The three bills compared are
the Protecting Cyber Networks Act (PCNA, H.R. 1560 as passed by the House), the National Cybersecurity Protection Advancement Act of 2015 (NCPAA, H.R. All three bills focus on information sharing among private entities and between them and the federal government. In addition to other provisions, NCPAA would explicitly amend portions of the Homeland Security Act of 2002 (6 U.S.C. ), and PCNA would amend parts of the National Security Act of 1947 (50 U.S.C. Private-sector entities often claim that they are reluctant to share such information among themselves because of concerns about legal liability, antitrust violations, and potential misuse, especially of intellectual property, including trade secrets and other proprietary business information. Institutional and cultural factors have also been cited—traditional approaches to security tend to emphasize secrecy and confidentiality, which would necessarily impede sharing of information. While reduction or removal of such barriers may provide cybersecurity benefits, concerns have also been raised about potential adverse impacts, especially with respect to privacy and civil liberties. The Cyber Intelligence Sharing and Protection Act (CISPA, H.R. NCPAA ( H.R. 1731 would be appended to H.R. 1560 , and H.R. The bill was offered as an amendment to H.R. More than 70 amendments to the bill were filed. The cloture motion was withdrawn on August 5 after a unanimous consent agreement was reached permitting consideration, and the Senate began debate on a manager's amendment on October 20. The substitute included several of the filed amendments. Several additional amendments were considered, but most did not succeed. The Senate passed CISA, as amended, on October 27. Other Legislative Proposals in the 114th Congress

Two other bills on information sharing have been introduced in the 114 th Congress, one in the House and one in the Senate. The White House has also submitted a legislative proposal (WHP) and issued an executive order on the topic. Overview of the Legislative Proposals

All the bills would address common concerns about barriers to sharing of information on threats, attacks, vulnerabilities, and other aspects of cybersecurity—both within and across sectors—but they vary somewhat in emphasis and method. NCPAA focuses on the role of the Department of Homeland Security (DHS), and in particular the National Cybersecurity and Communications Integration Center (NCCIC), the role of which is also addressed in S. 456 and the WHP. Similar authorizing language was included in H.R. All five bills and the WHP have provisions aimed at facilitating sharing of information among private-sector entities and providing protections from liability that might arise from such sharing. In general, the proposals limit the use of shared information to purposes of cybersecurity and specified aspects of law enforcement, and they limit government use for regulatory purposes. All the proposals require reports to Congress on impacts of their provisions. All also include provisions to shield information shared with the federal government from public disclosure, including exemption from disclosure under the Freedom of Information Act (FOIA). NCPAA and CISA also contain provisions relating to cybersecurity of federal agencies and their information systems and of critical infrastructure sectors. CISA also has provisions on international cybersecurity policy and cybercrime. Privacy and Civil Liberties. Concerns relating to privacy and civil liberties, especially the protection of personal and proprietary information and uses of shared information, have been a subject of considerable debate in the development of legislation on information sharing. Sharing of information among private-sector entities might not be substantially increased by the actions contemplated in the legislation. Most observers appear to believe that legislation on information sharing is either necessary or at least potentially beneficial—provided that appropriate protections are included. This may be especially true for information shared with the federal government. Information sharing is only one facet of cybersecurity. Side-by-Side Comparison of NCPAA, PCNA, and CISA

The remainder of the report consists of four tables comparing provisions in NCPAA and PCNA as passed by the House and CISA as passed by the Senate:
 Table 1 provides a side-by-side comparison of sections with corresponding provisions in the three bills and includes all the provisions specifically related to information sharing.
Effective sharing of information in cybersecurity is generally considered an important tool for protecting information systems from unauthorized access. Five bills on such sharing have been introduced in the 114th Congress—H.R. 234, H.R. 1560, H.R. 1731, S. 456, and S. 754, and relevant provisions have appeared in other bills. The White House has also submitted a legislative proposal and issued an executive order on the topic.
H.R. 1560, the Protecting Cyber Networks Act (PCNA), and H.R. 1731, the National Cybersecurity Protection Advancement Act of 2015 (NCPAA), passed the House the week of April 20. The bills were then combined as separate titles in H.R. 1560.
In the Senate, S. 754, the Cybersecurity Information Sharing Act of 2015 (CISA), was reported in March and was proposed to be considered as an amendment to H.R. 1735, the National Defense Authorization Act (NDAA). More than 70 amendments to CISA were submitted, a managers amendment was circulated, and a cloture motion was filed on August 3. On August 5, a unanimous consent agreement was reached permitting consideration, and the Senate began debate on a manager's amendment on October 20. The substitute included several of the filed amendments. Several additional amendments were considered, but most did not succeed. The Senate passed CISA, as amended, on October 27. Presumably, any inconsistencies between CISA and the two titles of H.R. 1560 could be reconciled during the process for resolving differences between the House and Senate bills.
PCNA, NCPAA, and CISA have many similarities but also significant differences. All focus on information sharing among private entities and between them and the federal government. NCPAA would explicitly amend portions of the Homeland Security Act of 2002, and PCNA would amend parts of the National Security Act of 1947. CISA addresses the roles of the Department of Homeland Security and the intelligence community but does not explicitly amend either act. NCPAA and CISA also contain provisions relating to cybersecurity of federal agencies and their information systems and of critical infrastructure sectors. CISA also has provisions on international cybersecurity policy and cybercrime. The bills differ in how they define some terms in common, the roles they provide for federal agencies, processes for nonfederal entities to share information with the federal government, processes for protecting privacy and civil liberties, uses permitted for shared information, and reporting requirements.
All the bills would address concerns about barriers to sharing information about cybersecurity within and across sectors. Such barriers are considered by many to hinder protection of information systems. Private-sector entities often express reluctance to share such information because of concerns about legal liability, antitrust violations, regulatory requirements, and protection of intellectual property and other proprietary business information. Institutional and cultural factors have also been cited—traditional approaches to security tend to emphasize secrecy and confidentiality, which would necessarily impede sharing of information.
All the bills have provisions aimed at facilitating information sharing among private-sector entities and providing protections from liability. While reduction or removal of such barriers may provide benefits, concerns have been raised about potential adverse impacts, especially on privacy and civil liberties, and potential misuse of shared information. The bills address many of those concerns. In general, they limit the use of shared information to purposes of cybersecurity and law enforcement, and they limit government use, especially for regulatory purposes. All include provisions to shield information shared with the federal government from public disclosure and to protect privacy and civil liberties with respect to shared information that is not needed for cybersecurity purposes. All require reports to Congress on impacts of their provisions.
Most observers appear to believe that legislation on information sharing is either necessary or at least potentially beneficial—provided that appropriate protections are included—but additional factors may be worthy of consideration as the legislative proposals are debated. In particular, resistance to information sharing among private-sector entities might not be substantially reduced by the actions contemplated in the legislation; and information sharing is only one of many facets of cybersecurity that organizations need to address to secure their information systems.