,,ib  ,union ,calendar ,no4 #aea  #aafth
 ,,congress  #ast ,session  ,h4 ,r4     
#cgaj  ,report ,no4 #aaf-aic  ,,in ,,the
 ,,house ,,of ,,representatives  ,july  
#aa1 #bjai ,ms4 ,jackson ,lee 7for      
herself1 ,mr4 ,payne1 and ,mr4          
,langevin7 introduced the following     
bill2 which was referred to the         
,committee on ,homeland ,security       
,august #cj1 #bjai ,committed to the    
,committee of the ,whole ,house on the  
,state of the ,union and ordered to be  
printed  ,a ,,bill  ,to amend the       
,homeland ,security ,act of #bjjb to    
provide for the remediation of          
cybersecurity vulnerabilities1 and for  
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,cybersecurity 
,vulnerability ,remediation ,act4  #b4  
,cybersecurity vulnerabilities ,section 
#bbji of the ,homeland ,security ,act of
 #bjjb 7#f ,u4,s4,c4 #fei7 is amended-- 
7#a7 in subsection 7a7-- 7,a7 in        
paragraph 7#e71 by striking and after   
the semicolon at the end2  7,b7 by      

redesignating paragraph 7#f7 as         
paragraph 7#g72 and  7,c7 by inserting  
after paragraph 7#e7 the following new  
paragraph3  7#f7 the term cybersecurity 
vulnerability has the meaning given the 
term security vulnerability in section  
#ajb of the ,cybersecurity ,information 
,sharing ,act of #bjae 7#f ,u4,s4,c4    
#aeja72 and  4  7#b7 in subsection 7c7--
  7,a7 in paragraph 7#e7-- 7i7 in       
subparagraph 7,a71 by striking and after
 the semicolon at the end2  7ii7 by     
redesignating subparagraph 7,b7 as      
subparagraph 7,c72  7iii7 by inserting  
after subparagraph 7,a7 the following   
new subparagraph3  7,b7 sharing         
mitigation protocols to counter         
cybersecurity vulnerabilities pursuant  
to subsection 7n72 and  2 and  7iv7 in  
subparagraph 7,c71 as so redesignated1  
by inserting and mitigation protocols to
 counter cybersecurity vulnerabilities  
in accordance with subparagraph 7,b7    
before with ,federal2  7,b7 in paragraph
 7#g77;,c71 by striking sharing and     

inserting share2 and  7,c7 in paragraph 
7#i71 by inserting mitigation protocols 
to counter cybersecurity                
vulnerabilities1 after measures12  7#c7 
in subsection 7e77#a77;,g71 by striking 
the semicolon after and at the end2 and 
7#d7 by adding at the end the following 
new subsection3  7n7 ,protocols ,to     
counter cybersecurity vulnerabilities   
,the ,director may1 as appropriate1     
identify1 develop1 and disseminate      
actionable protocols to mitigate        
cybersecurity vulnerabilities1 including
 in circumstances in which such         
vulnerabilities exist because software  
or hardware is no longer supported by a 
vendor4  4  #c4 ,report on cybersecurity
 vulnerabilities  7a7 ,report ,not later
 than one year after the date of the    
enactment of this ,act1 the ,director of
 the ,cybersecurity and ,infrastructure 
,security ,agency of the ,department of 
,homeland ,security shall submit to the 
,committee on ,homeland ,security of the
 ,house of ,representatives and the     

,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate a 
report on how the ,agency carries out   
subsection 7m7 of section #bbji of the  
,homeland ,security ,act of #bjjb to    
coordinate vulnerability disclosures1   
including disclosures of cybersecurity  
vulnerabilities 7as such term is defined
 in such section71 and subsection 7n7 of
 such section 7as added by section #b7  
to disseminate actionable protocols to  
mitigate cybersecurity vulnerabilities1 
that includes the following3  7#a7 ,a   
description of the policies and         
procedures relating to the coordination 
of vulnerability disclosures4  7#b7 ,a  
description of the levels of activity in
 furtherance of such subsections 7m7 and
 7n7 of such section #bbji4  7#c7 ,any  
plans to make further improvements to   
how information provided pursuant to    
such subsections can be shared 7as such 
term is defined in such section #bbji7  
between the ,department and industry and
 other stakeholders4  7#d7 ,any         

available information on the degree to  
which such information was acted upon by
 industry and other stakeholders4  7#e7 
,a description of how privacy and civil 
liberties are preserved in the          
collection1 retention1 use1 and sharing 
of vulnerability disclosures4  7b7 ,form
 ,the report required under subsection  
7b7 shall be submitted in unclassified  
form but may contain a classified annex4
  #d4 ,competition relating to          
cybersecurity vulnerabilities ,the      
,under ,secretary for ,science and      
,technology of the ,department of       
,homeland ,security1 in consultation    
with the ,director of the ,cybersecurity
 and ,infrastructure ,security ,agency  
of the ,department1 may establish an    
incentive-based program that allows     
industry1 individuals1 academia1 and    
others to compete in providing          
remediation solutions for cybersecurity 
vulnerabilities 7as such term is defined
 in section #bbji of the ,homeland      
,security ,act of #bjjb1 as amended by  

section #b74  ,august #cj1 #bjai        
,committed to the ,committee of the     
,whole ,house on the ,state of the      
,union and ordered to be printed