§2662 Reporting on Penetrations of Networks of Contractors and Subcontractors

Summary

The Administrator must make rules that force contractors and subcontractors to tell the Chief Information Officer when a covered network they run is successfully hacked. The Administrator will decide what counts as a covered network after talking with key agency officials, including the Deputy Administrator for Defense Programs, the Associate Administrator for Acquisition and Project Management, the Chief Information Officer, and any others needed. Contractors and subcontractors must send a report no later than 60 days after they discover a successful penetration. The report must say how the break-in was done, include a sample of any malware if they found one, and summarize any agency-created information that might have been affected. If they cannot gather everything in 60 days, they must send what they have and give the rest as it becomes available. The Administrator must also make rules to let agency staff get access to government or contractor equipment and information for forensic checks when agency-owned data was used or at risk. Those rules must let the agency ask for access, limit access to figuring out whether agency information was taken and what was taken, and protect trade secrets, business or financial records, and personal-identifying information. The rules can limit who sees the incident information to people or groups whose work is affected, those who help with cyber response, counterintelligence or law enforcement, or for national security and cyber defense. Definitions: Chief Information Officer = the Associate Administrator for Information Management and Chief Information Officer; contractor = a private entity with a contract to provide goods or services to the agency; covered network = any network that stores or handles classified or sensitive unclassified agency information; subcontractor = a private entity hired under a contractor to help with an agency program.