,i  #aae? ,,congress  #b;d ,session  ,h4
 ,r4 #fgce  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,septemb] #g1         
#bjah,mr4 ,mc,carthy 7= himself1 ,mr4   
,hurd1 ,mr4 ,langev91 & ,mr4 ,ratcliffe7
 introduc$ ! foll[+ bill2 :i* 0 ref]r$  
to ! ,committee on ,homel& ,security  ,a
 ,,bill  ,to direct ! ,secret>y (       
,homel& ,security to e/abli% a          
vuln]ability disclosure policy =        
,dep>tm5t ( ,homel& ,security int]net   
websites1 & = o!r purposes4  #a4        
,dep>tm5t ( ,homel& ,security disclosure
 ( security vuln]abilities  7a7         
,vuln]ability disclosure policy ,!      
,secret>y ( ,homel& ,security %all      
e/abli% a policy applicable to          
individuals1 organizations1 & companies 
t report security vuln]abilities on     
,dep>tm5t ( ,homel& ,security public    
int]net websites t %all include--  7#a7 
! in=mation te*nology to :i* ! policy   
applies2  7#b7 ! conditions "u :i*      
p>ties may legally op]ate to discov] &  
report security vuln]abilities2  7#c7 h[

 individuals1 organizations1 & companies
 %\ld disclose discov]$ security        
vuln]abilities to ! ,dep>tm5t2  7#d7 !  
communication t p>ties t report security
 vuln]abilities %\ld expect f !         
,dep>tm5t2 &  7#e7 h[ ! ,dep>tm5t w     
disclose1 or h[ p>ties t report security
 vuln]abilities may disclose1 report$   
security vuln]abilities4  7b7           
,rem$iation process ,! ,secret>y %all   
develop a process = ! ,dep>tm5t (       
,homel& ,security to address h[ !       
,dep>tm5t w mitigate or rem$iate        
security vuln]abilities report$ ?r\gh ! 
policy develop$ 9 subsection 7a74  7c7  
,consultation ,9 develop+ ! security    
vuln]ability disclosure policy "u       
subsection 7a71 ! ,secret>y %all consult
 )--  7#a7 ! ,attorney ,g5]al reg>d+ h[ 
to ensure t individuals1 organizations1 
& companies t comply ) ! requirem5ts ( !
 policy develop$ "u subsection 7a7 are  
protect$ f prosecution "u section #ajcj 
( title #ah1 ,unit$ ,/ates ,code1 civil 
lawsuits1 & simil> provisions ( law )   

respect to specific activities au?oriz$ 
"u ! policy2  7#b7 ! ,secret>y ( ,def5se
 & ! ,adm9i/rator ( ,g5]al ,s]vices     
reg>d+ lessons t may be appli$ f exi/+  
vuln]ability disclosure programs2 &     
7#c7 non-gov]nm5tal security rese>*]s4  
7d7 ,public availability ,! ,secret>y   
%all make ! policy develop$ "u          
subsection 7a7 publicly available4  7e7 
,submission to ,congress  7#a7 ,n lat]  
?an #ij days aft] ! date ( ! enactm5t ( 
?is ,act1 ! ,secret>y %all submit to    
,congress ! policy requir$ "u subsection
 7a7 & ! rem$iation process requir$ "u  
subsection 7b74  7#b7 ,n lat] ?an "o ye>
 aft] creat+ ! policy requir$ "u        
subsection 7a7 ! ,secret>y %all submit a
 report to ,congress1 & annually !reaft]
 = ea* ( ! next ?ree ye>s1 ! ,secret>y  
%all brief ,congress ) ! foll[+         
in=mation ) respect to ! policy requir$ 
"u subsection 7a7 & ! process requir$ "u
 subsection 7b73  7,a7 ! numb] ( unique 
security vuln]abilities report$2  7,b7 !
 numb] ( previ\sly unkn[n security      

vuln]abilities mitigat$ or rem$iat$2    
7,c7 ! numb] ( unique p>ties t report$  
security vuln]abilities2 &  7,d7 !      
av]age l5g? ( "t betwe5 ! report+ (     
security vuln]abilities & mitigation or 
rem$iation ( su* vuln]abilities4  7f7   
,def9itions ,9 ?is section-- 7#a7 ! t]m 
security vuln]ability has ! mean+ giv5 t
 t]m 9 section #aeja ( title #f1 ,unit$ 
,/ates ,code1 9 in=mation te*nology2 &  
7#b7 ! t]m in=mation sy/em has ! mean+  
giv5 t t]m by section #cejb ( title #dd1
 ,unit$ ,/ates ,code4