,,ii  #aaf? ,,congress  #a/ ,session    
,s4 #bcah  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,july #cj1 #bjai,mr4   
,cornyn 7= himself & ,ms4 ,hassan7      
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
  ,a ,,bill  ,to am5d ! ,homel&         
,security ,act ( #bjjb to au?orize !    
,secret>y ( ,homel& ,security to e/abli%
 a cont9u\s diagno/ics & mitigation     
program 9 ! ,cyb]security &             
,infra/ructure ,security ,ag5cy ( !     
,dep>tm5t ( ,homel& ,security1 & = o!r  
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,advanc+ ,cyb]security     
,diagno/ics & ,mitigation ,act4  #b4    
,e/abli%m5t ( cont9u\s diagno/ics &     
mitigation program 9 ! ,cyb]security &  
,infra/ructure ,security ,ag5cy  7a7 ,9 
g5]al ,section #bbac ( ! ,homel&        
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#ffc7 is am5d$ by add+ at ! end !       
foll[+3  7g7 ,cont9u\s ,diagno/ics &    
,mitigation  7#a7 ,program  7,a7 ,9     

g5]al ,! ,secret>y1 act+ ?r\gh !        
,director ( ,cyb]security &             
,infra/ructure ,security1 %all deploy1  
op]ate1 & ma9ta9 a cont9u\s diagno/ics &
 mitigation program = ag5cies4 ,"u su*  
program1 ! ,secret>y %all--  7i7 assi/  
ag5cies to cont9u\sly diagnose &        
mitigate cyb] ?reats & vuln]abilities2  
7ii7 develop & provide ! capability to  
collect1 analyze1 & visualize in=mation 
relat+ to security data & cyb]security  
risks at ag5cies2  7iii7 make program   
capabilities available = use1 ) or )\t  
reimbursem5t1 to civilian ag5cies &     
,/ate1 local1 ,tribal1 & t]ritorial     
gov]nm5ts2  7iv7 employ %>$ s]vices1    
collective pur*as+1 blanket pur*ase     
agreem5ts1 & any o!r economic or        
procurem5t models ! ,secret>y det]m9es  
appropriate to maximize ! co/s sav+s    
associat$ ) implem5t+ an in=mation      
sy/em2  7v7 assi/ entities 9 sett+      
in=mation security priorities & assess+ 
& manag+ cyb]security risks2 &  7vi7    
develop policies & proc$ures = report+  

sy/emic cyb]security risks & pot5tial   
incid5ts bas$ ^u data collect$ "u su*   
program4  7,b7 ,regul> ,improvem5t ,!   
,secret>y %all regul>ly deploy new      
te*nologies & modify exi/+ te*nologies  
to ! cont9u\s diagno/ics & mitigation   
program requir$ "u subp>agraph 7,a71 z  
appropriate1 to improve ! program4  7#b7
 ,ag5cy responsibilities ,not)/&+ any   
o!r provision ( law1 ea* ag5cy t uses ! 
cont9u\s diagno/ics & mitigation program
 "u p>agraph 7#a7 %all1 cont9u\sly & 9  
real "t1 provide to ! ,secret>y all     
in=mation1 assessm5ts1 analyses1 & raw  
data collect$ by ! program1 9 a mann]   
specifi$ by ! ,secret>y4  7#c7          
,responsibilities ( ! secret>y ,9 c>ry+ 
out ! cont9u\s diagno/ics & mitigation  
program "u p>agraph 7#a71 ! ,secret>y   
%all1 z appropriate--  7,a7 %>e )       
ag5cies relevant analysis & products    
develop$ "u su* program2  7,b7 provide  
regul> reports on cyb]security risks to 
ag5cies2 &  7,c7 provide comp>ative     
assessm5ts ( cyb]security risks =       

ag5cies4  4  7b7 ,cont9u\s ,diagno/ics &
 ,mitigation ,/rategy  7#a7 ,9 g5]al ,n 
lat] ?an #ahj days aft] ! date ( !      
enactm5t ( ?is ,act1 ! ,secret>y (      
,homel& ,security %all develop a        
compreh5sive cont9u\s diagno/ics &      
mitigation /rategy to c>ry out !        
cont9u\s diagno/ics & mitigation program
 requir$ "u subsection 7g7 ( section    
#bbac ( ! ,homel& ,security ,act ( #bjjb
 7#f ,u4,s4,c4 #ffc71 z add$ by         
subsection 7a74  7#b7 ,scope ,! /rategy 
requir$ "u p>agraph 7#a7 %all include ! 
foll[+3 7,a7 ,a description ( ! cont9u\s
 diagno/ics & mitigation program1       
includ+ ef=ts by ! ,secret>y ( ,homel&  
,security to assi/ ) ! deploym5t (      
program tools1 capabilities1 & s]vices1 
f ! inception ( ! program ref]r$ to 9   
p>agraph 7#a7 to ! date ( enactm5t ( ?is
 ,act4  7,b7 ,a description ( !         
coord9ation & fund+ requir$ to deploy1  
in/all1 & ma9ta9 ! tools1 capabilities1 
& s]vices t ! ,secret>y ( ,homel&       
,security det]m9es to be necess>y to    

satisfy ! requirem5ts ( su* program4    
7,c7 ,a description ( any ob/acles fac+ 
! deploym5t1 in/allation1 & ma9t5ance ( 
tools1 capabilities1 & s]vices "u su*   
program4  7,d7 ,recomm5dations &        
guidel9es to help ma9ta9 & cont9u\sly   
upgrade tools1 capabilities1 & s]vices  
provid$ "u su* program4  7,e7           
,recomm5dations = us+ ! data collect$ by
 su* program = creat+ a common framework
 = data analytics1 visualization (      
ent]prise-wide risks1 & real-"t report+1
 & comp>ative assessm5ts = cyb]security 
risks4  7,f7 ,recomm5dations = future   
ef=ts & activities1 includ+ = ! roll\t (
 new & em]g+ tools1 capabilities &      
s]vices1 propos$ timel9es = deliv]y1 &  
:e!r to cont9ue ! use ( phas$ roll\t    
plans1 relat$ to secur+ networks1       
devices1 data1 & in=mation & op]ational 
te*nology assets ?r\gh ! use ( su*      
program4  7#c7 ,=m ,! /rategy requir$ "u
 p>agraph 7#a7 %all be submitt$ 9 an    
unclassifi$ =m1 b may conta9 a classifi$
 annex4  7c7 ,report ,n lat] ?an #ahj   

days aft] ! developm5t ( ! /rategy      
requir$ "u subsection 7b71 ! ,secret>y (
 ,homel& ,security %all submit to !     
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate & !     
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tative a report on      
cyb]security risk po/ure bas$ on ! data 
collect$ ?r\gh ! cont9u\s diagno/ics &  
mitigation program "u subsection 7g7 (  
section #bbac ( ! ,homel& ,security ,act
 ( #bjjb 7#f ,u4,s4,c4 #ffc71 z add$ by 
subsection 7a74  7d7 ,,gao report ,n    
lat] ?an #a ye> aft] ! date ( enactm5t (
 ?is ,act1 ! ,comptroll] ,g5]al ( !     
,unit$ ,/ates %all submit a report to   
,congress on ! pot5tial impacts &       
b5efits ( replac+ ! report+ requirem5ts 
"u *apt] #ce ( title #dd1 ,unit$ ,/ates 
,code1 ) p]iodical real-"t data provid$ 
by ! cont9u\s diagno/ics & mitigation   
program "u subsection 7g7 ( section     
#bbac ( ! ,homel& ,security ,act ( #bjjb
 7#f ,u4,s4,c4 #ffc71 z add$ by         
subsection 7a74