---
kind: "section"
citation: "6 U.S.C. § 681d"
title: "6"
title_heading: "Domestic Security"
number: "681d"
heading: "Noncompliance with required reporting"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/681d"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part D — Cyber Incident Reporting"
---

# §681d. Noncompliance with required reporting

- (a) **Purpose—** In the event that a [covered entity](/usc/6/681.md?p=4) that is required to submit a report under [section 681b(a) of this title](/usc/6/681b.md?p=a) fails to comply with the requirement to report, the [Director](/usc/6/650.md?p=10) may obtain information about the [cyber incident](/usc/6/681.md?p=5) or [ransom payment](/usc/6/681.md?p=8) by engaging the [covered entity](/usc/6/681.md?p=4) directly to request information about the [cyber incident](/usc/6/681.md?p=5) or [ransom payment](/usc/6/681.md?p=8), and if the [Director](/usc/6/650.md?p=10) is unable to obtain information through such engagement, by issuing a subpoena to the [covered entity](/usc/6/681.md?p=4), pursuant to [subsection (c)](#c), to gather information sufficient to determine whether a [covered cyber incident](/usc/6/681.md?p=3) or [ransom payment](/usc/6/681.md?p=8) has occurred.
- (b) **Initial request for information—**
  - (1) **In general—** If the [Director](/usc/6/650.md?p=10) has reason to believe, whether through public reporting or other information in the possession of the Federal Government, including through analysis performed pursuant to paragraph (1) or (2) of [section 681a(a) of this title](/usc/6/681a.md?p=a), that a [covered entity](/usc/6/681.md?p=4) has experienced a [covered cyber incident](/usc/6/681.md?p=3) or made a [ransom payment](/usc/6/681.md?p=8) but failed to report such [cyber incident](/usc/6/681.md?p=5) or payment to the [Agency](/usc/6/650.md?p=1) in accordance with [section 681b(a) of this title](/usc/6/681b.md?p=a), the [Director](/usc/6/650.md?p=10) may request additional information from the [covered entity](/usc/6/681.md?p=4) to confirm whether or not a [covered cyber incident](/usc/6/681.md?p=3) or [ransom payment](/usc/6/681.md?p=8) has occurred.
  - (2) **Treatment—** Information provided to the [Agency](/usc/6/650.md?p=1) in response to a request under [paragraph (1)](#b-1) shall be treated as if it was submitted through the reporting procedures established in [section 681b of this title](/usc/6/681b.md)[^1] including that [section 681e of this title](/usc/6/681e.md) shall apply to such information in the same manner and to the same extent to information submitted in response to requests under [paragraph (1)](#b-1) as it applies to information submitted under [section 681b of this title](/usc/6/681b.md).
- (c) **Enforcement—**
  - (1) **In general—** If, after the date that is 72 hours from the date on which the [Director](/usc/6/650.md?p=10) made the request for information in [subsection (b)](#b), the [Director](/usc/6/650.md?p=10) has received no response from the [covered entity](/usc/6/681.md?p=4) from which such information was requested, or received an inadequate response, the [Director](/usc/6/650.md?p=10) may issue to such [covered entity](/usc/6/681.md?p=4) a subpoena to compel disclosure of information the [Director](/usc/6/650.md?p=10) deems necessary to determine whether a [covered cyber incident](/usc/6/681.md?p=3) or [ransom payment](/usc/6/681.md?p=8) has occurred and obtain the information required to be reported pursuant to [section 681b of this title](/usc/6/681b.md) and any implementing regulations, and assess potential impacts to national security, economic security, or public health and safety.
  - (2) **Civil action—**
    - (A) **In general—** If a [covered entity](/usc/6/681.md?p=4) fails to comply with a subpoena, the [Director](/usc/6/650.md?p=10) may refer the matter to the Attorney General to bring a civil action in a district court of the [United States](/usc/6/101.md?p=19-A) to enforce such subpoena.
    - (B) **Venue—** An action under this paragraph may be brought in the judicial district in which the [covered entity](/usc/6/681.md?p=4) against which the action is brought resides, is found, or does business.
    - (C) **Contempt of court—** A court may punish a failure to comply with a subpoena issued under this subsection as contempt of court.
  - (3) **Non-delegation—** The authority of the [Director](/usc/6/650.md?p=10) to issue a subpoena under this subsection may not be delegated.
  - (4) **Authentication—**
    - (A) **In general—** Any subpoena issued electronically pursuant to this subsection shall be authenticated with a cryptographic digital signature of an authorized representative of the [Agency](/usc/6/650.md?p=1), or other comparable successor technology, that allows the [Agency](/usc/6/650.md?p=1) to demonstrate that such subpoena was issued by the [Agency](/usc/6/650.md?p=1) and has not been altered or modified since such issuance.
    - (B) **Invalid if not authenticated—** Any subpoena issued electronically pursuant to this subsection that is not authenticated in accordance with [subparagraph (A)](#c-4-A) shall not be considered to be valid by the recipient of such subpoena.
- (d) **Provision of certain information to Attorney General—**
  - (1) **In general—** Notwithstanding [section 681e(a)(5) of this title](/usc/6/681e.md?p=a-5) and paragraph (b)(2) of this section, if the [Director](/usc/6/650.md?p=10) determines, based on the information provided in response to a subpoena issued pursuant to [subsection (c)](#c), that the facts relating to the [cyber incident](/usc/6/681.md?p=5) or [ransom payment](/usc/6/681.md?p=8) at issue may constitute grounds for a regulatory enforcement action or criminal prosecution, the [Director](/usc/6/650.md?p=10) may provide such information to the Attorney General or the head of the appropriate Federal regulatory [agency](/usc/6/650.md?p=1), who may use such information for a regulatory enforcement action or criminal prosecution.
  - (2) **Consultation—** The [Director](/usc/6/650.md?p=10) may consult with the Attorney General or the head of the appropriate Federal regulatory [agency](/usc/6/650.md?p=1) when making the determination under [paragraph (1)](#d-1).
- (e) **Considerations—** When determining whether to exercise the authorities provided under this section, the [Director](/usc/6/650.md?p=10) shall take into consideration—
  - (1) the complexity in determining if a [covered cyber incident](/usc/6/681.md?p=3) has occurred; and
  - (2) prior interaction with the [Agency](/usc/6/650.md?p=1) or awareness of the [covered entity](/usc/6/681.md?p=4) of the policies and procedures of the [Agency](/usc/6/650.md?p=1) for reporting [covered cyber incidents](/usc/6/681.md?p=3) and [ransom payments](/usc/6/681.md?p=8).
- (f) **Exclusions—** This section shall not apply to a [State](/usc/6/101.md?p=17), local, Tribal, or territorial government [entity](/usc/6/301c.md?p=2).
- (g) **Report to Congress—** The [Director](/usc/6/650.md?p=10) shall submit to Congress an annual report on the number of times the [Director](/usc/6/650.md?p=10)—
  - (1) issued an initial request for information pursuant to [subsection (b)](#b);
  - (2) issued a subpoena pursuant to [subsection (c)](#c); or
  - (3) referred a matter to the Attorney General for a civil action pursuant to [subsection (c)(2)](#c-2).
- (h) **Publication of the annual report—** The [Director](/usc/6/650.md?p=10) shall publish a version of the annual report required under [subsection (g)](#g) on the website of the [Agency](/usc/6/650.md?p=1), which shall include, at a minimum, the number of times the [Director](/usc/6/650.md?p=10)—
  - (1) issued an initial request for information pursuant to [subsection (b)](#b); or
  - (2) issued a subpoena pursuant to [subsection (c)](#c).
- (i) **Anonymization of reports—** The [Director](/usc/6/650.md?p=10) shall ensure any victim information contained in a report required to be published under [subsection (h)](#h) be anonymized before the report is published.

## Footnotes

[^1]: So in original. Probably should be followed by a comma.

## Source credit

(Pub. L. 107–296, title XXII, § 2244, as added Pub. L. 117–103, div. Y, § 103(a)(2), Mar. 15, 2022, 136 Stat. 1049; amended Pub. L. 117–263, div. G, title LXXI, § 7143(e)(2), Dec. 23, 2022, 136 Stat. 3664.)

## Notes

### Editorial Notes

### Amendments

2022—Subsec. (b)(2). Pub. L. 117–263 inserted “including that section 681e of this title shall apply to such information in the same manner and to the same extent to information submitted in response to requests under paragraph (1) as it applies to information submitted under section 681b of this title” after “section 681b of this title”.