,,ib ,union ,calendar ,no4 #gdi #aaeth ,,congress #b;d ,session ,h4 ,r4 #fgce ,report ,no4 #aae-ifa ,,in ,,the ,,house ,,of ,,representatives ,september #g1 #bjah ,mr4 ,mc,carthy 7for himself1 ,mr4 ,hurd1 ,mr4 ,langevin1 and ,mr4 ,ratcliffe7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security ,september #be1 #bjah ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed ,strike out all after the enacting clause and insert the part printed in italic ,for text of introduced bill1 see copy of bill as introduced on ,september #g1 #bjah ,a ,,bill ,to direct the ,secretary of ,homeland ,security to establish a vulnerability disclosure policy for ,department of ,homeland ,security internet websites1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,public-,private ,cybersecurity ,cooperation ,act4 #b4 ,department of ,homeland ,security disclosure of security vulnerabilities 7a7 ,vulnerability disclosure policy ,the ,secretary of ,homeland ,security shall establish a policy applicable to individuals1 organizations1 and companies that report security vulnerabilities on appropriate information systems of ,department of ,homeland ,security4 ,such policy shall include each of the following3 7#a7 ,the appropriate information systems of the ,department that individuals1 organizations1 and companies may use to discover and report security vulnerabilities on appropriate information systems4 7#b7 ,the conditions and criteria under which individuals1 organizations1 and companies may operate to discover and report security vulnerabilities4 7#c7 ,how individuals1 organizations1 and companies may disclose to the ,department security vulnerabilities discovered on appropriate information systems of the ,department4 7#d7 ,the ways in which the ,department may communicate with individuals1 organizations1 and companies that report security vulnerabilities4 7#e7 ,the process the ,department shall use for public disclosure of reported security vulnerabilities4 7b7 ,remediation process ,the ,secretary of ,homeland ,security shall develop a process for the ,department of ,homeland ,security to address the mitigation or remediation of the security vulnerabilities reported through the policy developed in subsection 7a74 7c7 ,consultation ,in developing the security vulnerability disclosure policy under subsection 7a71 the ,secretary of ,homeland ,security shall consult with each of the following3 7#a7 ,the ,attorney ,general regarding how to ensure that individuals1 organizations1 and companies that comply with the requirements of the policy developed under subsection 7a7 are protected from prosecution under section #ajcj of title #ah1 ,united ,states ,code1 civil lawsuits1 and similar provisions of law with respect to specific activities authorized under the policy4 7#b7 ,the ,secretary of ,defense and the ,administrator of ,general ,services regarding lessons that may be applied from existing vulnerability disclosure policies4 7#c7 ,non-governmental security researchers4 7d7 ,public availability ,the ,secretary of ,homeland ,security shall make the policy developed under subsection 7a7 publicly available4 7e7 ,submission to ,congress 7#a7 ,disclosure policy and remediation process ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security shall submit to ,congress a copy of the policy required under subsection 7a7 and the remediation process required under subsection 7b74 7#b7 ,report and briefing 7,a7 ,report ,not later than one year after establishing the policy required under subsection 7a71 the ,secretary of ,homeland ,security shall submit to ,congress a report on such policy and the remediation process required under subsection 7b74 7,b7 ,annual briefings ,one year after the date of the submission of the report under subparagraph 7,a71 and annually thereafter for each of the next three years1 the ,secretary of ,homeland ,security shall provide to ,congress a briefing on the policy required under subsection 7a7 and the process required under subsection 7b74 7,c7 ,matters for inclusion ,the report required under subparagraph 7,a7 and the briefings required under subparagraph 7,b7 shall include each of the following with respect to the policy required under subsection 7a7 and the process required under subsection 7b7 for the period covered by the report or briefing1 as the case may be3 7i7 ,the number of unique security vulnerabilities reported4 7ii7 ,the number of previously unknown security vulnerabilities mitigated or remediated4 7iii7 ,the number of unique individuals1 organizations1 and companies that reported security vulnerabilities4 7iv7 ,the average length of time between the reporting of security vulnerabilities and mitigation or remediation of such vulnerabilities4 7f7 ,definitions ,in this section3 7#a7 ,the term security vulnerability has the meaning given that term in section #ajb7ag7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja7ag771 in information technology4 7#b7 ,the term information system has the meaning given that term by section #cejb7ab7 of title #dd1 ,united ,states ,code4 7#c7 ,the term appropriate information system means an information system that the ,secretary of ,homeland ,security selects for inclusion under the vulnerability disclosure policy required by subsection 7a74 ,september #be1 #bjah ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed