3.0.0 2875 2023-08-23T22:00:34Z 2023-08-23T22:00:34Z Senate S 2021-09-28 117 ssga00 Homeland Security and Governmental Affairs Committee Senate Standing Reported by 2022-12-13T16:58:37Z Markup by 2021-10-06T14:15:55Z Referred to 2021-09-28T19:26:25Z S. Rept. 117-249 2022-12-13 Senate Placed on Senate Legislative Calendar under General Orders. Calendar No. 633. Calendars 2022-12-13 ssga00 Homeland Security and Governmental Affairs Committee Senate Committee on Homeland Security and Governmental Affairs. Reported by Senator Peters with an amendment in the nature of a substitute. With written report No. 117-249. Committee 2022-12-13 Committee on Homeland Security and Governmental Affairs. Reported by Senator Peters with an amendment in the nature of a substitute. With written report No. 117-249. Committee 14000 9 Library of Congress ssga00 Homeland Security and Governmental Affairs Committee 2021-10-06 ssga00 Homeland Security and Governmental Affairs Committee Senate Committee on Homeland Security and Governmental Affairs. Ordered to be reported with an amendment in the nature of a substitute favorably. Committee 2021-09-28 ssga00 Homeland Security and Governmental Affairs Committee Senate Read twice and referred to the Committee on Homeland Security and Governmental Affairs. IntroReferral 2021-09-28 Introduced in Senate IntroReferral 10000 9 Library of Congress P000595 Sen. Peters, Gary C. [D-MI] Gary Peters D MI N P000449 Sen. Portman, Rob [R-OH] Rob Portman R OH 2021-09-28 True S001191 Sen. Sinema, Kyrsten [D-AZ] Kyrsten Sinema D AZ 2021-10-20 False T000476 Sen. Tillis, Thomas [R-NC] Thomas Tillis R NC Roland 2021-10-20 False 2021-11-30T21:15:00Z S. 2875, Cyber Incident Reporting Act of 2021 https://www.cbo.gov/publication/57647 As ordered reported by the Senate Committee on Homeland Security and Governmental Affairs on October 6, 2021 Science, Technology, Communications Advanced technology and technological innovations Business records Civil actions and liability Computer security and identity theft Computers and information technology Congressional oversight Currency Digital media Fraud offenses and financial crimes Government information and archives Government studies and investigations Intergovernmental relations Right of privacy State and local government operations Terrorism Science, Technology, Communications 00 2021-09-28 Introduced in Senate 2022-06-24T14:20:54Z Cyber Incident Reporting Act of 2021

This bill requires reporting and other actions to address cybersecurity incidents, including ransomware attacks.

Entities that own or operate critical infrastructure must report cyber incidents and ransom payments within specified time frames while other entities may voluntarily report incidents. The Cybersecurity and Infrastructure Security Agency (CISA) must establish an office to receive and analyze such reports.

The bill limits the use and disclosure of reported information. The information may be shared (subject to protections) with federal agencies or to address cybersecurity threats. However, shared information may not be used as a basis for certain regulatory enforcement. Additionally, an entity may not be liable for submitting required reports. Further, reports do not constitute waivers of applicable protections against disclosure (e.g., attorney-client privilege) and are not subject to laws governing release of federal records.

The bill authorizes CISA to take specified action (e.g., issuing subpoenas) if an entity fails to submit a required report. CISA may share subpoenaed information with a regulator or the Department of Justice for regulatory enforcement or criminal prosecution.

A federal agency must share any information it receives about cyber attacks with CISA.

The bill also establishes (1) an interagency council to standardize federal reporting of cybersecurity threats, (2) a task force on ransomware attacks, and (3) a pilot program to identify information systems vulnerable to ransomware attacks.

]]> 25 2022-12-13 Reported to Senate 2023-08-23T21:53:26Z Cyber Incident Reporting Act of 2021

This bill requires reporting and other actions to address cybersecurity incidents, including ransomware attacks.

Entities that own or operate critical infrastructure must report cyber incidents and ransom payments within specified time frames while other entities may voluntarily report incidents. The Cybersecurity and Infrastructure Security Agency (CISA) must establish an office to receive and analyze such reports.

The bill limits the use and disclosure of reported information. The information may be shared (subject to protections) with federal agencies or to address cybersecurity threats. However, shared information may not be used as a basis for certain regulatory enforcement. Additionally, an entity may not be liable for submitting required reports. Further, reports do not constitute waivers of applicable protections against disclosure (e.g., attorney-client privilege) and are not subject to laws governing release of federal records.

The bill authorizes CISA to take specified action (e.g., issuing subpoenas) if an entity fails to submit a required report. CISA may share subpoenaed information with a regulator or the Department of Justice for regulatory enforcement or criminal prosecution.

A federal agency must share any information it receives about cyber attacks with CISA.

The bill also establishes (1) an interagency council to standardize federal reporting of cybersecurity threats, (2) a task force on ransomware attacks, and (3) a pilot program to identify information systems vulnerable to ransomware attacks.

]]> Cyber Incident Reporting Act of 2021 Official Title as Introduced A bill to amend the Homeland Security Act of 2002 to establish the Cyber Incident Review Office in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, and for other purposes. Introduced in Senate IS Display Title Cyber Incident Reporting Act of 2021 Short Title(s) as Reported to Senate Cyber Incident Reporting Act of 2021 S Senate Reported to Senate RS Short Title(s) as Introduced Cyber Incident Reporting Act of 2021 Introduced in Senate IS Reported to Senate 2022-12-13T05:00:00Z https://www.govinfo.gov/content/pkg/BILLS-117s2875rs/xml/BILLS-117s2875rs.xml Introduced in Senate 2021-09-28T04:00:00Z https://www.govinfo.gov/content/pkg/BILLS-117s2875is/xml/BILLS-117s2875is.xml 2022-12-13 Placed on Senate Legislative Calendar under General Orders. Calendar No. 633. text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain. Congressional Research Service, Library of Congress This file contains bill summaries and statuses for federal legislation. A bill summary describes the most significant provisions of a piece of legislation and details the effects the legislative text may have on current law and federal programs. Bill summaries are authored by the Congressional Research Service (CRS) of the Library of Congress. As stated in Public Law 91-510 (2 USC 166 (d)(6)), one of the duties of CRS is "to prepare summaries and digests of bills and resolutions of a public general nature introduced in the Senate or House of Representatives". For more information, refer to the User Guide that accompanies this file.