According to news articles (eg here) the 2013 National Defense Authorization Act, which was signed into US law 2-Jan-2012, apparently requires defense contractors to report intrusions. What defines a defense contractor? What defines an intrusion (or penetration as they call it)? What is required to reported to who?
I was asking because I was curious and wondered how it would affect the community at large. In general I'm a proponent of more sharing among the good guys and wondered how far reaching this would be. My experience has been that most companies dislike confessing to intrusions yet I'd be shocked of any company that hasn't had an intrusion of some sort (or at least an attempt).
If the definition of contractor is narrow (eg companies defined as members of the Defense Industrial Base and penetration is defined as access to Top Secret documents) it will have less an impact than if it more broad (eg companies are any companies with gov contracts, and penetrations are any outside access to any system).
The act itself is vague and I'm asking if anybody knows more about what is intended. I presume the law did not come out of this air and there is a back story as to what caused it and what is intended.