurity purpose](/usc/6/650.md?p=6) or for the purpose of enforcing a subpoena issued pursuant to this subsection.
- (q) **Industrial control systems—** The [Director](/usc/6/650.md?p=10) shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of [critical infrastructure](/usc/6/101.md?p=4) processes. In carrying out this subsection, the [Director](/usc/6/650.md?p=10) shall—
  - (1) lead Federal Government efforts, in consultation with [Sector Risk Management Agencies](/usc/6/650.md?p=23), as appropriate, to identify and mitigate [cybersecurity threats](/usc/6/650.md?p=8-A) to industrial control systems, including supervisory control and data acquisition systems;
  - (2) maintain threat hunting and [incident](/usc/6/650.md?p=12) response capabilities to respond to industrial control system [cybersecurity risks](/usc/6/650.md?p=7) and [incidents](/usc/6/650.md?p=12);
  - (3) provide cybersecurity technical assistance to industry end-users, product manufacturers, [Sector Risk Management Agencies](/usc/6/650.md?p=23), other [Federal agencies](/usc/6/677a.md?p=4), and other industrial control system stakeholders to identify, evaluate, assess, and mitigate vulnerabilities;
  - (4) collect, coordinate, and provide vulnerability information to the industrial control systems community by, as appropriate, working closely with security researchers, industry end-users, product manufacturers, [Sector Risk Management Agencies](/usc/6/650.md?p=23), other [Federal agencies](/usc/6/677a.md?p=4), and other industrial control systems stakeholders; and
  - (5) conduct such other efforts and assistance as the [Secretary](/usc/6/641.md?p=3) determines appropriate.
- (r) **Coordination on cybersecurity for SLTT entities—**
  - (1) **1 Coordination—** The [Center](/usc/6/681.md?p=1) shall, upon request and to the extent practicable, and in coordination as appropriate with Federal and non-[Federal entities](/usc/6/681.md?p=7), such as the Multi-[State](/usc/6/101.md?p=17) Information [Sharing](/usc/6/650.md?p=26) and Analysis [Center](/usc/6/681.md?p=1)—
    - (A) conduct exercises with [SLTT entities](/usc/6/650.md?p=27);
    - (B) provide operational and technical cybersecurity training to [SLTT entities](/usc/6/650.md?p=27) to address [cybersecurity risks](/usc/6/650.md?p=7) or [incidents](/usc/6/650.md?p=12), with or without reimbursement, related to—
      - (i) [cyber threat indicators](/usc/6/650.md?p=5);
      - (ii) [defensive measures](/usc/6/650.md?p=9-A);
      - (iii) [cybersecurity risks](/usc/6/650.md?p=7);
      - (iv) vulnerabilities; and
      - (v) [incident](/usc/6/650.md?p=12) response and management;
    - (C) in order to increase situational awareness and help prevent [incidents](/usc/6/650.md?p=12), assist [SLTT entities](/usc/6/650.md?p=27) in [sharing](/usc/6/650.md?p=26), in real time, with the Federal Government as well as among [SLTT entities](/usc/6/650.md?p=27), actionable—
      - (i) [cyber threat indicators](/usc/6/650.md?p=5);
      - (ii) [defensive measures](/usc/6/650.md?p=9-A);
      - (iii) information about [cybersecurity risks](/usc/6/650.md?p=7); and
      - (iv) information about [incidents](/usc/6/650.md?p=12);
    - (D) provide [SLTT entities](/usc/6/650.md?p=27) notifications containing specific [incident](/usc/6/650.md?p=12) and malware information that may affect them or their residents;
    - (E) provide to, and periodically update, [SLTT entities](/usc/6/650.md?p=27) via an easily accessible platform and other means—
      - (i) information about tools;
      - (ii) information about products;
      - (iii) resources;
      - (iv) policies;
      - (v) guidelines;
      - (vi) controls; and
      - (vii) other cybersecurity standards and best practices and procedures related to information security, including, as appropriate, information produced by other [Federal agencies](/usc/6/677a.md?p=4);
    - (F) work with senior [SLTT entity](/usc/6/650.md?p=27) officials, including chief information officers and senior election officials and through national associations, to coordinate the effective implementation by [SLTT entities](/usc/6/650.md?p=27) of tools, products, resources, policies, guidelines, controls, and procedures related to information security to secure the [information systems](/usc/6/650.md?p=14), including election systems, of [SLTT entities](/usc/6/650.md?p=27);
    - (G) provide operational and technical assistance to [SLTT entities](/usc/6/650.md?p=27) to implement tools, products, resources, policies, guidelines, controls, and procedures on information security;
    - (H) assist [SLTT entities](/usc/6/650.md?p=27) in developing policies and procedures for coordinating vulnerability disclosures consistent with international and national standards in the information technology industry; and
    - (I) promote cybersecurity education and awareness through engagements with [Federal agencies](/usc/6/677a.md?p=4) and non-[Federal entities](/usc/6/681.md?p=7).
- (s) **Report—** Not later than 1 year after June 21, 2022, and every 2 years thereafter, the [Secretary](/usc/6/641.md?p=3) shall submit to the Committee on [Homeland](/usc/6/101.md?p=1) Security and Governmental Affairs of the Senate and the Committee on [Homeland](/usc/6/101.md?p=1) Security of the House of Representatives a report on the services and capabilities that the [Agency](/usc/6/650.md?p=1) directly and indirectly provides to [SLTT entities](/usc/6/650.md?p=27).

## Footnotes

[^1]: So in original. There is no par. (2).

## Source credit

(Pub. L. 107–296, title XXII, § 2209, formerly title II, § 227, formerly § 226, as added Pub. L. 113–282, § 3(a), Dec. 18, 2014, 128 Stat. 3066; renumbered § 227 and amended Pub. L. 114–113, div. N, title II, §§ 203, 223(a)(3), Dec. 18, 2015, 129 Stat. 2957, 2963; Pub. L. 114–328, div. A, title XVIII, § 1841(b), Dec. 23, 2016, 130 Stat. 2663; renumbered title XXII, § 2209, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(iii), Nov. 16, 2018, 132 Stat. 4178, 4180; Pub. L. 116–94, div. L, § 102(a), Dec. 20, 2019, 133 Stat. 3089; Pub. L. 116–283, div. A, title XVII, § 1716(a), Jan. 1, 2021, 134 Stat. 4094; Pub. L. 117–81, div. A, title XV, §§ 1541(a), 1542, 1548(c), Dec. 27, 2021, 135 Stat. 2054, 2056, 2063; Pub. L. 117–103, div. Y, § 103(a)(1), Mar. 15, 2022, 136 Stat. 1038; Pub. L. 117–150, § 2(2), June 21, 2022, 136 Stat. 1295; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(D), Dec. 23, 2022, 136 Stat. 3659.)

## Notes

### Editorial Notes

### References in Text

Title I of the Cybersecurity Act of 2015, referred to in subsecs. (c)(1) and (h)(1), is title I of Pub. L. 114–113, div. N, Dec. 18, 2015, 129 Stat. 2936, also known as the Cybersecurity Information Sharing Act of 2015, which is classified generally to subchapter I of chapter 6 of this title. For complete classification of title I to the Code, see Short Title note set out under section 1501 of this title and Tables.

This chapter, referred to in subsec. (p)(8), was in the original “this Act”, meaning Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2135, known as the Homeland Security Act of 2002, which is classified principally to this chapter. For complete classification of this Act to the Code, see Short Title note set out below and Tables.

### Codification

Section was formerly classified to section 148 of this title prior to renumbering by Pub. L. 115–278.

### Amendments

2022—Subsec. (a). Pub. L. 117–263, § 7143(b)(2)(D)(i), added subsec. (a) and struck out former subsec. (a) which defined cybersecurity purpose, cybersecurity risk, cyber threat indicator, defensive measure, cybersecurity vulnerability, incident, information sharing and analysis organization, information system, security vulnerability, and sharing.

Subsec. (b). Pub. L. 117–263, § 7143(b)(2)(D)(ii), inserted “Executive” before “Assistant Director for Cybersecurity”.

Subsec. (c)(6). Pub. L. 117–150, § 2(2)(A), inserted “operational and” before “timely”.

Subsec. (c)(13). Pub. L. 117–103 added par. (13).

Subsec. (d)(1)(A)(iii). Pub. L. 117–263, § 7143(b)(2)(D)(iii)(I), struck out “, as that term is defined under section 3003(4) of title 50” after “intelligence community”.

Subsec. (d)(1)(B)(ii). Pub. L. 117–263, § 7143(b)(2)(D)(iii)(II), substituted “Information Sharing and Analysis Organizations” for “information sharing and analysis organizations”.

Subsec. (d)(1)(E). Pub. L. 117–150, § 2(2)(B), inserted “, including an entity that collaborates with election officials,” after “governments”.

Subsec. (e)(1)(E)(ii)(II). Pub. L. 117–263, § 7143(b)(2)(D)(iv), substituted “Information Sharing and Analysis Organizations” for “information sharing and analysis organizations”.

Subsec. (p). Pub. L. 117–263, § 7143(b)(2)(D)(v), redesignated subsec. (p) relating to coordination on cybersecurity for SLTT entities as (r).

Pub. L. 117–150, § 2(2)(C), added subsec. (p) relating to coordination on cybersecurity for SLTT entities.

Subsec. (q). Pub. L. 117–263, § 7143(b)(2)(D)(vi), redesignated subsec. (q) relating to report as (s).

Pub. L. 117–150, § 2(2)(C), added subsec. (q) relating to report.

Subsec. (r). Pub. L. 117–263, § 7143(b)(2)(D)(v), redesignated subsec. (p) relating to coordination on cybersecurity for SLTT entities as (r).

Subsec. (s). Pub. L. 117–263, § 7143(b)(2)(D)(vi), redesignated subsec. (q) relating to report as (s).

2021—Subsec. (a). Pub. L. 117–81, § 1542(1), added par. (4) and redesignated former pars. (4) to (8) (as previously added or redesignated by Pub. L. 116–283) as (5) to (9), respectively.

Pub. L. 116–283, § 1716(a)(1), added pars. (1) and (7) and redesignated former pars. (1) to (5) as (2) to (6), respectively, and former par. (6) as (8).

Subsec. (c)(5)(B), (C). Pub. L. 117–81, § 1542(2)(A), added subpar. (B), redesignated former subpar. (B) as (C), and inserted in subpar. (C) as redesignated “and mitigation protocols to counter cybersecurity vulnerabilities in accordance with subparagraph (B), as appropriate,” before “with Federal”.

Subsec. (c)(6). Pub. L. 117–81, § 1548(c), inserted “, which may take the form of continuous monitoring and detection of cybersecurity risks to critical infrastructure entities that own or operate industrial control systems that support national critical functions” after “mitigation, and remediation”.

Subsec. (c)(7)(C). Pub. L. 117–81, § 1542(2)(B), substituted “share” for “sharing”.

Subsec. (c)(9). Pub. L. 117–81, § 1542(2)(C), inserted “mitigation protocols to counter cybersecurity vulnerabilities, as appropriate,” after “measures,”.

Subsec. (c)(12). Pub. L. 116–283, § 1716(a)(2), added par. (12).

Subsec. (e)(1)(I). Pub. L. 117–81, § 1541(a)(1), added subpar. (I).

Subsec. (o). Pub. L. 117–81, § 1542(4), added subsec. (o). Former subsec. (o) redesignated (p) relating to subpoena authority.

Pub. L. 116–283, § 1716(a)(3), added subsec. (o).

Subsec. (p). Pub. L. 117–81, § 1542(3), redesignated subsec. (o) as (p) relating to subpoena authority.

Subsec. (q). Pub. L. 117–81, § 1541(a)(2), added subsec. (q) relating to industrial control systems.

2019—Subsec. (d)(1)(B)(iv). Pub. L. 116–94, § 102(a)(1), inserted “, including cybersecurity specialists” after “entities”.

Subsec. (f). Pub. L. 116–94, § 102(a)(3), added subsec. (f). Former subsec. (f) redesignated (g).

Subsec. (g). Pub. L. 116–94, § 102(a)(2), redesignated subsec. (f) as (g). Former subsec. (g) redesignated (h).

Subsec. (g)(1), (2). Pub. L. 116–94, § 102(a)(4), inserted “, or any team or activity of the Center,” after “Center”.

Subsecs. (h) to (n). Pub. L. 116–94, § 102(a)(2), redesignated subsecs. (g) to (m) as (h) to (n), respectively.

2018—Pub. L. 115–278, § 2(g)(9)(A)(iii)(I), substituted “Director” for “Under Secretary appointed under section 113(a)(1)(H) of this title” wherever appearing.

Subsec. (a)(4). Pub. L. 115–278, § 2(g)(9)(A)(iii)(II), substituted “section 671(5) of this title” for “section 131(5) of this title”.

Subsec. (b). Pub. L. 115–278, § 2(g)(9)(A)(iii)(III), inserted at end “The Center shall be located in the Cybersecurity and Infrastructure Security Agency. The head of the Center shall report to the Assistant Director for Cybersecurity.”

Subsec. (c)(11). Pub. L. 115–278, § 2(g)(9)(A)(iii)(IV), substituted “Emergency Communications Division” for “Office of Emergency Communications”.

2016—Subsecs. (l), (m). Pub. L. 114–328 added subsec. (l) and redesignated former subsec. (l) as (m).

2015—Subsec. (a)(1) to (5). Pub. L. 114–113, § 203(1)(A), (B), added pars. (1) to (3), redesignated former pars. (3) and (4) as (4) and (5), respectively, and struck out former pars. (1) and (2), which defined “cybersecurity risk” and “incident”, respectively.

Subsec. (a)(6). Pub. L. 114–113, § 203(1)(C)–(E), added par. (6).

Subsec. (c)(1). Pub. L. 114–113, § 203(2)(A), inserted “cyber threat indicators, defensive measures,” before “cybersecurity risks” and “, including the implementation of title I of the Cybersecurity Act of 2015” before semicolon at end.

Subsec. (c)(3). Pub. L. 114–113, § 203(2)(B), substituted “cyber threat indicators, defensive measures, cybersecurity risks,” for “cybersecurity risks”.

Subsec. (c)(5)(A). Pub. L. 114–113, § 203(2)(C), substituted “cyber threat indicators, defensive measures, cybersecurity risks,” for “cybersecurity risks”.

Subsec. (c)(6). Pub. L. 114–113, § 203(2)(D), substituted “cyber threat indicators, defensive measures, cybersecurity risks,” for “cybersecurity risks” and struck out “and” at end.

Subsec. (c)(7)(C). Pub. L. 114–113, § 203(2)(E), added subpar. (C).

Subsec. (c)(8) to (11). Pub. L. 114–113, § 203(2)(F), added pars. (8) to (11).

Subsec. (d)(1)(B)(i). Pub. L. 114–113, § 203(3)(A)(i), substituted “, local, and tribal” for “and local”.

Subsec. (d)(1)(B)(ii). Pub. L. 114–113, § 203(3)(A)(ii), substituted “, including information sharing and analysis centers;” for “; and”.

Subsec. (d)(1)(B)(iv). Pub. L. 114–113, § 203(3)(A)(iii), (iv), added cl. (iv).

Subsec. (d)(1)(E), (F). Pub. L. 114–113, § 203(3)(B)–(D), added subpar. (E) and redesignated former subpar. (E) as (F).

Subsec. (e)(1)(A). Pub. L. 114–113, § 203(4)(A)(i), inserted “cyber threat indicators, defensive measures, and” before “information”.

Subsec. (e)(1)(B). Pub. L. 114–113, § 203(4)(A)(ii), inserted “cyber threat indicators, defensive measures, and” before “information related”.

Subsec. (e)(1)(F). Pub. L. 114–113, § 203(4)(A)(iii), substituted “cyber threat indicators, defensive measures, cybersecurity risks,” for “cybersecurity risks” and struck out “and” at end.

Subsec. (e)(1)(G). Pub. L. 114–113, § 203(4)(A)(iv), substituted “cyber threat indicators, defensive measures, cybersecurity risks, and incidents; and” for “cybersecurity risks and incidents”.

Subsec. (e)(1)(H). Pub. L. 114–113, § 203(4)(A)(v), added subpar. (H).

Subsec. (e)(2). Pub. L. 114–113, § 203(4)(B), substituted “cyber threat indicators, defensive measures, cybersecurity risks,” for “cybersecurity risks” and inserted “or disclosure” after “access”.

Subsec. (e)(3). Pub. L. 114–113, § 203(4)(C), inserted “, including by working with the Privacy Officer appointed under section 142 of this title to ensure that the Center follows the policies and procedures specified in subsections (b) and (d)(5)(C) of section 105 of the Cybersecurity Act of 2015” before period at end.

Subsecs. (g) to (l). Pub. L. 114–113, § 203(5), added subsecs. (g) to (l).

### Statutory Notes and Related Subsidiaries

### Rules of Construction

Nothing in amendment made by Pub. L. 117–263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, see section 7143(f)(1) of Pub. L. 117–263, set out as a note under section 650 of this title.

Pub. L. 116–283, div. A, title XVII, § 1716(b), Jan. 1, 2021, 134 Stat. 4098, provided that: Prohibition on new regulatory authority.—Nothing in this section or the amendments made by this section [amending this section] may be construed to grant the Secretary of Homeland Security, or the head of any another Federal agency or department, any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of the enactment of this Act [Jan. 1, 2021]. Private entities.—Nothing in this section or the amendments made by this section [amending this section] may be construed to require any private entity to— request assistance from the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security; or implement any measure or recommendation suggested by the Director.”

Pub. L. 113–282, § 8, Dec. 18, 2014, 128 Stat. 3072, provided that: Prohibition on New Regulatory Authority.—Nothing in this Act [see section 1 of Pub. L. 113–282, set out as a Short Title of 2014 Amendment note under section 101 of this title] or the amendments made by this Act shall be construed to grant the Secretary [of Homeland Security] any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of enactment of this Act [Dec. 18, 2014]. Private Entities.—Nothing in this Act or the amendments made by this Act shall be construed to require any private entity— to request assistance from the Secretary; or that requested such assistance from the Secretary to implement any measure or recommendation suggested by the Secretary.”

### Definitions

Pub. L. 113–282, § 2, Dec. 18, 2014, 128 Stat. 3066, provided that: “In this Act [see section 1 of Pub. L. 113–282, set out as a Short Title of 2014 Amendment note under section 101 of this title]— the term ‘Center’ means the national cybersecurity and communications integration center under section 226 [renumbered 227 by section 223(a)(3) of Pub. L. 114–113 and renumbered 2209 by section 2(g)(2)(I) of Pub. L. 115–278] of the Homeland Security Act of 2002 [6 U.S.C. 659], as added by section 3; the term ‘critical infrastructure’ has the meaning given that term in section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101); the term ‘cybersecurity risk’ has the meaning given that term in section 226 [2209] of the Homeland Security Act of 2002, as added by section 3; the term ‘information sharing and analysis organization’ has the meaning given that term in section 212(5) [renumbered 2222(5) by section 2(g)(2)(H) of Pub. L. 115–278] of the Homeland Security Act of 2002 ([former] 6 U.S.C. 131(5)) [now 6 U.S.C. 671(5); see 6 U.S.C. 650(13)]; the term ‘information system’ has the meaning given that term in section 3502(8) of title 44, United States Code; and the term ‘Secretary’ means the Secretary of Homeland Security.”