Comptroller General assessment on sharing of cyber intelligence with State, local, Tribal, territorial, and private sector partners

(a) Assessment The Comptroller General of the United States shall conduct an assessment of sharing of cyber-related intelligence by the Department of Defense with State, local, Tribal, territorial, and private sector partners. (b) Report (1) Submission Not later than 60 days after the date on which the Comptroller General completes the assessment under subsection (a), the Comptroller General shall submit to the Committee on Armed Services of the House of Representatives and the Committee on Armed Services of the Senate a report on the results of the assessment. (2) Elements The report under paragraph (1) shall include the following: (A) With respect to each element of the Department of Defense, a summary of the capabilities and practices of the element for sharing cyber-related intelligence with State, local, Tribal, territorial, and private sector partners. (B) An assessment of the effects of such sharing, including the timeliness, level of detail, and the degree to which intelligence is provided in a format that allows for technical correlation and network defense actions versus general situational awareness. (C) An assessment of the deconfliction and coordination processes between elements regarding such sharing. (D) A description of the role and effectiveness of the Department of Defense in such deconfliction and coordination process. (E) An assessment of how the security clearances of such partners affect such sharing. (F) An assessment of the legal, policy, and infrastructure barriers that prevent cleared private sector partners from operationalizing classified threat intelligence, including— (i) the lack of accredited, state-run facilities where partners can securely correlate classified government-provided indicators against their own proprietary network data; and (ii) the lack of statutory liability protections (such as State-level tort claims extensions) for private sector entities acting on classified intelligence provided by the government. (G) Recommendations for improvements for such sharing.