,i  #aaf? ,,congress  #b;d ,session  ,h4
 ,r4 #efhj  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,janu>y #bg1 #bjbj,mr4
 ,langev9 7= himself1 ,mr4 ,katko1 ,mr4 
,ri*mond1 ,mr4 ,?ompson ( ,mississippi1 
& ,ms4 ,jackson ,lee7 introduc$ ! foll[+
 bill2 :i* 0 ref]r$ to ! ,committee on  
,homel& ,security  ,a ,,bill  ,to am5d !
 ,homel& ,security ,act ( #bjjb to      
protect ,unit$ ,/ates critical          
infra/ructure by ensur+ t !             
,cyb]security & ,infra/ructure ,security
 ,ag5cy ( ! ,dep>tm5t ( ,homel&         
,security has necess>y legal tools to   
notify entities at risk ( cyb]security  
vuln]abilities 9 ! ent]prise devices or 
sy/ems t control critical assets ( !    
,unit$ ,/ates1 & = o!r purposes4  #a4   
,%ort title ,?is ,act may be cit$ z !   
,cyb]security ,vuln]ability             
,id5tification & ,notification ,act (   
#bjbj4  #b4 ,subpo5a au?ority  7a7 ,9   
g5]al ,section #bbji ( ! ,homel&        
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#fei7 is am5d$--  7#a7 9 subsection     

7a7-- 7,a7 9 ?is subsection1 by ins]t+ 1
 cyb]security purpose1 aft] cyb] ?reat  
indicator2  7,b7 by r$esignat+ p>agraphs
 7#c7 ?r\gh 7#f7 z p>agraphs 7#d7 ?r\gh 
7#g71 respectively2  7,c7 by ins]t+ aft]
 ?is subsection ! foll[+ new p>agraph3  
7#c7 ! t]m ent]prise device or sy/em--  
7,a7 means a device or in=mation sy/em  
commonly us$ to p]=m indu/rial1         
comm]cial1 sci5tific1 or gov]nm5tal     
functions or processes t relate to      
critical infra/ructure1 includ+         
op]ational & indu/rial control sy/ems1  
di/ribut$ control sy/ems1 & programmable
 logic controll]s2 &  7,b7 does n       
include p]sonal devices & sy/ems1 su* z 
consum] mobile devices1 home comput]s1  
resid5tial wireless r\t]s1 or resid5tial
 int]net-enabl$ consum] devices2  2 &   
7,d7 9 p>agraph 7#f71 z s r$esignat$1 by
 /rik+ t]m in=mation sy/em has ! mean+  
giv5 t t]m 9 section #cejb7h7 ( title   
#dd2 & & ins]t+ t]ms in=mation sy/em &  
security vuln]ability h ! mean+s giv5 ^?
 t]ms 9 section #ajb ( ! ,cyb]security  

,in=mation ,%>+ ,act ( #bjae 7#f        
,u4,s4,c4 #aeja722  7#b7 9 subsection   
7c7-- 7,a7 9 p>agraph 7#h77;,c71 by     
/rik+ %>+ & ins]t+ %>e2  7,b7 9 p>agraph
 7#aj71 by /rik+ & aft] ! semicolon at !
 end2  7,c7 9 p>agraph 7#aa71 by /rik+ !
 p]iod at ! end & ins]t+ 2 &2 &  7,d7 by
 add+ at ! end ! foll[+ new p>agraph3   
7#ab7 detect+1 id5tify+1 & receiv+      
in=mation ab\t security vuln]abilities  
relat+ to in=mation sy/ems = a          
cyb]security purpose4  2 &  7#c7 by add+
 at ! end ! foll[+ new subsection3  7n7 
,subpo5a au?ority  7#a7 ,9 g5]al ,if !  
,director id5tifies an in=mation sy/em  
connect$ to ! int]net ) a specific      
security vuln]ability & has reason to   
believe t ! security vuln]ability       
relates to critical infra/ructure &     
affects an ent]prise device or sy/em (  
an entity1 & ! ,director made reasonable
 ef=ts to id5tify ! entity at risk b 0  
unable to d s1 ! ,director may issue a  
subpo5a = ! production ( in=mation      
necess>y to id5tify & notify ! entity at

 risk1 9 ord] to c>ry out a cyb]security
 purpose4  7#b7 ,limit on in=mation ,a  
subpo5a issu$ "u ?is subsection may only
 seek in=mation 9 ! categories set =? 9 
subp>agraphs 7,a71 7,b71 7,d71 & 7,e7 ( 
section #bgjc7;c77#b7 ( title #ah1      
,unit$ ,/ates ,code4  7#c7 ,liability   
protections = disclos+ provid]s ,!      
provisions ( section #bgjc7;e7 ( title  
#ah1 ,unit$ ,/ates ,code1 %all apply to 
any subpo5a issu$ "u ?is subsection4    
7#d7 ,coord9ation  7,a7 ,9 g5]al ,n lat]
 ?an #fj days aft] ! date ( ! enactm5t (
 ?is subsection1 ! ,director1 9         
coord9ation ) ! ,attorney ,g5]al1 %all  
develop int]-ag5cy proc$ures reg>d+ !   
issuance ( subpo5as "u ?is subsection 9 
ord] to avoid int]f]5ce ) ongo+ law     
en=cem5t inve/igations4 ,to ! ext5t     
practicable1 ! ,director %all coord9ate 
su* issuances ) ! ,dep>tm5t ( ,ju/ice1  
includ+ ! ,f$]al ,bureau (              
,inve/igation1 pursuant to su*          
proc$ures4  7,b7 ,cont5ts ,! int]-ag5cy 
proc$ures develop$ "u ?is p>agraph %all 

provide t a subpo5a issu$ by ! ,director
 "u ?is subsection %all be--  7i7 issu$ 
solely 9 ord] to c>ry out a cyb]security
 purpose2 &  7ii7 subject to !          
limitations "u ?is subsection4  7#e7    
,noncompliance ,if any p]son1 p>tn]%ip1 
corporation1 association1 or entity     
fails to comply ) any duly s]v$ subpo5a 
issu$ "u ?is subsection1 ! ,director may
 reque/ t ! ,attorney ,g5]al seek       
en=cem5t ( ! subpo5a 9 any judicial     
di/rict 9 :i* su* p]son1 p>tn]%ip1      
corporation1 association1 or entity     
resides1 is f\nd1 or transacts bus9ess4 
7#f7 ,notice ,n lat] ?an sev5 days aft] 
! date on :i* ! ,director receives      
in=mation obta9$ ?r\gh a subpo5a issu$  
"u ?is subsection1 ! ,director %all     
notify ! entity at risk id5tifi$ by     
in=mation obta9$ "u ! subpo5a reg>d+ !  
subpo5a & ! id5tifi$ security           
vuln]ability4  7#g7 ,au!ntication ,any  
subpo5a issu$ by ! ,director "u ?is     
subsection %all be au!nticat$ by !      
electronic signature ( an au?oriz$      

repres5tative ( ! ,ag5cy or o!r         
comp>able symbol or process id5tify+ !  
,ag5cy z ! s\rce ( ! subpo5a4  7#h7     
,proc$ures  7,a7 ,9 g5]al ,n lat] ?an   
#ij days aft] ! date ( enactm5t ( ?is   
subsection1 ! ,director %all e/abli%    
int]nal proc$ures & associat$ tra9+1    
applicable to employees & op]ations ( ! 
,ag5cy1 reg>d+ subpo5as issu$ "u ?is    
subsection1 :i* %all address ! foll[+3  
7i7 ,! protection ( & re/riction on     
dissem9ation ( nonpublic in=mation      
obta9$ ?r\gh su* a subpo5a1 includ+ a   
requirem5t t ! ,ag5cy may n dissem9ate  
nonpublic in=mation obta9$ ?r\gh su* a  
subpo5a t id5tifies ! p>ty t is subject 
to su* a subpo5a or ! entity at risk    
id5tifi$ by in=mation obta9$ z a result 
( su* a subpo5a1 unless--  7,i7 ! p>ty  
or entity cons5ts2 or  7,,ii7 ! ,ag5cy  
id5tifies or is notifi$ ( a cyb]security
 incid5t involv+ ! p>ty or entity1 :i*  
relates to ! security vuln]ability :i*  
l$ to ! issuance ( su* a subpo5a4  7ii7 
,! re/riction on ! use ( in=mation      

obta9$ ?r\gh ! subpo5a = a cyb]security 
purpose4  7iii7 ,! ret5tion & de/ruction
 ( nonpublic in=mation obta9$ ?r\gh su* 
a subpo5a1 includ+ ! foll[+3  7,i7      
,imm$iate de/ruction ( in=mation obta9$ 
?r\gh su* a subpo5a t ! ,director       
det]m9es is unrelat$ to critical        
infra/ructure4  7,,ii7 ,de/ruction ( any
 p]sonally id5tifiable in=mation n lat] 
?an six mon?s aft] ! date on :i* !      
,director receives in=mation obta9$     
?r\gh su* a subpo5a1 unless o!rwise     
agre$ to by ! individual s id5tifi$4    
7iv7 ,! process = recordkeep+ reg>d+    
ef=ts ref]r$ to 9 p>agraph 7#a7 und]tak5
 prior to ! issuance ( su* a subpo5a4   
7v7 ,! process = track+ engagem5t ) ea* 
p>ty t is subject to su* a subpo5a & !  
entity at risk id5tifi$ by in=mation    
obta9$ pursuant to su* a subpo5a4  7vi7 
,! process = provid+ notice to ea* p>ty 
t is subject to su* a subpo5a & ea*     
entity at risk id5tifi$ by in=mation    
obta9$ pursuant to su* a subpo5a4  7vii7
 ,! process & crit]ia = conduct+        

critical infra/ructure security risk    
assessm5ts to det]m9e :e!r a subpo5a is 
necess>y prior to be+ s issu$4  7,b7    
,congressional notification ,! ,director
 %all brief ! ,committee on ,homel&     
,security ( ! ,h\se ( ,repres5tatives & 
! ,committee on ,homel& ,security &     
,gov]nm5tal ,affairs ( ! ,s5ate ^u      
e/abli%m5t ( int]nal proc$ures &        
associat$ tra9+ requir$ "u ?is          
subsection4  7#i7 ,review ( proc$ures ,n
 lat] ?an "o ye> aft] ! date ( enactm5t 
( ?is subsection1 ! ,privacy ,(fic] ( ! 
,ag5cy1 9 consultation ) ! ,privacy     
,(fic] ( ! ,dep>tm5t1 %all--  7,a7      
review ! int]nal proc$ures & associat$  
tra9+ e/abli%$ by ! ,director "u        
p>agraph 7#h7 to ensure t--  7i7 !      
proc$ures & tra9+ are consi/5t ) fair   
in=mation practices2 &  7ii7 ! op]ations
 ( ! ,ag5cy comply ) ! proc$ures &      
tra9+2 &  7,b7 notify ! ,committee on   
,homel& ,security ( ! ,h\se (           
,repres5tatives & ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs

 ( ! ,s5ate ( ! results ( su* review4   
7#aj7 ,res\rce assessm5t ,n lat] ?an    
#abj days aft] ! date ( ! enactm5t ( ?is
 subsection1 ! ,director %all submit to 
! ,committee on ,homel& ,security ( !   
,h\se ( ,repres5tatives & ! ,committee  
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate an assessm5t reg>d+ 
:e!r additional res\rces are requir$    
to--  7,a7  7i7 ensure timely           
notifications to entities at risk       
pursuant to p>agraph 7#f72 &  7ii7      
provide su* entities at risk ) timely   
support to mitigate security            
vuln]abilities2 &  7,b7 provide         
associat$ tra9+ applicable to employees 
& op]ations ( ! ,ag5cy to comply )      
int]nal proc$ures e/abli%$ pursuant to  
p>agraph 7#h74  7#aa7 ,publication (    
in=mation ,n lat] ?an #abj days aft]    
e/abli%+ ! int]nal proc$ures & policies 
"u p>agraph 7#h71 ! ,director %all make 
publicly available1 includ+ on a        
,dep>tm5t website1 in=mation reg>d+ !   
subpo5a process "u ?is subsection1      

includ+ reg>d+ ! foll[+3  7,a7 ,!       
purpose = subpo5as issu$ "u ?is         
subsection4  7,b7 ,! subpo5a process4   
7,c7 ,! crit]ia = ! critical            
infra/ructure security risk assessm5t   
conduct$ prior to issu+ a subpo5a4  7,d7
 ,policies & proc$ures on ret5tion & %>+
 ( data obta9$ by a subpo5a4  7,e7 ,!   
process = provid+ notice to ea* entity  
at risk id5tifi$ by in=mation obta9$    
pursuant to a subpo5a issu$ "u ?is      
subsection1 & contact in=mation t su* an
 entity may use to confirm ! au!nticity 
( su* notice4  7,f7 ,guidel9es on h[    
entities at risk contact$ by ! ,director
 may respond to notice ( a subpo5a4     
7,g7 ,! int]nal proc$ures ( ! ,ag5cy    
e/abli%$ pursuant to p>agraph 7#h74     
7#ab7 ,annual reports ,n lat] ?an six   
mon?s aft] ! e/abli%m5t ( ! int]nal     
proc$ures & associat$ tra9+ pursuant to 
p>agraph 7#h7 & annually !reaft]1 !     
,director %all submit to ! ,committee on
 ,homel& ,security & ,gov]nm5tal        
,affairs ( ! ,s5ate & ! ,committee on   

,homel& ,security ( ! ,h\se (           
,repres5tatives a report 7:i* may       
include a classifi$ annex b ) !         
presumption ( declassification7 on ! use
 ( subpo5as "u ?is subsection by !      
,director1 :i* %all include ! foll[+3   
7,a7 ,a discussion ( ! foll[+3 7i7 ,!   
effectiv5ess ( ! use ( subpo5as to      
mitigate security vuln]abilities4  7ii7 
,! critical infra/ructure security risk 
assessm5t process conduct$ = subpo5as   
issu$ "u ?is subsection4  7iii7 ,! numb]
 ( subpo5as issu$ "u ?is subsection by !
 ,director dur+ ! prec$+ ye>4  7iv7 ,to 
! ext5t practicable1 ! numb] ( vuln]able
 ent]prise devices or sy/ems mitigat$ "u
 ?is subsection by ! ,ag5cy dur+ !      
prec$+ ye>4  7v7 ,! numb] ( entities    
notifi$ by ! ,director "u ?is           
subsection1 & _! responses1 dur+ !      
prec$+ ye>4  7,b7 ,= ea* subpo5a issu$  
"u ?is subsection1 ! foll[+3 7i7 ,!     
s\rce ( ! security vuln]ability at issue
 detect$1 id5tifi$1 or receiv$ by !     
,director4  7ii7 ,a description ( !     

ef=ts und]tak5 to id5tify ! entity at   
risk prior to issu+ ea* su* subpo5a4    
7iii7 ,a description ( ! outcome ( ea*  
su* subpo5a1 includ+ discussion reg>d+ !
 resolution or mitigation ( ! security  
vuln]ability at issue4  7iv7 ,a         
description ( any additional support    
provid$ by ! ,director to ! entity at   
risk4  7#ac7 ,publication ( ! annual    
reports ,! ,director %all make publicly 
available a v]sion ( ea* annual report  
requir$ "u p>agraph 7#ab71 :i* %all at a
 m9imum include ! f9d+s describ$ 9      
clause 7iii71 7iv71 & 7v7 ( ?is         
subsection ( su* p>agraph4  7#ad7 ,,dhs 
,inspector ,g5]al report ,n lat] ?an "o 
ye> aft] ! date ( ! enactm5t ( ?is      
subsection1 ! ,inspector ,g5]al ( !     
,dep>tm5t %all submit to ! ,committee on
 ,homel& ,security ( ! ,h\se (          
,repres5tatives & ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate a report evaluat+ ! ,ag5cy's
 compliance ) ! foll[+3  7,a7 ,!        
int]-ag5cy proc$ures e/abli%$ "u        

p>agraph 7#d74  7,b7 ,! int]nal         
proc$ures & associat$ tra9+ e/abli%$    
pursuant to p>agraph 7#h74  4