Cyber incident reporting requirements for operationally critical contractors

Section 391 of title 10, United States Code, is amended— (1) in subsection (c), by amending paragraph (2) to read as follows: (2) Rapid reporting The procedures established pursuant to subsection (a) shall require each operationally critical contractor to report to the component of the Department designated pursuant to subsection (d)(2)(A)— (A) on a rapid basis, each cyber incident with respect to any network or information system of such contractor, including for each such incident— (i) an assessment by the contractor of the effect of the incident on the ability of the contractor to meet the contractual requirements of the Department; (ii) the technique or method used in such incident; (iii) a sample of any malicious software, if discovered and isolated by the contractor, involved in such incident; and (iv) a summary of the information compromised by such incident; and (B) promptly, but not later than 72 hours after discovery, each discovery within any network or information system of such contractor of any hardware, software, firmware, embedded technology, or update thereto that is manufactured by, is developed under the direction of, or includes source code or design contributions from, a covered Chinese entity, including for each such hardware, software, firmware, technology, or update— (i) a description of the hardware, software, firmware, technology, or update discovered and the network or system on which it resides; (ii) the function and integration level of such hardware, software, firmware, technology, or update; (iii) the date, method, and circumstances of discovery; and (iv) any immediate mitigation or isolation measures undertaken.; and (2) in subsection (e), by adding at the end the following new paragraph: (3) Covered Chinese entity defined The term covered Chinese entity means an entity— (A) organized under the laws of, or primarily subject to the jurisdiction of, the People’s Republic of China; (B) owned by, controlled by, or subject to the direction of the Government of the People’s Republic of China or the Chinese Communist Party; or (C) identified on the list of Chinese military companies operating in the United States under section 1260H of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (Public Law 116–283; 10 U.S.C. 113 note), or any successor provision..