§677c Cyber Response and Recovery Fund

Summary

Creates a Cyber Response and Recovery Fund to pay for helping with major cyber incidents. The Fund can pay for coordinating response activities under section 677b(b); direct help to federal, State, local, Tribal, and public or private groups when a declaration is made, on a reimbursable or non‑reimbursable basis, such as vulnerability checks, fixing incidents, malware study, analysis, threat hunting, and network protection; grants or cooperative agreements the Director decides are appropriate for replacing or improving hardware or software and for technical contract staff; and advance actions under section 677b(f)(1)(B). Money for the Fund comes from congressional appropriations and reimbursements from federal agencies when Congress has provided money for that reimbursement. Funds can only be spent from deposits in the Fund and are extra to other CISA money. Fund money must add to, not replace, other government funding for declared incidents. The Secretary must require recipients to report how they used the funds.