Cybersecurity incident response plan

Section 405 of the Cybersecurity Act of 2015 (6 U.S.C. 1533) is amended— (1) in subsection (a)— (A) in paragraph (4)— (i) in the paragraph heading, by inserting information system; after Federal entity;; and (ii) by inserting information system, after Federal entity,; (B) by redesignating paragraphs (4) through (7) as paragraphs (6) through (9), respectively; and (C) by inserting after paragraph (3) the following: (4) Cybersecurity incident The term cybersecurity incident has the meaning given the term incident in section 3552 of title 44, United States Code. (5) Cybersecurity risk The term cybersecurity risk has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).; and (2) in subsection (d), by adding at the end the following: (4) Plan (A) In general Not later than 1 year after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2025, the Secretary shall develop and implement a cybersecurity incident response plan to inform applicable personnel within the Department of Health and Human Services of processes and protocols to prepare for, and respond to, cybersecurity incidents involving information, including hardware, software, databases, and networks, used or maintained by, or on behalf of, the Department, including strategies— (i) to assess cybersecurity risks; (ii) to prevent cybersecurity incidents; (iii) to detect and identify cybersecurity incidents; (iv) to minimize damage in the event of a cybersecurity incident; (v) to protect data; and (vi) to recover from any cybersecurity incidents expeditiously. (B) Consultation In developing the plan under subparagraph (A), the Secretary shall consult with the Director of the Cybersecurity and Infrastructure Security Agency, the Director of the Office of Management and Budget, and the Director of the National Institute of Standards and Technology, and relevant experts, as appropriate. (C) Report Not later than 60 days before the date on which the Secretary begins implementing the plan under subparagraph (A), the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Energy and Commerce, the Committee on Oversight and Reform, and the Committee on Homeland Security of the House of Representatives a report that describes such plan..

Section 405 of the Cybersecurity Act of 2015 (6 U.S.C. 1533) is amended— (1) in subsection (a)— (A) in paragraph (4)— (i) in the paragraph heading, by inserting information system; after federal entity;; and (ii) by inserting information system, after Federal entity,; (B) by redesignating paragraphs (4) through (7) as paragraphs (6) through (9), respectively; and (C) by inserting after paragraph (3) the following: (4) Cybersecurity incident The term cybersecurity incident has the meaning given the term incident in section 3552 of title 44, United States Code. (5) Cybersecurity risk The term cybersecurity risk has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).; and (2) in subsection (d), by adding at the end the following: (4) Plan (A) In general Not later than 1 year after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2026, the Secretary shall expand and implement the Cyber Annex of the All Hazards Plan of the Department of Health and Human Services to inform applicable personnel within the Department of Health and Human Services of processes and protocols to prepare for, and respond to, cybersecurity incidents. (B) Scope The plan under subparagraph (A) shall address cybersecurity incidents involving information systems, including hardware, software, databases, and networks, used or maintained by, or on behalf of, the Department. (C) Elements The plan under subparagraph (A) shall include strategies— (i) to assess cybersecurity risks; (ii) to prevent cybersecurity incidents; (iii) to detect and identify cybersecurity incidents; (iv) to minimize damage in the event of a cybersecurity incident; (v) to protect data; (vi) to recover from any cybersecurity incidents expeditiously; and (vii) to communicate and share non-sensitive information about cybersecurity incidents with entities in the Healthcare and Public Health Sector (as defined in section 2 of the Health Care Cybersecurity and Resiliency Act of 2026). (D) Consultation In developing the plan under subparagraph (A), the Secretary shall consult with the Director of the Cybersecurity and Infrastructure Security Agency, the Director of the Office of Management and Budget, the Director of the National Institute of Standards and Technology, and relevant experts, as appropriate. (E) Updates The Secretary shall review and update the plan under subparagraph (A)— (i) not less frequently than once every 2 years; and (ii) after any significant cybersecurity incident affecting the Department of Health and Human Services or a Federal health program. (F) Report Not later than 60 days before the date on which the Secretary begins implementing the plan under subparagraph (A), the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Energy and Commerce, the Committee on Oversight and Reform, and the Committee on Homeland Security of the House of Representatives a report that describes such plan..