9 1 system for the purpose of discerning security 2 vulnerabilities of the information system, if such 3 method is associated with a known or suspected cy- 4 bersecurity threat. 5 (14) MONITOR.—The term ‘‘monitor’’ means to 6 acquire, identify, or scan, or to possess, information 7 that is stored on, processed by, or transiting an in- 8 formation system. 9 (15) PRIVATE 10 (A) IN ENTITY.— GENERAL.—Except as otherwise 11 provided in this paragraph, the term ‘‘private 12 entity’’ means any person or private group, or- 13 ganization, proprietorship, partnership, trust, 14 cooperative, corporation, or other commercial or 15 nonprofit entity, including an officer, employee, 16 or agent thereof. 17 (B) INCLUSION.—The term ‘‘private enti- 18 ty’’ includes a State, tribal, or local government 19 performing electric or other utility services. 20 (C) EXCLUSION.—The term ‘‘private enti- 21 ty’’ does not include a foreign power as defined 22 in section 101 of the Foreign Intelligence Sur- 23 veillance Act of 1978 (50 U.S.C. 1801). 24 (16) SECURITY 25 CONTROL.—The term ‘‘security control’’ means the management, operational, and † S 754 ES