6 U.S.C. § 1501
Section 1501 · Definitions
Current version, with additions and removals from the December 18, 2015 version.
In this subchapter:
In this subchapter:
(1) Agency
(1) Agency
The term "agency" has the meaning given the term in section 3502 of title 44.
The term "agency" has the meaning given the term in section 3502 of title 44.
(2) Antitrust laws
(2) Antitrust laws
The term "antitrust laws"—
The term "antitrust laws"—
(A) has the meaning given the term in section 12 of title 15;
(A) has the meaning given the term in section 12 of title 15;
(B) includes section 45 of title 15 to the extent that section 45 of title 15 applies to unfair methods of competition; and
(B) includes section 45 of title 15 to the extent that section 45 of title 15 applies to unfair methods of competition; and
(C) includes any State antitrust law, but only to the extent that such law is consistent with the law referred to in subparagraph (A) or the law referred to in subparagraph (B).
(C) includes any State antitrust law, but only to the extent that such law is consistent with the law referred to in subparagraph (A) or the law referred to in subparagraph (B).
(3) Appropriate Federal entities
(3) Appropriate Federal entities
The term "appropriate Federal entities" means the following:
The term "appropriate Federal entities" means the following:
(A) The Department of Commerce.
(A) The Department of Commerce.
(B) The Department of Defense.
(B) The Department of Defense.
(C) The Department of Energy.
(C) The Department of Energy.
(D) The Department of Homeland Security.
(D) The Department of Homeland Security.
(E) The Department of Justice.
(E) The Department of Justice.
(F) The Department of the Treasury.
(F) The Department of the Treasury.
(G) The Office of the Director of National Intelligence.
(G) The Office of the Director of National Intelligence.
(4) Cybersecurity purpose
(4) Cybersecurity purpose
The term "cybersecurity purpose" means the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability.
The term "cybersecurity purpose" has the meaning given the term in section 650 of this title.
(5) Cybersecurity threat
(5) Cybersecurity threat
(A) In general
Except as provided in subparagraph (B), the term "cybersecurity threat" means an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system.
(B) Exclusion
The term "cybersecurity threat" does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement.
The term "cybersecurity threat" has the meaning given the term in section 650 of this title.
(6) Cyber threat indicator
(6) Cyber threat indicator
The term "cyber threat indicator" means information that is necessary to describe or identify—
(A) malicious reconnaissance, including anomalous patterns of communications that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat or security vulnerability;
(B) a method of defeating a security control or exploitation of a security vulnerability;
(C) a security vulnerability, including anomalous activity that appears to indicate the existence of a security vulnerability;
(D) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a security control or exploitation of a security vulnerability;
(E) malicious cyber command and control;
(F) the actual or potential harm caused by an incident, including a description of the information exfiltrated as a result of a particular cybersecurity threat;
(G) any other attribute of a cybersecurity threat, if disclosure of such attribute is not otherwise prohibited by law; or
(H) any combination thereof.
The term "cyber threat indicator" has the meaning given the term in section 650 of this title.
(7) Defensive measure
(7) Defensive measure
(A) In general
Except as provided in subparagraph (B), the term "defensive measure" means an action, device, procedure, signature, technique, or other measure applied to an information system or information that is stored on, processed by, or transiting an information system that detects, prevents, or mitigates a known or suspected cybersecurity threat or security vulnerability.
(B) Exclusion
The term "defensive measure" does not include a measure that destroys, renders unusable, provides unauthorized access to, or substantially harms an information system or information stored on, processed by, or transiting such information system not owned by—
(i) the private entity operating the measure; or
(ii) another entity or Federal entity that is authorized to provide consent and has provided consent to that private entity for operation of such measure.
The term "defensive measure" has the meaning given the term in section 650 of this title.
(8) Federal entity
(8) Federal entity
The term "Federal entity" means a department or agency of the United States or any component of such department or agency.
The term "Federal entity" means a department or agency of the United States or any component of such department or agency.
(9) Information system
(9) Information system
The term "information system"—
(B) includes industrial control systems, such as supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers.
(10) Local government
(10) Local government
The term "local government" means any borough, city, county, parish, town, township, village, or other political subdivision of a State.
The term "local government" means any borough, city, county, parish, town, township, village, or other political subdivision of a State.
(11) Malicious cyber command and control
(11) Malicious cyber command and control
The term "malicious cyber command and control" means a method for unauthorized remote identification of, access to, or use of, an information system or information that is stored on, processed by, or transiting an information system.
The term "malicious cyber command and control" has the meaning given the term in section 650 of this title.
(12) Malicious reconnaissance
(12) Malicious reconnaissance
The term "malicious reconnaissance" means a method for actively probing or passively monitoring an information system for the purpose of discerning security vulnerabilities of the information system, if such method is associated with a known or suspected cybersecurity threat.
The term "malicious reconnaissance" has the meaning given the term in section 650 of this title.
(13) Monitor
(13) Monitor
The term "monitor" means to acquire, identify, or scan, or to possess, information that is stored on, processed by, or transiting an information system.
The term "monitor" has the meaning given the term in section 650 of this title.
(14) Non-Federal entity
(14) Non-Federal entity
(A) In general
(A) In general
Except as otherwise provided in this paragraph, the term "non-Federal entity" means any private entity, non-Federal government agency or department, or State, tribal, or local government (including a political subdivision, department, or component thereof).
Except as otherwise provided in this paragraph, the term "non-Federal entity" means any private entity, non-Federal government agency or department, or State, tribal, or local government (including a political subdivision, department, or component thereof).
(B) Inclusions
(B) Inclusions
The term "non-Federal entity" includes a government agency or department of the District of Columbia, the Commonwealth of Puerto Rico, the United States Virgin Islands, Guam, American Samoa, the Northern Mariana Islands, and any other territory or possession of the United States.
The term "non-Federal entity" includes a government agency or department of the District of Columbia, the Commonwealth of Puerto Rico, the United States Virgin Islands, Guam, American Samoa, the Northern Mariana Islands, and any other territory or possession of the United States.
(C) Exclusion
(C) Exclusion
The term "non-Federal entity" does not include a foreign power as defined in section 1801 of title 50.
The term "non-Federal entity" does not include a foreign power as defined in section 1801 of title 50.
(15) Private entity
(15) Private entity
(A) In general
(A) In general
Except as otherwise provided in this paragraph, the term "private entity" means any person or private group, organization, proprietorship, partnership, trust, cooperative, corporation, or other commercial or nonprofit entity, including an officer, employee, or agent thereof.
Except as otherwise provided in this paragraph, the term "private entity" means any person or private group, organization, proprietorship, partnership, trust, cooperative, corporation, or other commercial or nonprofit entity, including an officer, employee, or agent thereof.
(B) Inclusion
(B) Inclusion
The term "private entity" includes a State, tribal, or local government performing utility services, such as electric, natural gas, or water services.
The term "private entity" includes a State, tribal, or local government performing utility services, such as electric, natural gas, or water services.
(C) Exclusion
(C) Exclusion
The term "private entity" does not include a foreign power as defined in section 1801 of title 50.
The term "private entity" does not include a foreign power as defined in section 1801 of title 50.
(16) Security control
(16) Security control
The term "security control" means the management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information.
The term "security control" has the meaning given the term in section 650 of this title.
(17) Security vulnerability
(17) Security vulnerability
The term "security vulnerability" means any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of a security control.
The term "security vulnerability" has the meaning given the term in section 650 of this title.
(18) Tribal
(18) Tribal