H. R. 2029—720
‘‘(j) REPORTS ON INTERNATIONAL COOPERATION.—Not later than
180 days after the date of enactment of this subsection, and periodically thereafter, the Secretary of Homeland Security shall submit
to the Committee on Homeland Security and Governmental Affairs
of the Senate and the Committee on Homeland Security of the
House of Representatives a report on the range of efforts underway
to bolster cybersecurity collaboration with relevant international
partners in accordance with subsection (c)(8).
‘‘(k) OUTREACH.—Not later than 60 days after the date of enactment of this subsection, the Secretary, acting through the Under
Secretary appointed under section 103(a)(1)(H), shall—
‘‘(1) disseminate to the public information about how to
voluntarily share cyber threat indicators and defensive measures with the Center; and
‘‘(2) enhance outreach to critical infrastructure owners and
operators for purposes of such sharing.
‘‘(l) COORDINATED VULNERABILITY DISCLOSURE.—The Secretary,
in coordination with industry and other stakeholders, may develop
and adhere to Department policies and procedures for coordinating
vulnerability disclosures.’’.
SEC. 204. INFORMATION SHARING AND ANALYSIS ORGANIZATIONS.
Section 212 of the Homeland Security Act of 2002 (6 U.S.C.
131) is amended—
(1) in paragraph (5)—
(A) in subparagraph (A)—
(i) by inserting ‘‘, including information related
to cybersecurity risks and incidents,’’ after ‘‘critical
infrastructure information’’; and
(ii) by inserting ‘‘, including cybersecurity risks
and incidents,’’ after ‘‘related to critical infrastructure’’;
(B) in subparagraph (B)—
(i) by inserting ‘‘, including cybersecurity risks and
incidents,’’ after ‘‘critical infrastructure information’’;
and
(ii) by inserting ‘‘, including cybersecurity risks
and incidents,’’ after ‘‘related to critical infrastructure’’;
and
(C) in subparagraph (C), by inserting ‘‘, including cybersecurity risks and incidents,’’ after ‘‘critical infrastructure
information’’; and
(2) by adding at the end the following:
‘‘(8) CYBERSECURITY RISK; INCIDENT.—The terms ‘cybersecurity risk’ and ‘incident’ have the meanings given those terms
in section 227.’’.
SEC. 205. NATIONAL RESPONSE FRAMEWORK.
Section 228 of the Homeland Security Act of 2002, as added
by section 223(a)(4) of this division, is amended by adding at the
end the following:
‘‘(d) NATIONAL RESPONSE FRAMEWORK.—The Secretary, in
coordination with the heads of other appropriate Federal departments and agencies, and in accordance with the National Cybersecurity Incident Response Plan required under subsection (c), shall
regularly update, maintain, and exercise the Cyber Incident Annex
to the National Response Framework of the Department.’’.