,,ii  #aae? ,,congress  #a/ ,session    
,s4 #aaeg  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,may #ag1 #bjag ,mr4   
,s*atz 7= himself1 ,mr4 ,johnson1 & ,mr4
 ,g>dn]7 introduc$ ! foll[+ bill2 :i* 0 
read twice & ref]r$ to ! ,committee on  
,homel& ,security & ,gov]nm5tal ,affairs
  ,a ,,bill  ,to e/abli% ! ,vuln]ability
 ,equities ,review ,bo>d1 & = o!r       
purposes4  #a4 ,%ort title  ,?is ,act   
may be cit$ z ! ,protect+ ,our ,ability 
to ,c\nt] ,hack+ ,act ( #bjag or ,,pat* 
,act ( #bjag4  #b4 ,vuln]ability        
,equities ,review ,bo>d  7a7 ,def9itions
 ,9 ?is section3 7#a7 ,f$]al ag5cy ,!   
t]m ,f$]al ag5cy has ! mean+ giv5 su*   
t]m 9 section #eea ( title #e1 ,unit$   
,/ates ,code4  7#b7 ,publicly kn[n  7,a7
 ,9 g5]al ,except z provid$ 9           
subp>agraph 7,b71 ! t]m publicly kn[n1 )
 respect to in=mation reg>d+ a          
vuln]ability1 means in=mation t-- 7i7   
is--  7,i7 a v]bal or electronic        
pres5tation or discussion 9 a publicly  
accessible doma92 or  7,,ii7 9 a pap] or

 o!r publi%$ docum5tation 9 ! public    
doma92 &  7ii7 t specifically discusses 
! vuln]ability & h[ ! vuln]ability c\ld 
be exploit$4  7,b7 ,classifi$ mat]ial   
,in=mation ab\t a vuln]ability %all n be
 consid]$ publicly kn[n if ! in=mation  
is curr5tly protect$ z classifi$ & has  
be5 inappropriately releas$ to ! public4
  7#c7 ,v5dor ,! t]m v5dor1 ) respect to
 a te*nology1 product1 sy/em1 s]vice1 or
 application1 means ! p]son :o-- 7,a7   
develop$ ! te*nology1 product1 sy/em1   
s]vice1 or application2 or  7,b7 is     
responsible = ma9ta9+ ! te*nology1      
product1 sy/em1 s]vice1 or application4 
7#d7 ,vuln]ability ,! t]m vuln]ability  
means a design1 configuration1 or       
implem5tation weakness 9 a te*nology1   
product1 sy/em1 s]vice1 or application t
 c be exploit$ or trigg]$ to cause      
unexpect$ or un9t5d$ behavior4  7b7     
,e/abli%m5t ,!re is e/abli%$ !          
,vuln]ability ,equities ,review ,bo>d 79
 ?is section ! ,bo>d74  7c7 ,memb]%ip   
7#a7 ,p]man5t memb]s ,! p]man5t memb]s (

 ! ,bo>d consi/ ( ! foll[+3  7,a7 ,!    
,secret>y ( ,homel& ,security1 or !     
designee ( ! ,secret>y1 :o %all be !    
*air ( ! ,bo>d4  7,b7 ,! ,director ( !  
,f$]al ,bureau ( ,inve/igation1 or !    
designee ( ! ,director4  7,c7 ,!        
,director ( ,national ,intellig5ce1 or !
 designee ( ! ,director4  7,d7 ,!       
,director ( ! ,c5tral ,intellig5ce      
,ag5cy1 or ! designee ( ! ,director4    
7,e7 ,! ,director ( ! ,national         
,security ,ag5cy1 or ! designee ( !     
,director4  7,f7 ,! ,secret>y (         
,comm]ce1 or ! designee ( ! ,secret>y4  
7#b7 ,ad hoc memb]s ,! ,bo>d %all       
include z memb]s1 on an ad hoc basis1 ! 
foll[+3  7,a7 ,! ,secret>y ( ,/ate1 or !
 designee ( ! ,secret>y1 :5 ! ,bo>d     
consid]s matt]s "u ! jurisdiction ( su* 
secret>y4  7,b7 ,! ,secret>y ( !        
,treasury1 or ! designee ( ! ,secret>y1 
:5 ! ,bo>d consid]s matt]s "u !         
jurisdiction ( su* secret>y4  7,c7 ,!   
,secret>y ( ,en]gy1 or ! designee ( !   
,secret>y1 :5 ! ,bo>d consid]s matt]s "u

 ! jurisdiction ( su* secret>y4  7,d7 ,!
 ,f$]al ,trade ,commission1 or !        
designee ( ! ,commission1 :5 ! ,bo>d    
consid]s matt]s relat+ to ! ,commission4
  7#c7 ,o!r p>ticipants ,any memb] ( !  
,national ,security ,c\ncil "u section  
#aja ( ! ,national ,security ,act (     
#aidg 7#ej ,u4,s4,c4 #cjba7 :o is n a   
p]man5t or ad hoc memb] ( ! ,bo>d may1 )
 ! approval ( ! ,presid5t1 p>ticipate 9 
activities ( ! ,bo>d :5 reque/$ by !    
,bo>d4  7d7 ,duties  7#a7 ,policies     
7,a7 ,9 g5]al ,! ,bo>d %all e/abli%     
policies on matt]s relat+ to :e!r1 :51  
h[1 to :om1 & to :at degree in=mation   
ab\t a vuln]ability t is n publicly kn[n
 %\ld be %>$ or releas$ by ! ,f$]al     
,gov]nm5t to a non-,f$]al entity4  7,b7 
,availability to ! public ,to ! degree t
 ! policies e/abli%$ "u subp>agraph 7,a7
 are unclassifi$1 ! ,bo>d %all make su* 
policies available to ! public4  7,c7   
,draft policies  7i7 ,submittal to      
,congress  7,i7 ,9 g5]al ,n lat] ?an    
#ahj days aft] ! date ( ! enactm5t ( ?is

 ,act1 ! ,bo>d %all submit to ,congress 
& ! ,presid5t a draft ( ! policies      
requir$ by subp>agraph 7,a71 along ) a  
description ( any *all5ges or imp$im5ts 
t may require legislative or            
adm9i/rative action4  7,,ii7 ,=m ,!     
draft submitt$ "u subclause 7,i7 %all be
 9 unclassifi$ =m1 b may include a      
classifi$ annex4  7ii7 ,publication ,n  
lat] ?an #bdj days aft] ! date ( !      
enactm5t ( ?is ,act1 ! ,bo>d %all make  
available to ! public a draft ( !       
policies requir$ by subp>agraph 7,a71 to
 ! degree t su* policies are            
unclassifi$4  7#b7 ,requirem5t ,! head (
 ea* ,f$]al ag5cy %all1 ^u obta9+       
in=mation ab\t a vuln]ability t is n    
publicly kn[n1 subject su* in=mation to 
! process e/abli%$ "u p>agraph          
7#c77;,a74  7#c7 ,process  7,a7 ,9 g5]al
 ,! ,bo>d %all e/abli% ! process by :i* 
! ,bo>d det]m9es :e!r1 :51 h[1 to :om1 &
 to :at degree ! ,f$]al ,gov]nm5t %>es  
or releases in=mation to a non-,f$]al   
entity ab\t a vuln]ability t is n       

publicly kn[n4  7,b7 ,consid]ations ,!  
process e/abli%$ "u subp>agraph 7,a7    
%all include1 ) respect to a            
vuln]ability1 consid]ation ( ! foll[+3  
7i7 ,:i* te*nologies1 products1 sy/ems1 
s]vices1 or applications are subject to 
! vuln]ability1 includ+ :e!r ! products 
or sy/ems are us$ 9 core ,int]net       
infra/ructure1 9 o!r critical           
infra/ructure sy/ems1 9 ! ,unit$ ,/ates 
economy1 or 9 national security sy/ems4 
7ii7 ,! pot5tial risks ( leav+ !        
vuln]ability unpat*$ or unmitigat$4     
7iii7 ,! h>m t c\ld occur if an actor1  
su* z an adv]s>y ( ! ,unit$ ,/ates or a 
crim9al organization1 7 to obta9        
in=mation ab\t ! vuln]ability4  7iv7 ,h[
 likely x is t ! ,f$]al ,gov]nm5t w\ld  
"k if someone ext]nal to ! ,f$]al       
,gov]nm5t 7 exploit+ ! vuln]ability4    
7v7 ,! ne$ ( ! ,f$]al ,gov]nm5t to      
exploit ! vuln]ability4  7vi7 ,:e!r !   
vuln]ability is ne$$ = a specific ongo+ 
intellig5ce or national security        
op]ation4  7vii7 ,if a ,f$]al entity    

w\ld l to exploit ! vuln]ability to     
obta9 in=mation1 :e!r !re are o!r means 
available to ! ,f$]al entity to obta9   
su* in=mation4  7viii7 ,! likelihood t a
 non-,f$]al entity w discov] !          
vuln]ability4  7ix7 ,! risks to =eign   
c\ntries & ! p ( =eign c\ntries ( n %>+ 
or releas+ in=mation ab\t !             
vuln]ability4  7x7 ,:e!r ! vuln]ability 
c be pat*$ or o!rwise mitigat$4  7xi7   
,:e!r ! affect$ non-,f$]al entity has a 
publicly disclos$ policy = report+ &    
disclos+ vuln]abilities4  7#d7          
,exclusion f process ( vuln]abilities   
presumptively %>eable or releasable     
7,a7 ,9 g5]al ,"u guidel9es e/abli%$ by 
! ,bo>d1 a ,f$]al ag5cy may %>e or      
release in=mation to a non-,f$]al entity
 ab\t a vuln]ability )\t subject+ su*   
in=mation to ! process "u p>agraph      
7#c77;,a7 if ! ag5cy det]m9es t su*     
in=mation is presumptively %>eable or   
releasable4 ,! guidel9es %all specify ! 
/&>ds to be us$ to det]m9e :e!r or n    
in=mation is presumptively %>eable or   

releasable = purposes ( ?is p>agraph4   
7,b7 ,rule ( con/ruction ,subp>agraph   
7,a7 %all n be con/ru$ to imply t       
in=mation :i* is det]m9$ "u su*         
subp>agraph to be presumptively %>eable 
or releasable is exempt f ! requirem5ts 
( subp>agraph 7,a7 ( p>agraph 7#e7 or ! 
%>+ process e/abli%$ "u subp>agraph 7,b7
 ( su* p>agraph4  7#e7 ,dissem9ation (  
in=mation on vuln]abilities  7,a7 ,%>+  
?r\gh ,secret>y ( ,homel& ,security  7i7
 ,9 g5]al ,9 any case 9 :i* ! ,bo>d     
det]m9es "u p>agraph 7#c77;,a7 t        
in=mation ab\t a vuln]ability n o!rwise 
publicly kn[n %\ld be %>$ ) or releas$  
to an appropriate v5dor1 ! ,bo>d %all   
provide ! in=mation to ! ,secret>y (    
,homel& ,security & ! ,secret>y %all1 on
 behalf ( ! ,f$]al ,gov]nm5t1 %>e or    
release ! in=mation z direct$ by !      
,bo>d4  7ii7 ,presumptively %>eable or  
releasable in=mation ,9 any case 9 :i* a
 ,f$]al ag5cy det]m9es "u p>agraph      
7#d77;,a7 t in=mation ab\t a            
vuln]ability is presumptively %>eable or

 releasable1 ! ,f$]al ag5cy %all provide
 su* in=mation to ! ,secret>y & !       
,secret>y %all1 on behalf ( ! ,f$]al    
,gov]nm5t1 %>e or release ! in=mation4  
7,b7 ,%>+ process  7i7 ,9 g5]al ,n lat] 
?an #ahj days aft] ! date ( ! enactm5t (
 ?is ,act1 ! ,secret>y ( ,homel&        
,security1 9 coord9ation ) ! ,secret>y (
 ,comm]ce1 %all e/abli% ! process by :i*
 ! ,secret>y ( ,homel& ,security %>es or
 releases in=mation pursuant to         
subp>agraph 7,a74  7ii7 ,use ( volunt>y 
cons5sus /&>ds ,! ,secret>y %all ensure 
t 7,i7 any %>+ or release ( in=mation "u
 subp>agraph 7,a7 is made 9 accordance )
 volunt>y cons5sus /&>ds = disclosure ( 
vuln]abilities2 &  7,,ii7 ! process     
e/abli%$ "u clause 7i7 is consi/5t ) su*
 /&>ds4  7,c7 ,in=mation n det]m9$ to be
 %>eable or releasable  7i7 ,9 g5]al ,! 
policies "u p>agraph 7#a7 %all provide  
=--  7,i7 ! p]iodic review (            
vuln]abilities t are det]m9$ by ! ,bo>d1
 pursuant to ! process e/abli%$ "u      
p>agraph 7#c77;,a71 n to be %>eable or  

releasable1 9 ord] to det]m9e :e!r su*  
vuln]abilities may be %>$ or releas$ 9 a
 mann] consi/5t ) ! national security   
int]e/s ( ! ,unit$ ,/ates2 &  7,,ii7 !  
%>+ ) or releas+ to appropriate         
non-,f$]al entities ( in=mation ab\t    
vuln]abilities t may be %>$ or releas$ 9
 a mann] consi/5t ) ! national security 
int]e/s ( ! ,unit$ ,/ates foll[+ review 
"u subclause 7,i74  7ii7 ,9 case ( lat] 
becom+ publicly kn[n  7,i7 ,9 g5]al ,9 !
 case ( a vuln]ability t 0 n publicly   
kn[n & det]m9$ n to be %>eable or       
releasable pursuant to clause 7i77,i7 & 
!n subsequ5tly becomes publicly kn[n1 ! 
vuln]ability %all n be subject to !     
process e/abli%$ "u p>agraph 7#c77;,a7 &
 %all be subject to su* o!r ,f$]al      
proc$ures & int]-ag5cy op]ation         
processes z may be applicable1 su* z    
proc$ures & processes e/abli%$ to c>ry  
out ! ,cyb]security ,in=mation ,%>+ ,act
 ( #bjae 7#f ,u4,s4,c4 #aeja et seq474  
7,,ii7 ,applicability to classifi$      
mat]ial ,9 ?is clause1 subp>agraph 7,b7 

( subsection 7a77#b7 %all n apply4  7e7 
,compliance ,ea* head ( a ,f$]al ag5cy  
%all ensure t ! ag5cy complies ) !      
policies issu$ by ! ,bo>d "u ?is        
section4  7f7 ,ov]sight  7#a7 ,annual   
reports by ,bo>d  7,a7 ,9 g5]al ,n less 
frequ5tly ?an once ea* ye>1 ! ,bo>d %all
 submit to ! appropriate committees (   
,congress a report on ! activities ( !  
,bo>d & ! policies issu$ "u subsection  
7d74  7,b7 ,cont5ts ,9 addition to      
in=mation ab\t ! activities & policies  
describ$ 9 subp>agraph 7,a71 ! report   
requir$ by su* subp>agraph %all also    
include ! foll[+3  7i7 ,! frequ5cy (    
meet+s held by ! ,bo>d4  7ii7 ,!        
aggregate numb] ( vuln]abilities review$
 by ! ,bo>d4  7iii7 ,! numb] (          
vuln]abilities det]m9$ by ! ,bo>d to be 
%>eable or releasable4  7iv7 ,! numb] ( 
vuln]abilities det]m9$ by ! ,bo>d n to  
be %>eable or releasable4  7v7 ,su* o!r 
matt]s z ! ,bo>d consid]s appropriate4  
7,c7 ,availability to ! public ,= ea*   
report submitt$ "u subp>agraph 7,a71 !  

,bo>d %all make an unclassifi$ v]sion ( 
! report available to ! public4  7#b7   
,annual reports on activities ( ,i,gs   
7,a7 ,9 g5]al ,n less frequ5tly ?an once
 ea* ye>1 ! ,inspector ,g5]al ( !       
,dep>tm5t ( ,homel& ,security %all1 9   
consultation ) ! ,inspectors ,g5]al (   
o!r ,f$]al ag5cies ^: "w is affect$ by  
activities ( ! ,bo>d1 submit to !       
appropriate committees ( ,congress a    
report on ! activities ( all su*        
,inspectors ,g5]al dur+ ! prec$+ ye> 9  
connection ) ! activities ( ! ,bo>d1 !  
policies issu$ "u subsection 7d71 & !   
%>+ & releas+ ( in=mation ab\t          
vuln]abilities pursuant to su* policies4
  7,b7 ,availability to ! public ,= ea* 
report submitt$ "u subp>agraph 7,a71 !  
,inspector ,g5]al ( ! ,dep>tm5t (       
,homel& ,security %all make an          
unclassifi$ v]sion ( ! report available 
to ! public4  7#c7 ,=m ,ea* report "u   
p>agraphs 7#a7 & 7#b7 %all be submitt$ 9
 unclassifi$ =m1 b may include a        
classifi$ annex4  7#d7 ,review by       

,privacy & ,civil ,lib]ties ,ov]sight   
,bo>d  7,a7 ,9 g5]al ,! ,privacy &      
,civil ,lib]ties ,ov]sight ,bo>d %all   
review ea* report submitt$ "u p>agraph  
7#a74  7,b7 ,consultation ,!            
,vuln]ability ,equities ,review ,bo>d   
may consult ) ! ,privacy & ,civil       
,lib]ties ,ov]sight ,bo>d z !           
,vuln]ability ,equities ,review ,bo>d   
consid]s appropriate4  7#e7 ,appropriate
 committees ( ,congress def9$ ,9 ?is    
subsection1 ! t]m appropriate committees
 ( ,congress means-- 7,a7 ! ,committee  
on ,homel& ,security & ,gov]nm5tal      
,affairs1 ! ,committee on ,comm]ce1     
,sci5ce1 & ,transportation1 & ! ,select 
,committee on ,intellig5ce ( ! ,s5ate2 &
  7,b7 ! ,committee on ,homel&          
,security1 ! ,committee on ,ov]sight &  
,gov]nm5t ,re=m1 ! ,committee on ,en]gy 
& ,comm]ce1 & ! ,p]man5t ,select        
,committee on ,intellig5ce ( ! ,h\se (  
,repres5tatives4