,,ii  #aaeth ,,congress  #b;d ,session  
,s4 #cgjg  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,december #e1  
#bjah,mr4 ,portman 7for himself and ,ms4
 ,hassan7 introduced the following bill2
 which was read twice and referred to   
the ,committee on ,homeland ,security   
and ,governmental ,affairs  ,a ,,bill   
,to direct the ,secretary of ,homeland  
,security to establish a vulnerability  
disclosure policy for ,department of    
,homeland ,security internet websites1  
and for other purposes4  #a4 ,short     
title ,this ,act may be cited as the    
,public-,private ,cybersecurity         
,cooperation ,act4  #b4 ,department of  
,homeland ,security disclosure of       
security vulnerabilities  7a7           
,definitions ,in this section3  7#a7    
,appropriate information system ,the    
term appropriate information system     
means an information system that the    
,secretary of ,homeland ,security       
selects for inclusion under the         
vulnerability disclosure policy required

 by subsection 7b74  7#b7 ,department   
,the term ,department means the         
,department of ,homeland ,security4     
7#c7 ,information system ,the term      
information system has the meaning given
 that term by section #cejb7ab7 of title
 #dd1 ,united ,states ,code4  7#d7      
,secretary ,the term ,secretary means   
the ,secretary of ,homeland ,security4  
7#e7 ,security vulnerability ,the term  
security vulnerability has the meaning  
given that term in section #ajb7ag7 of  
the ,cybersecurity ,information ,sharing
 ,act of #bjae 7#f ,u4,s4,c4 #aeja7ag771
 in information technology4  7b7        
,vulnerability disclosure policy ,the   
,secretary shall establish a policy     
applicable to individuals1              
organizations1 and companies that report
 security vulnerabilities on appropriate
 information systems of ,department4    
,such policy shall include each of the  
following3  7#a7 ,the appropriate       
information systems of the ,department  
that individuals1 organizations1 and    

companies may use to discover and report
 security vulnerabilities on appropriate
 information systems4  7#b7 ,the        
conditions and criteria under which     
individuals1 organizations1 and         
companies may operate to discover and   
report security vulnerabilities4  7#c7  
,how individuals1 organizations1 and    
companies may disclose to the           
,department security vulnerabilities    
discovered on appropriate information   
systems of the ,department4  7#d7 ,the  
ways in which the ,department may       
communicate with individuals1           
organizations1 and companies that report
 security vulnerabilities4  7#e7 ,the   
process the ,department shall use for   
public disclosure of reported security  
vulnerabilities4  7c7 ,remediation      
process ,the ,secretary shall develop a 
process for the ,department to address  
the mitigation or remediation of the    
security vulnerabilities reported       
through the policy developed in         
subsection 7b74  7d7 ,consultation  7#a7

 ,in general ,in developing the security
 vulnerability disclosure policy under  
subsection 7b71 the ,secretary shall    
consult with each of the following3     
7,a7 ,the ,attorney ,general regarding  
how to ensure that individuals1         
organizations1 and companies that comply
 with the requirements of the policy    
developed under subsection 7b7 are      
protected from prosecution under section
 #ajcj of title #ah1 ,united ,states    
,code1 civil lawsuits1 and similar      
provisions of law with respect to       
specific activities authorized under the
 policy4  7,b7 ,the ,secretary of       
,defense and the ,administrator of      
,general ,services regarding lessons    
that may be applied from existing       
vulnerability disclosure policies4  7,c7
 ,non-governmental security researchers4
  7#b7 ,nonapplicability of ,,faca ,the 
,federal ,advisory ,committee ,act 7#e  
,u4,s4,c4 ,app47 shall not apply to any 
consultation under this section4  7e7   
,public availability ,the ,secretary    

shall make the policy developed under   
subsection 7b7 publicly available4  7f7 
,submission to ,congress  7#a7          
,disclosure policy and remediation      
process ,not later than #ij days after  
the date of enactment of this ,act1 the 
,secretary shall submit to ,congress a  
copy of the policy required under       
subsection 7b7 and the remediation      
process required under subsection 7c74  
7#b7 ,report and briefing  7,a7 ,report 
,not later than #a year after           
establishing the policy required under  
subsection 7b71 the ,secretary shall    
submit to ,congress a report on such    
policy and the remediation process      
required under subsection 7c74  7,b7    
,annual briefings ,one year after the   
date of the submission of the report    
under subparagraph 7,a71 and annually   
thereafter for each of the next #c      
years1 the ,secretary shall provide to  
,congress a briefing on the policy      
required under subsection 7b7 and the   
process required under subsection 7c74  

7,c7 ,matters for inclusion ,the report 
required under subparagraph 7,a7 and the
 briefings required under subparagraph  
7,b7 shall include each of the following
 with respect to the policy required    
under subsection 7b7 and the process    
required under subsection 7c7 for the   
period covered by the report or         
briefing1 as the case may be3  7i7 ,the 
number of unique security               
vulnerabilities reported4  7ii7 ,the    
number of previously unknown security   
vulnerabilities mitigated or remediated4
  7iii7 ,the number of unique           
individuals1 organizations1 and         
companies that reported security        
vulnerabilities4  7iv7 ,the average     
length of time between the reporting of 
security vulnerabilities and mitigation 
or remediation of such vulnerabilities4