ENHANCING MARITIME CYBERSECURITY.

SEC. 11224. [14 U.S.C. 504 note] ENHANCING MARITIME CYBERSECURITY. (a) Definitions.—In this section: (1) Cyber incident.—The term “cyber incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually or imminently jeopardizes, without lawful authority, an information system. (2) Maritime operators.—The term “maritime operators” means the owners or operators of vessels engaged in commercial service, the owners or operators of facilities, and port authorities. (3) Facilities.—The term “facilities” has the meaning given the term “facility” in section 70101 of title 46, United States Code. (b) Public Availability of Cybersecurity Tools and Resources.— (1) In general.—Not later than 2 years after the date of enactment of this Act, the Commandant, in coordination with the Administrator of the Maritime Administration, the Director of the Cybersecurity and Infrastructure Security Agency, and the Director of the National Institute of Standards and Technology, shall identify and make available to the public a list of tools and resources, including the resources of the Coast Guard and the Cybersecurity and Infrastructure Security Agency, designed to assist maritime operators in identifying, detecting, protecting against, mitigating, responding to, and recovering from cyber incidents. (2) Identification.—In carrying out paragraph (1), the Commandant, the Administrator of the Maritime Administration, the Director of the Cybersecurity and Infrastructure Security Agency, and the Director of the National Institute of Standards and Technology shall identify tools and resources that— (A) comply with the cybersecurity framework for improving critical infrastructure established by the National Institute of Standards and Technology; or (B) use the guidelines on maritime cyber risk management issued by the International Maritime Organization on July 5, 2017 (or successor guidelines). (3) Consultation.—The Commandant, the Administrator of the Maritime Administration, the Director of the Cybersecurity and Infrastructure Security Agency, and the Director of the National Institute of Standards and Technology may consult with maritime operators, other Federal agencies, industry stakeholders, and cybersecurity experts to identify tools and resources for purposes of this section.