#aae? ,,congress  #b;d ,session  ,h4 ,r4
 #fgce  ,,an ,,act  ,to direct !        
,secret>y ( ,homel& ,security to e/abli%
 a vuln]ability disclosure policy =     
,dep>tm5t ( ,homel& ,security int]net   
websites1 & = o!r purposes4  #a4 ,%ort  
title ,?is ,act may be cit$ z !         
,public-,private ,cyb]security          
,coop]ation ,act4  #b4 ,dep>tm5t (      
,homel& ,security disclosure ( security 
vuln]abilities  7a7 ,vuln]ability       
disclosure policy ,! ,secret>y ( ,homel&
 ,security %all e/abli% a policy        
applicable to individuals1              
organizations1 & companies t report     
security vuln]abilities on appropriate  
in=mation sy/ems ( ,dep>tm5t ( ,homel&  
,security4 ,su* policy %all include ea* 
( ! foll[+3  7#a7 ,! appropriate        
in=mation sy/ems ( ! ,dep>tm5t t        
individuals1 organizations1 & companies 
may use to discov] & report security    
vuln]abilities on appropriate in=mation 
sy/ems4  7#b7 ,! conditions & crit]ia "u
 :i* individuals1 organizations1 &      

companies may op]ate to discov] & report
 security vuln]abilities4  7#c7 ,h[     
individuals1 organizations1 & companies 
may disclose to ! ,dep>tm5t security    
vuln]abilities discov]$ on appropriate  
in=mation sy/ems ( ! ,dep>tm5t4  7#d7 ,!
 ways 9 :i* ! ,dep>tm5t may communicate 
) individuals1 organizations1 &         
companies t report security             
vuln]abilities4  7#e7 ,! process !      
,dep>tm5t %all use = public disclosure (
 report$ security vuln]abilities4  7b7  
,rem$iation process ,! ,secret>y (      
,homel& ,security %all develop a process
 = ! ,dep>tm5t ( ,homel& ,security to   
address ! mitigation or rem$iation ( !  
security vuln]abilities report$ ?r\gh ! 
policy develop$ 9 subsection 7a74  7c7  
,consultation ,9 develop+ ! security    
vuln]ability disclosure policy "u       
subsection 7a71 ! ,secret>y ( ,homel&   
,security %all consult ) ea* ( ! foll[+3
 7#a7 ,! ,attorney ,g5]al reg>d+ h[ to  
ensure t individuals1 organizations1 &  
companies t comply ) ! requirem5ts ( !  

policy develop$ "u subsection 7a7 are   
protect$ f prosecution "u section #ajcj 
( title #ah1 ,unit$ ,/ates ,code1 civil 
lawsuits1 & simil> provisions ( law )   
respect to specific activities au?oriz$ 
"u ! policy4  7#b7 ,! ,secret>y (       
,def5se & ! ,adm9i/rator ( ,g5]al       
,s]vices reg>d+ lessons t may be appli$ 
f exi/+ vuln]ability disclosure         
policies4  7#c7 ,non-gov]nm5tal security
 rese>*]s4  7d7 ,public availability ,! 
,secret>y ( ,homel& ,security %all make 
! policy develop$ "u subsection 7a7     
publicly available4  7e7 ,submission to 
,congress  7#a7 ,disclosure policy &    
rem$iation process ,n lat] ?an #ij days 
aft] ! date ( ! enactm5t ( ?is ,act1 !  
,secret>y ( ,homel& ,security %all      
submit to ,congress a copy ( ! policy   
requir$ "u subsection 7a7 & ! rem$iation
 process requir$ "u subsection 7b74     
7#b7 ,report & brief+  7,a7 ,report ,n  
lat] ?an "o ye> aft] e/abli%+ ! policy  
requir$ "u subsection 7a71 ! ,secret>y (
 ,homel& ,security %all submit to       

,congress a report on su* policy & !    
rem$iation process requir$ "u subsection
 7b74  7,b7 ,annual brief+s ,"o ye> aft]
 ! date ( ! submission ( ! report "u    
subp>agraph 7,a71 & annually !reaft] =  
ea* ( ! next ?ree ye>s1 ! ,secret>y (   
,homel& ,security %all provide to       
,congress a brief+ on ! policy requir$  
"u subsection 7a7 & ! process requir$ "u
 subsection 7b74  7,c7 ,matt]s =        
inclusion ,! report requir$ "u          
subp>agraph 7,a7 & ! brief+s requir$ "u 
subp>agraph 7,b7 %all include ea* ( !   
foll[+ ) respect to ! policy requir$ "u 
subsection 7a7 & ! process requir$ "u   
subsection 7b7 = ! p]iod cov]$ by !     
report or brief+1 z ! case may be3 7i7  
,! numb] ( unique security              
vuln]abilities report$4  7ii7 ,! numb] (
 previ\sly unkn[n security              
vuln]abilities mitigat$ or rem$iat$4    
7iii7 ,! numb] ( unique individuals1    
organizations1 & companies t report$    
security vuln]abilities4  7iv7 ,! av]age
 l5g? ( "t betwe5 ! report+ ( security  

vuln]abilities & mitigation or          
rem$iation ( su* vuln]abilities4  7f7   
,def9itions ,9 ?is section3  7#a7 ,! t]m
 security vuln]ability has ! mean+ giv5 
t t]m 9 section #ajb7ag7 ( !            
,cyb]security ,in=mation ,%>+ ,act (    
#bjae 7#f ,u4,s4,c4 #aeja7ag771 9       
in=mation te*nology4  7#b7 ,! t]m       
in=mation sy/em has ! mean+ giv5 t t]m  
by section #cejb7ab7 ( title #dd1 ,unit$
 ,/ates ,code4  7#c7 ,! t]m appropriate 
in=mation sy/em means an in=mation sy/em
 t ! ,secret>y ( ,homel& ,security      
selects = inclusion "u ! vuln]ability   
disclosure policy requir$ by subsection 
7a74  ,pass$ ! ,h\se ( ,repres5tatives  
,septemb] #be1 #bjah4;,cl]k4