§681c. Voluntary reporting of other cyber incidents — Inbound Citations

Citations to 6 U.S.C. § 681c as a whole

• 6 U.S.C. § 681a(a)(7)

  Go to provision →
  (7) with respect to covered cyber incident reports under section¹ 681b(a) and 681c of this title involving an ongoing cyber threat or security vulnerability, immediately review those reports for cyber threat indicators that can be anonymized and disseminated, with defensive measures, to appropriate stakeholders, in coordination with other divisions within the Agency, as appropriate;
• 6 U.S.C. § 681a(a)(10)

  Go to provision →
  (10) in accordance with section 681e of this title and subsection (b) of this section, as soon as possible but not later than 24 hours after receiving a covered cyber incident report, ransom payment report, voluntarily submitted information pursuant to section 681c of this title, or information received pursuant to a request for information or subpoena under section 681d of this title, make available the information to appropriate Sector Risk Management Agencies and other appropriate Federal agencies.
• 6 U.S.C. § 681a(c)(1)

  Go to provision →
  (1) include the total number of reports submitted under sections 681b and 681c of this title during the preceding month, including a breakdown of required and voluntary reports;
• 6 U.S.C. § 681a(c)(2)

  Go to provision →
  (2) include any identified trends in covered cyber incidents and ransomware attacks over the course of the preceding month and as compared to previous reports, including any trends related to the information collected in the reports submitted under sections 681b and 681c of this title, including—

  (A) the infrastructure, tactics, and techniques malicious cyber actors commonly use; and

  (B) intelligence gaps that have impeded, or currently are impeding, the ability to counter covered cyber incidents and ransomware threats;
• 6 U.S.C. § 681a(c)(3)

  Go to provision →
  (3) include a summary of the known uses of the information in reports submitted under sections 681b and 681c of this title; and
• 6 U.S.C. § 681e(a)(1)

  Go to provision →
  (1) Information provided to the Agency pursuant to section 681b or 681c of this title may be disclosed to, retained by, and used by, consistent with otherwise applicable provisions of Federal law, any Federal agency or department, component, officer, employee, or agent of the Federal Government solely for—

  (A) a cybersecurity purpose;

  (B) the purpose of identifying—

  (i) a cyber threat, including the source of the cyber threat; or

  (ii) a security vulnerability;

  (C) the purpose of responding to, or otherwise preventing or mitigating, a specific threat of death, a specific threat of serious bodily harm, or a specific threat of serious economic harm, including a terrorist act or use of a weapon of mass destruction;

  (D) the purpose of responding to, investigating, prosecuting, or otherwise preventing or mitigating, a serious threat to a minor, including sexual exploitation and threats to physical safety; or

  (E) the purpose of preventing, investigating, disrupting, or prosecuting an offense arising out of a cyber incident reported pursuant to section 681b or 681c of this title or any of the offenses listed in section 1504(d)(5)(A)(v) of this title.
• 6 U.S.C. § 681e(a)(1)(E)

  Go to provision →
  (E) the purpose of preventing, investigating, disrupting, or prosecuting an offense arising out of a cyber incident reported pursuant to section 681b or 681c of this title or any of the offenses listed in section 1504(d)(5)(A)(v) of this title.
• 6 U.S.C. § 681e(a)(5)(B)

  Go to provision →
  (B) A report submitted to the Agency pursuant to section 681b or 681c of this title may, consistent with Federal or State regulatory authority specifically relating to the prevention and mitigation of cybersecurity threats to information systems, inform the development or implementation of regulations relating to such systems.
• 6 U.S.C. § 681e(b)

  Go to provision →
  (b) Reports describing covered cyber incidents or ransom payments submitted to the Agency by entities in accordance with section 681b of this title, as well as voluntarily-submitted cyber incident reports submitted to the Agency pursuant to section 681c of this title, shall—

  (1) be considered the commercial, financial, and proprietary information of the covered entity when so designated by the covered entity;

  (2) be exempt from disclosure under section 552(b)(3) of title 5 (commonly known as the “Freedom of Information Act”), as well as any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records;

  (3) be considered not to constitute a waiver of any applicable privilege or protection provided by law, including trade secret protection; and

  (4) not be subject to a rule of any Federal agency or department or any judicial doctrine regarding ex parte communications with a decision-making official.