#aafth ,,congress #ast ,session ,h4 ,r4 #cdfi ,,an ,,act ,to direct the ,transportation ,security ,administration to carry out covert testing and risk mitigation improvement of aviation security operations1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,covert ,testing and ,risk ,mitigation ,improvement ,act of #bjai4 #b4 ,,tsa covert testing and risk mitigation improvement 7a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act and annually thereafter1 the ,administrator of the ,transportation ,security ,administration shall implement the following3 7#a7 ,a system for conducting risk-informed headquarters-based covert tests of aviation security operations1 including relating to airport passenger and baggage security screening operations1 that can yield statistically valid data that can be used to identify and assess the nature and extent of vulnerabilities to such operations that are not mitigated by current security practices4 ,the ,administrator shall execute annually not fewer than three risk-informed covert testing projects designed to identify systemic vulnerabilities in the transportation security system1 and shall document the assumptions and rationale guiding the selection of such projects4 7#b7 ,a long-term headquarters-based covert testing program1 employing static but risk-informed threat vectors1 designed to assess changes in overall screening effectiveness4 7b7 ,mitigation 7#a7 ,in general ,the ,administrator of the ,transportation ,security ,administration shall establish a system to address and mitigate the vulnerabilities identified and assessed pursuant to the testing conducted under subsection 7a74 7#b7 ,analysis ,not later than #fj days after the identification of any such vulnerability1 the ,administrator shall ensure a vulnerability described in paragraph 7#a7 is analyzed to determine root causes4 7#c7 ,determination ,not later than #abj days after the identification of any such vulnerability1 the ,administrator shall make a determination regarding whether or not to mitigate such vulnerability4 ,the ,administrator shall prioritize mitigating vulnerabilities based on their ability to reduce risk4 ,if the ,administrator determines-- 7,a7 to not mitigate such vulnerability1 the ,administrator shall document the reasons for the decision2 or 7,b7 to mitigate such vulnerability1 the ,administrator shall establish and document-- 7i7 key milestones appropriate for the level of effort required to so mitigate such vulnerability2 and 7ii7 a date by which measures to so mitigate such vulnerability shall be implemented by the ,transportation ,security ,administration4 7#d7 ,retesting ,not later than #ahj days after the date on which measures to mitigate a vulnerability are completed by the ,transportation ,security ,administration pursuant to paragraph 7#c77;,b77ii71 the ,administrator shall conduct a covert test in accordance with subsection 7a7 of the aviation security operation with respect to which such vulnerability was identified to assess the effectiveness of such measures to mitigate such vulnerability4 7c7 ,compilation of lists 7#a7 ,in general ,not later than #fj days after completing a covert testing protocol under subsection 7a71 the ,administrator of the ,transportation ,security ,administration shall compile a list 7including a classified annex if necessary7 of the vulnerabilities identified and assessed pursuant to such testing4 ,each such list shall contain1 at a minimum1 the following3 7,a7 ,a brief description of the nature of each vulnerability so identified and assessed4 7,b7 ,the date on which each vulnerability was so identified and assessed4 7,c7 ,key milestones appropriate for the level of effort required to mitigate each vulnerability1 as well as an indication of whether each such milestone has been met4 7,d7 ,an indication of whether each vulnerability has been mitigated or reduced and1 if so1 the date on which each such vulnerability was so mitigated or reduced4 7,e7 ,if a vulnerability has not been fully mitigated1 the date by which the ,administrator shall so mitigate such vulnerability or a determination that it is not possible to fully mitigate such vulnerability4 7,f7 ,the results of any subsequent covert testing undertaken to assess whether mitigation efforts have eliminated or reduced each vulnerability4 7#b7 ,submission to ,congress ,the ,administrator shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate a comprehensive document tracking the status of the information required under paragraph 7#a7 together with the ,transportation ,security ,administration's annual budget request4 7d7 ,,gao review ,not later than #c years after the date of the enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall review and submit to the ,administrator of the ,transportation ,security ,administration and the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate a report on the effectiveness of the ,transportation ,security ,administration's processes for conducting covert testing projects that yield statistically valid data that can be used to assess the nature and extent of vulnerabilities to aviation security operations that are not effectively mitigated by current security operations4 ,passed the ,house of ,representatives ,december #i1 #bjai4;,clerk4