,,ii #aaf? ,,congress #a/ ,session ,s4 #ahjh ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,june #ab1 #bjai,mr4 ,g>dn] 7= himself & ,mr4 ,m>key7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,=eign ,relations ,a ,,bill ,to require ! ,secret>y ( ,/ate to design & e/abli% a ,vuln]ability ,disclosure ,process to improve ,dep>tm5t ( ,/ate cyb]security & a bug b\nty program to id5tify & report vuln]abilities ( ,int]net-fac+ in=mation te*nology ( ! ,dep>tm5t ( ,/ate1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,hack ,y\r ,/ate ,dep>tm5t ,act4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,bug b\nty program ,! t]m bug b\nty program means a program "u :i* an approv$ individual1 organization1 or company is tempor>ily au?oriz$ to id5tify & report vuln]abilities ( ,int]net-fac+ in=mation te*nology ( ! ,dep>tm5t 9 ex*ange = comp5sation4 7#b7 ,dep>tm5t ,! t]m ,dep>tm5t means ! ,dep>tm5t ( ,/ate4 7#c7 ,in=mation te*nology ,! t]m in=mation te*nology has ! mean+ giv5 su* t]m 9 section #aaaja ( title #dj1 ,unit$ ,/ates ,code4 7#d7 ,secret>y ,! t]m ,secret>y means ! ,secret>y ( ,/ate4 7#e7 ,,vdp ,! t]m ,,vdp means ! ,vuln]ability ,disclosure ,process e/abli%$ pursuant to section #c4 #c4 ,dep>tm5t ( ,/ate ,vuln]ability ,disclosure ,process 7a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y %all design1 e/abli%1 & make publicly kn[n a ,vuln]ability ,disclosure ,process to improve cyb]security )9 ! ,dep>tm5t by-- 7#a7 provid+ security rese>*]s ) cle> guidel9es =-- 7,a7 conduct+ vuln]ability discov]y activities direct$ at ,dep>tm5t in=mation te*nology2 & 7,b7 submitt+ discov]$ security vuln]abilities to ! ,dep>tm5t2 & 7#b7 creat+ ,dep>tm5t proc$ures & infra/ructure to receive & fix discov]$ vuln]abilities4 7b7 ,requirem5ts ,9 e/abli%+ ,,vdp pursuant to subsection 7a71 ! ,secret>y %all-- 7#a7 id5tify :i* ,dep>tm5t in=mation te*nology %\ld be includ$ 9 ! process2 7#b7 det]m9e :e!r ! process %\ld diff]5tiate among & specify ! types ( security vuln]abilities t may be t>get$2 7#c7 provide a readily available means ( report+ discov]$ security vuln]abilities & ! =m 9 :i* su* vuln]abilities %\ld be report$2 7#d7 id5tify :i* ,dep>tm5t (fices & positions w be responsible = receiv+1 prioritiz+1 & address+ security vuln]ability disclosure reports2 7#e7 consult ) ! ,attorney ,g5]al reg>d+ h[ to ensure t individuals1 organizations1 & companies t comply ) ! ,,vdp requirem5ts are protect$ f prosecution "u section #ajcj ( title #ah1 ,unit$ ,/ates ,code1 & simil> provisions ( law = specific activities au?oriz$ "u ,,vdp2 7#f7 consult ) ! relevant (fices at ! ,dep>tm5t ( ,def5se t 7 responsible = laun*+ ! #bjaf ,vuln]ability ,disclosure ,program1 ,hack ! ,p5tagon1 & subsequ5t ,dep>tm5t ( ,def5se bug b\nty programs2 7#g7 engage qualifi$ int]e/$ p]sons1 includ+ nongov]nm5tal sector repres5tatives1 ab\t ! /ructure ( ,,vdp1 z con/ructive & to ! ext5t practicable2 & 7#h7 aw>d contracts to entities1 z necess>y1 to manage ,,vdp & implem5t ! rem$iation ( discov]$ security vuln]abilities4 7c7 ,annual reports ,n lat] ?an #ahj days aft] ! e/abli%m5t ( ,,vdp "u subsection 7a7 & annually !reaft] = ! foll[+ #f ye>s1 ! ,secret>y %all submit a report to ! ,committee on ,=eign ,relations ( ! ,s5ate & ! ,committee on ,=eign ,affairs ( ! ,h\se ( ,repres5tatives reg>d+ ! e/abli%m5t ( ,,vdp1 includ+ in=mation relat+ to-- 7#a7 ! numb] & sev]ity1 9 accordance ) ! ,national ,vuln]abilities ,database ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 ( security vuln]abilities report$ ?r\gh ,,vdp2 7#b7 ! numb] ( previ\sly unid5tifi$ security vuln]abilities rem$iat$ z a result ( su* report+2 7#c7 ! curr5t numb] ( out/&+ previ\sly unid5tifi$ security vuln]abilities & ! ,dep>tm5t's rem$iation plans to address su* vuln]abilities2 7#d7 ! av]age p]iod betwe5 ! report+ ( security vuln]abilities & ! rem$iation ( su* vuln]abilities2 7#e7 ! res\rces1 surge /aff+1 roles1 & responsibilities )9 ! ,dep>tm5t us$ to implem5t ,,vdp & complete ! necess>y security vuln]ability rem$iation2 & 7#f7 any o!r in=mation t ! ,secret>y det]m9es to be relevant4 #d4 ,dep>tm5t ( ,/ate ,bug ,b\nty ,pilot ,program 7a7 ,e/abli%m5t ( pilot program 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y %all e/abli% a ,bug ,b\nty ,pilot ,program to m9imize security vuln]abilities ( ,int]net-fac+ in=mation te*nology ( ! ,dep>tm5t4 7#b7 ,requirem5ts ,9 e/abli%+ ! pilot program "u p>agraph 7#a71 ! ,secret>y %all-- 7,a7 provide comp5sation = reports ( previ\sly unid5tifi$ security vuln]abilities )9 ! websites1 applications1 & o!r ,int]net-fac+ in=mation te*nology ( ! ,dep>tm5t t are accessible to ! public2 7,b7 aw>d contracts to entities1 z necess>y1 to manage ! pilot program & = execut+ ! rem$iation ( security vuln]abilities id5tifi$ pursuant to subp>agraph 7,a72 7,c7 id5tify :i* ,dep>tm5t in=mation te*nology %\ld be includ$ 9 ! pilot program2 7,d7 consult ) ! ,attorney ,g5]al on h[ to ensure t individuals1 organizations1 or companies t comply ) ! requirem5ts ( ! pilot program are protect$ f prosecution "u section #ajcj ( title #ah1 ,unit$ ,/ates ,code1 & simil> provisions ( law = specific activities au?oriz$ "u ! pilot program2 7,e7 consult ) ! relevant (fices at ! ,dep>tm5t ( ,def5se t 7 responsible = laun*+ ! #bjaf ,hack ! ,p5tagon pilot program & subsequ5t ,dep>tm5t ( ,def5se bug b\nty programs2 7,f7 develop a process by :i* an approv$ individual1 organization1 or company c-- 7i7 regi/] ) entities ref]r$ to 9 subp>agraph 7,b72 7ii7 submit to a backgr\nd *eck1 z det]m9$ by ! ,dep>tm5t2 & 7iii7 receive a det]m9ation z to eligibility = p>ticipation 9 ! pilot program2 7,g7 engage qualifi$ int]e/$ p]sons1 includ+ nongov]nm5tal sector repres5tatives1 ab\t ! /ructure ( ! pilot program1 z con/ructive & to ! ext5t practicable2 & 7,h7 consult ) relevant ,unit$ ,/ates ,gov]nm5t (ficials to ensure t ! pilot program complem5ts p]si/5t network & vuln]ability scans ( ! ,dep>tm5t's ,int]net-accessible sy/ems1 su* z ! scans conduct$ pursuant to ,b9d+ ,op]ational ,directive #ae-ja1 issu$ by ! ,secret>y ( ,homel& ,security on ,may #ba1 #bjae4 7#c7 ,duration ,! pilot program e/abli%$ "u p>agraph 7#a7 %\ld be t]m9at$ n lat] ?an #a ye> aft] ! date on :i* x is e/abli%$4 7b7 ,report ,n lat] ?an #ahj days aft] ! completion ( ! ,bug ,b\nty ,pilot ,program "u subsection 7a71 ! ,secret>y %all submit a report to ! ,committee on ,=eign ,relations ( ! ,s5ate & ! ,committee on ,=eign ,affairs ( ! ,h\se ( ,repres5tatives t describes ! pilot program1 includ+ in=mation reg>d+-- 7#a7 ! numb] ( approv$ individuals1 organizations1 or companies involv$ 9 ! pilot program1 brok5 d[n by-- 7,a7 ! numb] ( approv$ individuals1 organizations1 or companies t regi/]$ = ! pilot program2 7,b7 ! numb] ( su* entities t 7 approv$ to p>ticipate 9 ! pilot program2 7,c7 ! numb] ( su* entities t submitt$ security vuln]abilities "u ! pilot program2 & 7,d7 ! numb] ( su* entities t receiv$ comp5sation "u ! pilot program2 7#b7 ! numb] & sev]ity1 9 accordance ) ! ,national ,vuln]abilities ,database ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 ( security vuln]abilities report$ "u ! pilot program2 7#c7 ! numb] ( previ\sly unid5tifi$ security vuln]abilities rem$iat$ z a result ( ! pilot program2 7#d7 ! curr5t numb] ( out/&+ previ\sly unid5tifi$ security vuln]abilities & ! ,dep>tm5t's plans = rem$iat+ su* vuln]abilities2 7#e7 ! av]age p]iod betwe5 ! report+ ( security vuln]abilities & ! rem$iation ( su* vuln]abilities2 7#f7 ! types ( comp5sation provid$ "u ! pilot program2 & 7#g7 ! lessons le>n$ f ! pilot program4