,,ii  #aafth ,,congress  #ast ,session  
,s4 #bcah  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,july #cj1     
#bjai,mr4 ,cornyn 7for himself and ,ms4 
,hassan7 introduced the following bill2 
which was read twice and referred to the
 ,committee on ,homeland ,security and  
,governmental ,affairs  ,a ,,bill  ,to  
amend the ,homeland ,security ,act of   
#bjjb to authorize the ,secretary of    
,homeland ,security to establish a      
continuous diagnostics and mitigation   
program in the ,cybersecurity and       
,infrastructure ,security ,agency of the
 ,department of ,homeland ,security1 and
 for other purposes4  #a4 ,short title  
,this ,act may be cited as the          
,advancing ,cybersecurity ,diagnostics  
and ,mitigation ,act4  #b4              
,establishment of continuous diagnostics
 and mitigation program in the          
,cybersecurity and ,infrastructure      
,security ,agency  7a7 ,in general      
,section #bbac of the ,homeland         
,security ,act of #bjjb 7#f ,u4,s4,c4   

#ffc7 is amended by adding at the end   
the following3  7g7 ,continuous         
,diagnostics and ,mitigation  7#a7      
,program  7,a7 ,in general ,the         
,secretary1 acting through the ,director
 of ,cybersecurity and ,infrastructure  
,security1 shall deploy1 operate1 and   
maintain a continuous diagnostics and   
mitigation program for agencies4 ,under 
such program1 the ,secretary shall--    
7i7 assist agencies to continuously     
diagnose and mitigate cyber threats and 
vulnerabilities2  7ii7 develop and      
provide the capability to collect1      
analyze1 and visualize information      
relating to security data and           
cybersecurity risks at agencies2  7iii7 
make program capabilities available for 
use1 with or without reimbursement1 to  
civilian agencies and ,state1 local1    
,tribal1 and territorial governments2   
7iv7 employ shared services1 collective 
purchasing1 blanket purchase agreements1
 and any other economic or procurement  
models the ,secretary determines        

appropriate to maximize the costs       
savings associated with implementing an 
information system2  7v7 assist entities
 in setting information security        
priorities and assessing and managing   
cybersecurity risks2 and  7vi7 develop  
policies and procedures for reporting   
systemic cybersecurity risks and        
potential incidents based upon data     
collected under such program4  7,b7     
,regular ,improvement ,the ,secretary   
shall regularly deploy new technologies 
and modify existing technologies to the 
continuous diagnostics and mitigation   
program required under subparagraph     
7,a71 as appropriate1 to improve the    
program4  7#b7 ,agency responsibilities 
,notwithstanding any other provision of 
law1 each agency that uses the          
continuous diagnostics and mitigation   
program under paragraph 7#a7 shall1     
continuously and in real time1 provide  
to the ,secretary all information1      
assessments1 analyses1 and raw data     
collected by the program1 in a manner   

specified by the ,secretary4  7#c7      
,responsibilities of the secretary ,in  
carrying out the continuous diagnostics 
and mitigation program under paragraph  
7#a71 the ,secretary shall1 as          
appropriate--  7,a7 share with agencies 
relevant analysis and products developed
 under such program2  7,b7 provide      
regular reports on cybersecurity risks  
to agencies2 and  7,c7 provide          
comparative assessments of cybersecurity
 risks for agencies4  4  7b7 ,continuous
 ,diagnostics and ,mitigation ,strategy 
7#a7 ,in general ,not later than #ahj   
days after the date of the enactment of 
this ,act1 the ,secretary of ,homeland  
,security shall develop a comprehensive 
continuous diagnostics and mitigation   
strategy to carry out the continuous    
diagnostics and mitigation program      
required under subsection 7g7 of section
 #bbac of the ,homeland ,security ,act  
of #bjjb 7#f ,u4,s4,c4 #ffc71 as added  
by subsection 7a74  7#b7 ,scope ,the    
strategy required under paragraph 7#a7  

shall include the following3 7,a7 ,a    
description of the continuous           
diagnostics and mitigation program1     
including efforts by the ,secretary of  
,homeland ,security to assist with the  
deployment of program tools1            
capabilities1 and services1 from the    
inception of the program referred to in 
paragraph 7#a7 to the date of enactment 
of this ,act4  7,b7 ,a description of   
the coordination and funding required to
 deploy1 install1 and maintain the      
tools1 capabilities1 and services that  
the ,secretary of ,homeland ,security   
determines to be necessary to satisfy   
the requirements of such program4  7,c7 
,a description of any obstacles facing  
the deployment1 installation1 and       
maintenance of tools1 capabilities1 and 
services under such program4  7,d7      
,recommendations and guidelines to help 
maintain and continuously upgrade tools1
 capabilities1 and services provided    
under such program4  7,e7               
,recommendations for using the data     

collected by such program for creating a
 common framework for data analytics1   
visualization of enterprise-wide risks1 
and real-time reporting1 and comparative
 assessments for cybersecurity risks4   
7,f7 ,recommendations for future efforts
 and activities1 including for the      
rollout of new and emerging tools1      
capabilities and services1 proposed     
timelines for delivery1 and whether to  
continue the use of phased rollout      
plans1 related to securing networks1    
devices1 data1 and information and      
operational technology assets through   
the use of such program4  7#c7 ,form    
,the strategy required under paragraph  
7#a7 shall be submitted in an           
unclassified form1 but may contain a    
classified annex4  7c7 ,report ,not     
later than #ahj days after the          
development of the strategy required    
under subsection 7b71 the ,secretary of 
,homeland ,security shall submit to the 
,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate   

and the ,committee on ,homeland         
,security of the ,house of              
,representative a report on             
cybersecurity risk posture based on the 
data collected through the continuous   
diagnostics and mitigation program under
 subsection 7g7 of section #bbac of the 
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #ffc71 as added by subsection 
7a74  7d7 ,,gao report ,not later than  
#a year after the date of enactment of  
this ,act1 the ,comptroller ,general of 
the ,united ,states shall submit a      
report to ,congress on the potential    
impacts and benefits of replacing the   
reporting requirements under chapter #ce
 of title #dd1 ,united ,states ,code1   
with periodical real-time data provided 
by the continuous diagnostics and       
mitigation program under subsection 7g7 
of section #bbac of the ,homeland       
,security ,act of #bjjb 7#f ,u4,s4,c4   
#ffc71 as added by subsection 7a74