Cybersecurity incident registry

(a) In general The Director shall— (1) establish, through partnerships with 1 or more Information Sharing and Analysis Organizations, a voluntary registry of information relating to cyber incidents affecting information technology systems owned or managed by a covered entity; and (2) determine the scope of cyber incidents to be included in the registry and processes by which incidents can be reported for collection in the registry. (b) Use Information in the registry established pursuant to subsection (a) may be used to— (1) improve data collection and coordination activities related to the nationwide monitoring of the incidence and impact of cyber incidents affecting a covered entity; (2) conduct analyses regarding trends in cyber incidents affecting a covered entity; (3) develop systematic approaches to assist a covered entity in preventing and responding to cyber incidents; (4) increase the awareness and preparedness of a covered entity regarding the cybersecurity of the covered entity; and (5) identify, prevent, or investigate cyber incidents targeting a covered entity. (c) Information collection (1) In general The Director may collect information relating to cyber incidents to store in the registry established pursuant to subsection (a). (2) Submission of information Information relating to a cyber incident may be submitted by a covered entity and may include the following: (A) The date of the cyber incident, including the date on which the incident was initially detected and the date on which the incident was first publicly reported or disclosed to another entity. (B) A description of the cyber incident, which shall include whether the incident was as a result of a breach, malware, distributed denial of service attack, or other method designed to cause a vulnerability. (C) The effects of the cyber incident, including descriptions of the type and size of each such incident. (D) Other information determined relevant by the Director. (d) Report The Director shall make available on the Information Exchange an annual report relating to cyber incidents affecting elementary schools and secondary schools which includes data, and the analysis of such data, in a manner that— (1) is— (A) de-identified; and (B) presented in the aggregate; and (2) at a minimum, protects personal privacy to the extent required by applicable Federal and State privacy laws.