Cyber Response and Recovery Act of 2021

II Calendar No. 648 117TH CONGRESS 2D SESSION S. 1316 [Report No. 117–257] To amend the Homeland Security Act of 2002 to authorize the Secretary of Homeland Security to make a declaration of a significant incident, and for other purposes. IN THE SENATE OF THE UNITED STATES APRIL 22, 2021 Mr. PETERS (for himself and Mr. PORTMAN) introduced the following bill; which was read twice and referred to the Committee on Homeland Secu- rity and Governmental Affairs DECEMBER 14, 2022 Reported by Mr. PETERS, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To amend the Homeland Security Act of 2002 to authorize the Secretary of Homeland Security to make a declara- tion of a significant incident, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 2 •S 1316 RS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Cyber Response and 2 Recovery Act of 2021’’. 3 SEC. 2. DECLARATION OF A SIGNIFICANT INCIDENT. 4 (a) IN GENERAL.—Title XXII of the Homeland Se- 5 curity Act of 2002 (6 U.S.C. 651 et seq.) is amended by 6 adding at the end the following: 7 ‘‘Subtitle C—Declaration of a 8 Significant Incident 9 ‘‘SEC. 2231. DEFINITIONS. 10 ‘‘For the purposes of this subtitle: 11 ‘‘(1) ASSET RESPONSE ACTIVITY.—The term 12 ‘asset response activity’ means an activity to support 13 an entity impacted by an incident with the response 14 to, remediation of, or recovery from, the incident, in- 15 cluding— 16 ‘‘(A) furnishing technical and advisory as- 17 sistance to the entity to protect the assets of 18 the entity, mitigate vulnerabilities, and reduce 19 the related impacts; 20 ‘‘(B) assessing potential risks to the crit- 21 ical infrastructure sector or geographic region 22 impacted by the incident, including potential 23 cascading effects of the incident on other crit- 24 ical infrastructure sectors or geographic re- 25 gions; 26 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 3 •S 1316 RS ‘‘(C) developing courses of action to miti- 1 gate the risks assessed under subparagraph 2 (B); 3 ‘‘(D) facilitating information sharing and 4 operational coordination with entities per- 5 forming threat response activities; and 6 ‘‘(E) providing guidance on how best to 7 use Federal resources and capabilities in a 8 timely, effective manner to speed recovery from 9 the incident. 10 ‘‘(2) DECLARATION.—The term ‘declaration’ 11 means a declaration of the Secretary under section 12 2232(a)(1). 13 ‘‘(3) DIRECTOR.—The term ‘Director’ means 14 the Director of the Cybersecurity and Infrastructure 15 Security Agency. 16 ‘‘(4) FEDERAL AGENCY.—The term ‘Federal 17 agency’ has the meaning given the term ‘agency’ in 18 section 3502 of title 44, United States Code. 19 ‘‘(5) FUND.—The term ‘Fund’ means the 20 Cyber Response and Recovery Fund established 21 under section 2233(a). 22 ‘‘(6) INCIDENT.—The term ‘incident’ has the 23 meaning given the term in section 3552 of title 44, 24 United States Code. 25 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 4 •S 1316 RS ‘‘(7) RENEWAL.—The term ‘renewal’ means a 1 renewal of a declaration under section 2232(d). 2 ‘‘(8) SIGNIFICANT INCIDENT.—The term ‘sig- 3 nificant incident’— 4 ‘‘(A) means an incident or a group of re- 5 lated incidents that results, or is likely to re- 6 sult, in demonstrable harm to— 7 ‘‘(i) the national security interests, 8 foreign relations, or economy of the United 9 States; or 10 ‘‘(ii) the public confidence, civil lib- 11 erties, or public health and safety of the 12 people of the United States; and 13 ‘‘(B) does not include an incident or a por- 14 tion of a group of related incidents that occurs 15 on— 16 ‘‘(i) a national security system (as de- 17 fined in section 3552 of title 44, United 18 States Code); or 19 ‘‘(ii) an information system described 20 in paragraph (2) or (3) of section 3553(e) 21 of title 44, United States Code. 22 ‘‘SEC. 2232. DECLARATION. 23 ‘‘(a) IN GENERAL.— 24 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 5 •S 1316 RS ‘‘(1) DECLARATION.—The Secretary, in con- 1 sultation with the National Cyber Director, may 2 make a declaration of a significant incident in ac- 3 cordance with this section if the Secretary deter- 4 mines that— 5 ‘‘(A) a specific significant incident— 6 ‘‘(i) has occurred; or 7 ‘‘(ii) is likely to occur imminently; and 8 ‘‘(B) otherwise available resources, other 9 than the Fund, are likely insufficient to respond 10 effectively to, or to mitigate effectively, the spe- 11 cific significant incident described in subpara- 12 graph (A). 13 ‘‘(2) PROHIBITION ON DELEGATION.—The Sec- 14 retary may not delegate the authority provided to 15 the Secretary under paragraph (1). 16 ‘‘(b) ASSET RESPONSE ACTIVITIES.—Upon a dec- 17 laration, the Director shall coordinate— 18 ‘‘(1) the asset response activities of each Fed- 19 eral agency in response to the specific significant in- 20 cident associated with the declaration; and 21 ‘‘(2) with appropriate entities, which may in- 22 clude— 23 ‘‘(A) public and private entities and State 24 and local governments with respect to the asset 25 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 6 •S 1316 RS response activities of those entities and govern- 1 ments; and 2 ‘‘(B) Federal, State, local, and Tribal law 3 enforcement agencies with respect to investiga- 4 tions and threat response activities of those law 5 enforcement agencies. 6 ‘‘(c) DURATION.—Subject to subsection (d), a dec- 7 laration shall terminate upon the earlier of— 8 ‘‘(1) a determination by the Secretary that the 9 declaration is no longer necessary; or 10 ‘‘(2) the expiration of the 120-day period begin- 11 ning on the date on which the Secretary makes the 12 declaration. 13 ‘‘(d) RENEWAL.—The Secretary, without delegation, 14 may renew a declaration as necessary. 15 ‘‘(e) PUBLICATION.—Not later than 72 hours after 16 a declaration or a renewal, the Secretary shall publish the 17 declaration or renewal in the Federal Register. 18 ‘‘(f) ADVANCE ACTIONS.—The Secretary— 19 ‘‘(1) shall assess the resources available to re- 20 spond to a potential declaration; and 21 ‘‘(2) may take actions before and while a dec- 22 laration is in effect to arrange or procure additional 23 resources for asset response activities or technical 24 assistance the Secretary determines necessary, which 25 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 7 •S 1316 RS may include entering into standby contracts with 1 private entities for cybersecurity services or incident 2 responders in the event of a declaration. 3 ‘‘SEC. 2233. CYBER RESPONSE AND RECOVERY FUND. 4 ‘‘(a) IN GENERAL.—There is established a Cyber Re- 5 sponse and Recovery Fund, which shall be available for— 6 ‘‘(1) the coordination of activities described in 7 section 2232(b); 8 ‘‘(2) response and recovery support for the spe- 9 cific significant incident associated with a declara- 10 tion to Federal, State, local, and Tribal, entities and 11 public and private entities on a reimbursable or non- 12 reimbursable basis, including through asset response 13 activities and technical assistance, such as— 14 ‘‘(A) vulnerability assessments and mitiga- 15 tion; 16 ‘‘(B) technical incident mitigation; 17 ‘‘(C) malware analysis; 18 ‘‘(D) analytic support; 19 ‘‘(E) threat detection and hunting; and 20 ‘‘(F) network protections; 21 ‘‘(3) as the Director determines appropriate, 22 grants for, or cooperative agreements with, Federal, 23 State, local, and Tribal public and private entities to 24 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 8 •S 1316 RS respond to, and recover from, the specific significant 1 incident associated with a declaration, such as— 2 ‘‘(A) hardware or software to replace, up- 3 date, improve, harden, or enhance the 4 functionality of existing hardware, software, or 5 systems; and 6 ‘‘(B) technical contract personnel support; 7 and 8 ‘‘(4) advance actions taken by the Secretary 9 under section 2232(f)(2). 10 ‘‘(b) DEPOSITS.—Money shall be deposited into the 11 Fund from— 12 ‘‘(1) appropriations to the Fund for activities of 13 the Fund; 14 ‘‘(2) reimbursement from Federal agencies for 15 the activities described in paragraphs (1), (2), and 16 (4) of subsection (a); and 17 ‘‘(3) any other income incident to activities of 18 the Fund. 19 ‘‘(c) SUPPLEMENT NOT SUPPLANT.—Amounts in the 20 Fund shall be used to supplement, not supplant, other 21 Federal, State, local, or Tribal funding for activities in 22 response to a declaration. 23 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 9 •S 1316 RS ‘‘SEC. 2234. NOTIFICATION AND REPORTING. 1 ‘‘(a) NOTIFICATION.—Upon a declaration or renewal, 2 the Secretary shall immediately notify the National Cyber 3 Director and appropriate congressional committees and in- 4 clude in the notification— 5 ‘‘(1) an estimation of the planned duration of 6 the declaration; 7 ‘‘(2) with respect to a notification of a declara- 8 tion, the reason for the declaration, including infor- 9 mation relating to the specific significant incident or 10 imminent specific significant incident, including— 11 ‘‘(A) the operational or mission impact or 12 anticipated impact of the specific significant in- 13 cident on Federal and non-Federal entities; 14 ‘‘(B) if known, the perpetrator of the spe- 15 cific significant incident; and 16 ‘‘(C) the scope of the Federal and non- 17 Federal entities impacted or anticipated to be 18 impacted by the specific significant incident; 19 ‘‘(3) with respect to a notification of a renewal, 20 the reason for the renewal; 21 ‘‘(4) justification as to why available resources, 22 other than the Fund, are insufficient to respond to 23 or mitigate the specific significant incident; and 24 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 10 •S 1316 RS ‘‘(5) a description of the coordination activities 1 described in section 2232(b) that the Secretary an- 2 ticipates the Director to perform. 3 ‘‘(b) REPORT TO CONGRESS.—Not later than 180 4 days after the date of a declaration or renewal, the Sec- 5 retary shall submit to the appropriate congressional com- 6 mittees a report that includes— 7 ‘‘(1) the reason for the declaration or renewal, 8 including information and intelligence relating to the 9 specific significant incident that led to the declara- 10 tion or renewal; 11 ‘‘(2) the use of any funds from the Fund for 12 the purpose of responding to the incidents or threat 13 described in paragraph (1); 14 ‘‘(3) a description of the actions, initiatives, and 15 projects undertaken by the Department and State 16 and local governments and public and private enti- 17 ties in responding to and recovering from the spe- 18 cific significant incident described in paragraph (1); 19 ‘‘(4) an accounting of the specific obligations 20 and outlays of the Fund; and 21 ‘‘(5) an analysis of— 22 ‘‘(A) the impact of the specific significant 23 incident described in paragraph (1) on Federal 24 and non-Federal entities; 25 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 11 •S 1316 RS ‘‘(B) the impact of the declaration or re- 1 newal on the response to, and recovery from, 2 the specific significant incident described in 3 paragraph (1); and 4 ‘‘(C) the impact of the funds made avail- 5 able from the Fund as a result of the declara- 6 tion or renewal on the recovery from, and re- 7 sponse to, the specific significant incident de- 8 scribed in paragraph (1). 9 ‘‘(c) CLASSIFICATION.—Each notification made 10 under subsection (a) and each report submitted under sub- 11 section (b)— 12 ‘‘(1) shall be in an unclassified form; and 13 ‘‘(2) may include a classified annex. 14 ‘‘(d) CONSOLIDATED REPORT.—The Secretary shall 15 not be required to submit multiple reports under sub- 16 section (b) for multiple declarations or renewals if the Sec- 17 retary determines that the declarations or renewals sub- 18 stantively relate to the same specific significant incident. 19 ‘‘(e) EXEMPTION.—The requirements of subchapter 20 I of chapter 35 of title 44 (commonly known as the ‘Pa- 21 perwork Reduction Act’) shall not apply to the voluntary 22 collection of information by the Department during an in- 23 vestigation of, a response to, or an immediate post-re- 24 VerDate Sep 11 2014 01:36 Dec 15, 2022 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6401 E:\BILLS\S1316.RS S1316 SSpencer on DSK126QN23PROD with BILLS 12 •S 1316 RS sponse review of, the specific significant incident leading 1 to a declaration or renewal. 2 ‘‘SEC. 2235. RULE OF CONSTRUCTION. 3 ‘‘Nothing in this subtitle shall be construed to impair 4 or limit the ability of the Director to carry out the author- 5 ized activities of the Cybersecurity and Infrastructure Se- 6 curity Agency. 7 ‘‘SEC. 2236. AUTHORIZATION OF APPROPRIATIONS. 8 ‘‘There are authorized to be appropriated to the Fund 9 $20,000,000 for fiscal year 2022, which shall remain 10 available to be expended until September 30, 2028. 11 ‘‘SEC. 2237. SUNSET. 12 ‘‘The authorities granted to the Secretary or the Di- 13 rector under this subtitle shall expire on the date that is 14 7 years after the date of enactment of the Cyber Response 15 and Recovery Act of 2021.’’. 16 (b) CLERICAL AMENDMENT.—The table of contents 17 in section 1(b) of the Homeland Security Act of 2002 18 (Public Law 107–296; 116 Stat. 2135) is amended by 19 adding at the end the following: 20 ‘‘Subtitle C—Declaration of a Significant Incident ‘‘Sec. 2231. Definitions. ‘‘Sec. 2232. Declaration. ‘‘Sec. 2233. Cyber response and recovery fund. ‘‘Sec. 2234. Notification and reporting. ‘‘Sec. 2235. Rule of construction. ‘‘Sec. 2236. Authorization of appropriations. ‘‘Sec. 2237. Sunset.’’. VerDat [Text truncated for display. Full text available on Congress.gov.]