---
kind: "section"
citation: "6 U.S.C. § 681a"
title: "6"
title_heading: "Domestic Security"
number: "681a"
heading: "Cyber incident review"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/681a"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part D — Cyber Incident Reporting"
---

# §681a. Cyber incident review

- (a) **Activities—** The [Center](/usc/6/681.md?p=1) shall—
  - (1) receive, aggregate, analyze, and secure, using processes consistent with the processes developed pursuant to the Cybersecurity Information Sharing Act of 2015 ([6 U.S.C. 1501](/usc/6/1501.md) et seq.) reports from [covered entities](/usc/6/681.md?p=4) related to a [covered cyber incident](/usc/6/681.md?p=3) to assess the effectiveness of [security controls](/usc/6/650.md?p=24), identify tactics, techniques, and procedures adversaries use to overcome those controls and other [cybersecurity purposes](/usc/6/650.md?p=6), including to assess potential impact of [cyber incidents](/usc/6/681.md?p=5) on public health and safety and to enhance situational awareness of [cyber threats](/usc/6/681.md?p=6) across [critical infrastructure sectors](/usc/6/601.md?p=3);
  - (2) coordinate and share information with appropriate Federal [departments](/usc/6/641.md?p=1) and [agencies](/usc/6/650.md?p=1) to identify and track [ransom payments](/usc/6/681.md?p=8), including those utilizing [virtual currencies](/usc/6/681.md?p=10);
  - (3) leverage information gathered about [cyber incidents](/usc/6/681.md?p=5) to—
    - (A) enhance the quality and effectiveness of information [sharing](/usc/6/650.md?p=26) and coordination efforts with appropriate [entities](/usc/6/301c.md?p=2), including [agencies](/usc/6/650.md?p=1), sector coordinating [councils](/usc/6/681.md?p=2), [Information Sharing and Analysis Organizations](/usc/6/650.md?p=13), [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments, technology providers, [critical infrastructure](/usc/6/101.md?p=4) owners and operators, cybersecurity and [cyber incident](/usc/6/681.md?p=5) response firms, and security researchers; and
    - (B) provide appropriate [entities](/usc/6/301c.md?p=2), including sector coordinating [councils](/usc/6/681.md?p=2), [Information Sharing and Analysis Organizations](/usc/6/650.md?p=13), [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments, technology providers, cybersecurity and [cyber incident](/usc/6/681.md?p=5) response firms, and security researchers, with timely, actionable, and anonymized reports of [cyber incident](/usc/6/681.md?p=5) campaigns and trends, including, to the maximum extent practicable, related contextual information, [cyber threat indicators](/usc/6/650.md?p=5), and [defensive measures](/usc/6/650.md?p=9-A), pursuant to [section 681e of this title](/usc/6/681e.md);
  - (4) establish mechanisms to receive feedback from stakeholders on how the [Agency](/usc/6/650.md?p=1) can most effectively receive [covered cyber incident](/usc/6/681.md?p=3) reports, [ransom payment](/usc/6/681.md?p=8) reports, and other voluntarily provided information, and how the [Agency](/usc/6/650.md?p=1) can most effectively support private sector cybersecurity;
  - (5) facilitate the timely [sharing](/usc/6/650.md?p=26), on a [voluntary](/usc/6/671.md?p=6-A) basis, between relevant [critical infrastructure](/usc/6/101.md?p=4) owners and operators of information relating to [covered cyber incidents](/usc/6/681.md?p=3) and [ransom payments](/usc/6/681.md?p=8), particularly with respect to ongoing [cyber threats](/usc/6/681.md?p=6) or [security vulnerabilities](/usc/6/650.md?p=25) and identify and disseminate ways to prevent or mitigate similar [cyber incidents](/usc/6/681.md?p=5) in the future;
  - (6) for a [covered cyber incident](/usc/6/681.md?p=3), including a [ransomware attack](/usc/6/650.md?p=22), that also satisfies the definition of a [significant cyber incident](/usc/6/681.md?p=9), or is part of a group of related [cyber incidents](/usc/6/681.md?p=5) that together satisfy such definition, conduct a review of the details surrounding the [covered cyber incident](/usc/6/681.md?p=3) or group of those [incidents](/usc/6/650.md?p=12) and identify and disseminate ways to prevent or mitigate similar [incidents](/usc/6/650.md?p=12) in the future;
  - (7) with respect to [covered cyber incident](/usc/6/681.md?p=3) reports under section[^1] 681b(a) and [681c](/usc/6/681c.md) of this title involving an ongoing [cyber threat](/usc/6/681.md?p=6) or [security vulnerability](/usc/6/650.md?p=25), immediately review those reports for [cyber threat indicators](/usc/6/650.md?p=5) that can be anonymized and disseminated, with [defensive measures](/usc/6/650.md?p=9-A), to appropriate stakeholders, in coordination with other divisions within the [Agency](/usc/6/650.md?p=1), as appropriate;
  - (8) publish quarterly unclassified, public reports that describe aggregated, anonymized observations, findings, and recommendations based on [covered cyber incident](/usc/6/681.md?p=3) reports, which may be based on the unclassified information contained in the briefings required under [subsection (c)](#c);
  - (9) proactively identify opportunities, consistent with the protections in [section 681e of this title](/usc/6/681e.md), to leverage and utilize data on [cyber incidents](/usc/6/681.md?p=5) in a manner that enables and strengthens cybersecurity research carried out by academic institutions and other private sector organizations, to the greatest extent practicable; and
  - (10) in accordance with [section 681e of this title](/usc/6/681e.md) and [subsection (b)](#b) of this section, as soon as possible but not later than 24 hours after receiving a [covered cyber incident](/usc/6/681.md?p=3) report, [ransom payment](/usc/6/681.md?p=8) report, voluntarily submitted information pursuant to [section 681c of this title](/usc/6/681c.md), or information received pursuant to a request for information or subpoena under [section 681d of this title](/usc/6/681d.md), make available the information to appropriate [Sector Risk Management Agencies](/usc/6/650.md?p=23) and other appropriate [Federal agencies](/usc/6/677a.md?p=4).
- (b) **Interagency sharing—** The President or a designee of the President—
  - (1) may establish a specific time requirement for [sharing](/usc/6/650.md?p=26) information under [subsection (a)(10)](#a-10); and
  - (2) shall determine the appropriate [Federal agencies](/usc/6/677a.md?p=4) under [subsection (a)(10)](#a-10).
- (c) **Periodic briefing—** Not later than 60 days after the effective date of the final rule required under [section 681b(b) of this title](/usc/6/681b.md?p=b), and on the first day of each month thereafter, the [Director](/usc/6/650.md?p=10), in consultation with the National Cyber [Director](/usc/6/650.md?p=10), the Attorney General, and the [Director](/usc/6/650.md?p=10) of National Intelligence, shall provide to the majority leader of the Senate, the minority leader of the Senate, the Speaker of the House of Representatives, the minority leader of the House of Representatives, the Committee on [Homeland](/usc/6/101.md?p=1) Security and Governmental Affairs of the Senate, and the Committee on [Homeland](/usc/6/101.md?p=1) Security of the House of Representatives a briefing that characterizes the national [cyber threat](/usc/6/681.md?p=6) landscape, including the threat facing [Federal agencies](/usc/6/677a.md?p=4) and [covered entities](/usc/6/681.md?p=4), and applicable intelligence and law enforcement information, [covered cyber incidents](/usc/6/681.md?p=3), and [ransomware attacks](/usc/6/650.md?p=22), as of the date of the briefing, which shall—
  - (1) include the total number of reports submitted under sections [681b](/usc/6/681b.md) and [681c](/usc/6/681c.md) of this title during the preceding month, including a breakdown of required and [voluntary](/usc/6/671.md?p=6-A) reports;
  - (2) include any identified trends in [covered cyber incidents](/usc/6/681.md?p=3) and [ransomware attacks](/usc/6/650.md?p=22) over the course of the preceding month and as compared to previous reports, including any trends related to the information collected in the reports submitted under sections [681b](/usc/6/681b.md) and [681c](/usc/6/681c.md) of this title, including—
    - (A) the infrastructure, tactics, and techniques malicious cyber actors commonly use; and
    - (B) intelligence gaps that have impeded, or currently are impeding, the ability to counter [covered cyber incidents](/usc/6/681.md?p=3) and ransomware threats;
  - (3) include a summary of the known uses of the information in reports submitted under sections [681b](/usc/6/681b.md) and [681c](/usc/6/681c.md) of this title; and
  - (4) include an unclassified portion, but may include a classified component.

## Footnotes

[^1]: So in original. Probably should be “sections”.

## Source credit

(Pub. L. 107–296, title XXII, § 2241, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1040.)

## Notes

### Editorial Notes

### References in Text

The Cybersecurity Information Sharing Act of 2015, referred to in subsec. (a)(1), is title I of div. N of Pub. L. 114–113, Dec. 18, 2015, 129 Stat. 2936, which is classified generally to subchapter I (§ 1501 et seq.) of chapter 6 of this title. For complete classification of this Act to the Code, see Short Title note set out under section 1501 of this title and Tables.