§650 Definitions

Summary

Defines important cybersecurity and infrastructure words used in this part of the law. It gives short meanings for terms you will see later. "Agency" means the Cybersecurity and Infrastructure Security Agency. "Appropriate congressional committees" means the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Homeland Security. "Cloud service provider" means a company offering cloud services as defined in NIST Special Publication 800–145. "Critical infrastructure information" means non-public information about attacks, vulnerabilities, or repairs that affect important systems. "Cyber threat indicator" means information needed to describe or identify harmful scanning, methods to defeat security, vulnerabilities, ways to trick users, malicious command-and-control, harm from incidents, or other threat attributes allowed by law. "Cybersecurity purpose" means protecting systems or the information they hold or carry from threats. "Cybersecurity risk" means threats, vulnerabilities, and their consequences, including terrorism, but not simple violations of consumer terms of service. "Cybersecurity threat" means an action (not protected by the First Amendment) that could harm a system’s security, availability, confidentiality, or integrity, and it excludes only violations of consumer terms of service. "Defensive measure" means a tool or action that detects, stops, or reduces a known or suspected threat, but not measures that destroy, disable, expose, or seriously harm systems or data not owned by the entity operating the measure or by another entity that has given consent (see private entity defined in section 1501). "Director" means the Director of CISA. "Homeland Security Enterprise" means government and non-government groups involved in homeland security, like officials, private companies, and academics. "Incident" means an event that actually or soon could violate the integrity, confidentiality, or availability of information or a system without lawful authority. "Information Sharing and Analysis Organization" means a group set up by public or private organizations to gather, analyze, and share critical infrastructure information to understand risks, help prevent or recover from problems, and voluntarily share that information with members and government. "Information system" means the term in section 3502 of title 44 and also includes industrial control systems such as SCADA, DCS, and PLCs. "Intelligence community" has the meaning in section 3003(4) of title 50. "Malicious cyber command and control" means a way to identify, access, or use a system or data remotely without authorization. "Malicious reconnaissance" means actively probing or passively watching a system to find vulnerabilities when tied to a known or suspected threat. "Managed service provider" means an entity that provides ongoing support and management of networks, apps, infrastructure, or security on a customer’s site, the provider’s data center, or a third-party data center. "Monitor" means to collect, identify, scan, or hold information that is stored on, processed by, or passing through an information system. "National cybersecurity asset response activities" include giving technical help to affected entities, finding other at-risk entities, assessing sector or regional risks and plans, coordinating information sharing and response, and advising on using federal resources to speed recovery. "National security system" has the meaning in section 11103 of title 40. "Ransomware attack" means an incident using unauthorized or malicious code or other digital means (like denial-of-service) to disrupt systems or compromise data to demand payment, but it does not include fake ransom demands or good-faith payment requests made at the owner’s request. "Sector Risk Management Agency" means a federal department or agency, designated by law or Presidential directive, that leads or supports programs for a critical infrastructure sector and coordinates with the Department. "Security control" means the management, operational, and technical safeguards used to protect a system’s confidentiality, integrity, and availability. "Security vulnerability" means any hardware, software, process, or procedure flaw that could let a security control be bypassed. "Sharing" means giving, receiving, and distributing information. "SLTT entity" means a State, local, Tribal, or territorial government or a part of one. "Supply chain compromise" means an incident in the supply chain that an adversary can use to threaten a system or the information it handles at any point in its life cycle.