Cyber incident reporting

Subtitle D of title XXII of the Homeland Security Act of 2002 (6 U.S.C. 681 et seq.) is amended— (1) in section 2240 (6 U.S.C. 681), by striking paragraph (4) and inserting the following: (4) Covered entity The term covered entity — (A) means an entity in a critical infrastructure sector, as defined in Presidential Policy Directive 21, that satisfies the definition established by the Director in the final rule issued pursuant to section 2242(b); and (B) includes— (i) a community water system (as defined in section 1401 of the Safe Drinking Water Act (42 U.S.C. 300f)) that serves a population of greater than 3,300 persons; and (ii) a covered treatment works (as defined in section 228(a) of the Federal Water Pollution Control Act).; (2) in section 2242(a) (6 U.S.C. 681b(a)), by adding at the end the following: (8) Transmission to EPA The Agency shall submit to the Administrator of the Environmental Protection Agency a copy of each report submitted to the Agency under paragraph (1), (2), or (3).; and (3) in section 2244(f) (6 U.S.C. 681d(f))— (A) by striking This section and inserting the following: (1) In general Except as provided in paragraph (2), this section; and (B) by adding at the end the following: (2) Exception This section shall apply to a State, local, Tribal, or territorial government entity that is required to submit a report under section 2242(a) with respect to a community water system or covered treatment works, as defined in clauses (i) and (ii), respectively, of section 2240(4)(B), that is owned or operated by the State, local, Tribal or territorial government entity..