,,ib  ,union ,cal5d> ,no4 #gjf  #aae?   
,,congress  #b;d ,session  ,h4 ,r4 #fddc
  ,report ,no4 #aae-iaj  ,,9 ,,! ,,h\se 
,,( ,,repres5tatives  ,july #ai1 #bjah  
,mr4 ,ratcliffe 7= himself1 ,mr4        
,ri*mond1 ,mr4 ,mc,caul1 ,mr4 ,katko1 & 
,mr4 ,fitzpatrick7 introduc$ ! foll[+   
bill2 :i* 0 ref]r$ to ! ,committee on   
,homel& ,security  ,augu/ #bh1          
#bjah;,additional sponsor3 ,mr4 ,donovan
  ,augu/ #bh1 #bjah ,report$ ) an       
am5dm5t1 committ$ to ! ,committee ( !   
,:ole ,h\se on ! ,/ate ( ! ,union1 &    
ord]$ to be pr9t$ ,/rike out all aft] ! 
enact+ clause & ins]t ! "p pr9t$ 9      
italic ,= text ( introduc$ bill1 see    
copy ( bill z introduc$ on ,july #ai1   
#bjah  ,a ,,bill  ,to am5d ! ,homel&    
,security ,act ( #bjjb to au?orize !    
,secret>y ( ,homel& ,security to e/abli%
 a cont9u\s diagno/ics & mitigation     
program at ! ,dep>tm5t ( ,homel&        
,security1 & = o!r purposes4  #a4 ,%ort 
title ,?is ,act may be cit$ z ! ,advanc+
 ,cyb]security ,diagno/ics & ,mitigation

 ,act4  #b4 ,e/abli%m5t ( cont9u\s      
diagno/ics & mitigation program 9       
,dep>tm5t ( ,homel& ,security  7a7 ,9   
g5]al ,section #bcj ( ! ,homel&         
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#aea7 is am5d$ by add+ at ! end ! foll[+
 new subsection3  7g7 ,cont9u\s         
,diagno/ics & ,mitigation  7#a7 ,program
  7,a7 ,9 g5]al ,! ,secret>y %all       
deploy1 op]ate1 & ma9ta9 a cont9u\s     
diagno/ics & mitigation program4 ,"u su*
 program1 ! ,secret>y %all--  7i7       
develop & provide ! capability to       
collect1 analyze1 & visualize in=mation 
relat+ to security data & cyb]security  
risks2  7ii7 make program capabilities  
available = use1 ) or )\t reimbursem5t2 
7iii7 employ %>$ s]vices1 collective    
pur*as+1 blanket pur*ase agreem5ts1 &   
any o!r economic or procurem5t models ! 
,secret>y det]m9es appropriate to       
maximize ! co/s sav+s associat$ )       
implem5t+ an in=mation sy/em2  7iv7     
assi/ entities 9 sett+ in=mation        
security priorities & manag+            

cyb]security risks2 &  7v7 develop      
policies & proc$ures = report+ sy/emic  
cyb]security risks & pot5tial incid5ts  
bas$ ^u data collect$ "u su* program4   
7,b7 ,regul> ,improvem5t ,! ,secret>y   
%all regul>ly deploy new te*nologies &  
modify exi/+ te*nologies to ! cont9u\s  
diagno/ics & mitigation program requir$ 
"u subp>agraph 7,a71 z appropriate1 to  
improve ! program4  7#b7 ,activities ,9 
c>ry+ out ! cont9u\s diagno/ics &       
mitigation program "u p>agraph 7#a71 !  
,secret>y %all ensure1 to ! ext5t       
practicable1 t--  7,a7 timely1          
actionable1 & relevant cyb]security risk
 in=mation1 assessm5ts1 & analysis are  
provid$ 9 real "t2  7,b7 %>e ! analysis 
& products develop$ "u su* program2     
7,c7 all in=mation1 assessm5ts1         
analyses1 & raw data "u su* program is  
made available to ! national            
cyb]security & communications           
integration c5t] ( ! ,dep>tm5t2 &  7,d7 
provide regul> reports on cyb]security  
risks4  4  7b7 ,cont9u\s ,diagno/ics &  

,mitigation ,/rategy  7#a7 ,9 g5]al ,n  
lat] ?an #ahj days aft] ! date ( !      
enactm5t ( ?is ,act1 ! ,secret>y (      
,homel& ,security %all develop a        
compreh5sive cont9u\s diagno/ics &      
mitigation /rategy to c>ry out !        
cont9u\s diagno/ics & mitigation program
 requir$ "u subsection 7g7 ( section    
#bcj ( su* ,act1 z add$ by subsection   
7a74  7#b7 ,scope ,! /rategy requir$ "u 
p>agraph 7#a7 %all include ! foll[+3    
7,a7 ,a description ( ! cont9u\s        
diagno/ics & mitigation program1 includ+
 ef=ts by ! ,secret>y ( ,homel&         
,security to assi/ ) ! deploym5t (      
program tools1 capabilities1 & s]vices1 
f ! inception ( ! program ref]r$ to 9   
p>agraph 7#a7 to ! date ( ! enactm5t (  
?is ,act4  7,b7 ,a description ( !      
coord9ation requir$ to deploy1 in/all1 &
 ma9ta9 ! tools1 capabilities1 & s]vices
 t ! ,secret>y ( ,homel& ,security      
det]m9es to be necess>y to satisfy !    
requirem5ts ( su* program4  7,c7 ,a     
description ( any ob/acles fac+ !       

deploym5t1 in/allation1 & ma9t5ance (   
tools1 capabilities1 & s]vices "u su*   
program4  7,d7 ,recomm5dations &        
guidel9es to help ma9ta9 & cont9u\sly   
upgrade tools1 capabilities1 & s]vices  
provid$ "u su* program4  7,e7           
,recomm5dations = us+ ! data collect$ by
 su* program = creat+ a common framework
 = data analytics1 visualization (      
ent]prise-wide risks1 & real-"t report+4
  7,f7 ,recomm5dations = future ef=ts & 
activities1 includ+ = ! roll\t ( new    
tools1 capabilities & s]vices1 propos$  
timel9es = deliv]y1 & :e!r to cont9ue ! 
use ( phas$ roll\t plans1 relat$ to     
secur+ networks1 devices1 data1 &       
in=mation te*nology assets ?r\gh ! use (
 su* program4  7#c7 ,=m ,! /rategy      
requir$ "u subp>agraph 7,a7 %all be     
submitt$ 9 an unclassifi$ =m1 b may     
conta9 a classifi$ annex4  7c7 ,report  
,n lat] ?an #ij days aft] ! developm5t (
 ! /rategy requir$ "u subsection 7b71 ! 
,secret>y ( ,homel& ,security %all      
submit to ! ,committee on ,homel&       

,security & ,gov]nm5tal ,affairs ( !    
,s5ate & ! ,committee on ,homel&        
,security ( ! ,h\se ( ,repres5tative a  
report on cyb]security risk po/ure bas$ 
on ! data collect$ ?r\gh ! cont9u\s     
diagno/ics & mitigation program "u      
subsection 7g7 ( section #bcj ( !       
,homel& ,security ,act ( #bjjb1 z add$  
by subsection 7a74  ,augu/ #bh1 #bjah   
,report$ ) an am5dm5t1 committ$ to !    
,committee ( ! ,:ole ,h\se on ! ,/ate ( 
! ,union1 & ord]$ to be pr9t$