,,ii  #aaeth ,,congress  #b;d ,session  
,s4 #cdfd  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,september #ah1
 #bjah,mr4 ,cornyn 7for himself and ,ms4
 ,hassan7 introduced the following bill2
 which was read twice and referred to   
the ,committee on ,homeland ,security   
and ,governmental ,affairs  ,a ,,bill   
,to amend the ,homeland ,security ,act  
of #bjjb to authorize the ,secretary of 
,homeland ,security to establish a      
continuous diagnostics and mitigation   
program at the ,department of ,homeland 
,security1 and for other purposes4  #a4 
,short title ,this ,act may be cited as 
the ,advancing ,cybersecurity           
,diagnostics and ,mitigation ,act4  #b4 
,establishment of continuous diagnostics
 and mitigation program in ,department  
of ,homeland ,security  7a7 ,in general 
,section #bcj of the ,homeland ,security
 ,act of #bjjb 7#f ,u4,s4,c4 #aea7 is   
amended by adding at the end the        
following new subsection3  7g7          
,continuous ,diagnostics and ,mitigation

  7#a7 ,program  7,a7 ,in general ,the  
,secretary shall deploy1 operate1 and   
maintain a continuous diagnostics and   
mitigation program4 ,under such program1
 the ,secretary shall--  7i7 develop and
 provide the capability to collect1     
analyze1 and visualize information      
relating to security data and           
cybersecurity risks2  7ii7 make program 
capabilities available for use1 with or 
without reimbursement2  7iii7 employ    
shared services1 collective purchasing1 
blanket purchase agreements1 and any    
other economic or procurement models the
 ,secretary determines appropriate to   
maximize the costs savings associated   
with implementing an information system2
  7iv7 assist entities in setting       
information security priorities and     
managing cybersecurity risks2 and  7v7  
develop policies and procedures for     
reporting systemic cybersecurity risks  
and potential incidents based upon data 
collected under such program4  7,b7     
,regular ,improvement ,the ,secretary   

shall regularly deploy new technologies 
and modify existing technologies to the 
continuous diagnostics and mitigation   
program required under subparagraph     
7,a71 as appropriate1 to improve the    
program4  7#b7 ,activities ,in carrying 
out the continuous diagnostics and      
mitigation program under paragraph 7#a71
 the ,secretary shall ensure1 to the    
extent practicable1 that--  7,a7 timely1
 actionable1 and relevant cybersecurity 
risk information1 assessments1 and      
analysis are provided in real time2     
7,b7 share the analysis and products    
developed under such program2  7,c7 all 
information1 assessments1 analyses1 and 
raw data under such program is made     
available to the national cybersecurity 
and communications integration center of
 the ,department2 and  7,d7 provide     
regular reports on cybersecurity risks4 
4  7b7 ,continuous ,diagnostics and     
,mitigation ,strategy  7#a7 ,in general 
,not later than #ahj days after the date
 of the enactment of this ,act1 the     

,secretary of ,homeland ,security shall 
develop a comprehensive continuous      
diagnostics and mitigation strategy to  
carry out the continuous diagnostics and
 mitigation program required under      
subsection 7g7 of section #bcj of the   
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #aea71 as added by subsection 
7a74  7#b7 ,scope ,the strategy required
 under paragraph 7#a7 shall include the 
following3 7,a7 ,a description of the   
continuous diagnostics and mitigation   
program1 including efforts by the       
,secretary of ,homeland ,security to    
assist with the deployment of program   
tools1 capabilities1 and services1 from 
the inception of the program referred to
 in paragraph 7#a7 to the date of the   
enactment of this ,act4  7,b7 ,a        
description of the coordination required
 to deploy1 install1 and maintain the   
tools1 capabilities1 and services that  
the ,secretary of ,homeland ,security   
determines to be necessary to satisfy   
the requirements of such program4  7,c7 

,a description of any obstacles facing  
the deployment1 installation1 and       
maintenance of tools1 capabilities1 and 
services under such program4  7,d7      
,recommendations and guidelines to help 
maintain and continuously upgrade tools1
 capabilities1 and services provided    
under such program4  7,e7               
,recommendations for using the data     
collected by such program for creating a
 common framework for data analytics1   
visualization of enterprise-wide risks1 
and real-time reporting4  7,f7          
,recommendations for future efforts and 
activities1 including for the rollout of
 new tools1 capabilities and services1  
proposed timelines for delivery1 and    
whether to continue the use of phased   
rollout plans1 related to securing      
networks1 devices1 data1 and information
 technology assets through the use of   
such program4  7#c7 ,form ,the strategy 
required under subparagraph 7,a7 shall  
be submitted in an unclassified form1   
but may contain a classified annex4  7c7

 ,report ,not later than #ij days after 
the development of the strategy required
 under subsection 7b71 the ,secretary of
 ,homeland ,security shall submit to the
 ,committee on ,homeland ,security and  
,governmental ,affairs of the ,senate   
and the ,committee on ,homeland         
,security of the ,house of              
,representative a report on             
cybersecurity risk posture based on the 
data collected through the continuous   
diagnostics and mitigation program under
 subsection 7g7 of section #bcj of the  
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #aea71 as added by subsection 
7a74