,i  #aag? ,,congress  #a/ ,session  ,h4 
,r4 #ccac  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,may #ah1 #bjba,mr4   
,lieu 7= himself1 ,ms4 ,spanb]g]1 ,mr4  
,pflug]1 & ,ms4 ,t5ney7 introduc$ !     
foll[+ bill2 :i* 0 ref]r$ to !          
,committee on ,=eign ,affairs  ,a ,,bill
  ,to require ! ,secret>y ( ,/ate to    
design & e/abli% a ,vuln]ability        
,disclosure ,process 7,,vdp7 to improve 
,dep>tm5t ( ,/ate cyb]security & a bug  
b\nty program to id5tify & report       
vuln]abilities ( int]net-fac+ in=mation 
te*nology ( ! ,dep>tm5t ( ,/ate1 & = o!r
 purposes4  #a4 ,%ort title ,?is ,act   
may be cit$ z ! ,hack ,y\r ,/ate        
,dep>tm5t ,act4  #b4 ,def9itions ,9 ?is 
,act3 7#a7 ,bug b\nty program ,! t]m bug
 b\nty program means a program "u :i* an
 approv$ individual1 organization1 or   
company is tempor>ily au?oriz$ to       
id5tify & report vuln]abilities (       
int]net-fac+ in=mation te*nology ( !    
,dep>tm5t 9 ex*ange = comp5sation4  7#b7
 ,dep>tm5t ,! t]m ,dep>tm5t means !     

,dep>tm5t ( ,/ate4  7#c7 ,in=mation     
te*nology ,! t]m in=mation te*nology has
 ! mean+ giv5 su* t]m 9 section #aaaja (
 title #dj1 ,unit$ ,/ates ,code4  7#d7  
,secret>y ,! t]m ,secret>y means !      
,secret>y ( ,/ate4  #c4 ,dep>tm5t (     
,/ate ,vuln]ability ,disclosure ,process
  7a7 ,9 g5]al ,n lat] ?an #ahj days    
aft] ! date ( ! enactm5t ( ?is ,act1 !  
,secret>y %all design1 e/abli%1 & make  
publicly kn[n a ,vuln]ability           
,disclosure ,process 7,,vdp7 to improve 
,dep>tm5t cyb]security by-- 7#a7 provid+
 security rese>*]s ) cle> guidel9es =-- 
7,a7 conduct+ vuln]ability discov]y     
activities direct$ at ,dep>tm5t         
in=mation te*nology2 &  7,b7 submitt+   
discov]$ security vuln]abilities to !   
,dep>tm5t2 &  7#b7 creat+ ,dep>tm5t     
proc$ures & infra/ructure to receive &  
fix discov]$ vuln]abilities4  7b7       
,requirem5ts ,9 e/abli%+ ! ,,vdp        
pursuant to p>agraph 7#a71 ! ,secret>y  
%all-- 7#a7 id5tify :i* ,dep>tm5t       
in=mation te*nology %\ld be includ$ 9 ! 

process2  7#b7 det]m9e :e!r ! process   
%\ld diff]5tiate among & specify ! types
 ( security vuln]abilities t may be     
t>get$2  7#c7 provide a readily         
available means ( report+ discov]$      
security vuln]abilities & ! =m 9 :i* su*
 vuln]abilities %\ld be report$2  7#d7  
id5tify :i* ,dep>tm5t (fices & positions
 w be responsible = receiv+1 prioritiz+1
 & address+ security vuln]ability       
disclosure reports2  7#e7 consult ) !   
,attorney ,g5]al reg>d+ h[ to ensure t  
individuals1 organizations1 & companies 
t comply ) ! requirem5ts ( ! process are
 protect$ f prosecution "u section #ajcj
 ( title #ah1 ,unit$ ,/ates ,code1 &    
simil> provisions ( law = specific      
activities au?oriz$ "u ! process2  7#f7 
consult ) ! relevant (fices at !        
,dep>tm5t ( ,def5se t 7 responsible =   
laun*+ ! #bjaf ,vuln]ability ,disclosure
 ,program1 ,hack ! ,p5tagon1 & subsequ5t
 ,dep>tm5t ( ,def5se bug b\nty programs2
  7#g7 engage qualifi$ int]e/$ p]sons1  
includ+ nongov]nm5tal sector            

repres5tatives1 ab\t ! /ructure ( !     
process z con/ructive & to ! ext5t      
practicable2 &  7#h7 aw>d contracts to  
entities1 z necess>y1 to manage !       
process & implem5t ! rem$iation (       
discov]$ security vuln]abilities4  7c7  
,annual reports ,n lat] ?an #ahj days   
aft] ! e/abli%m5t ( ! ,,vdp "u          
subsection 7a7 & annually !reaft] = !   
next six ye>s1 ! ,secret>y ( ,/ate %all 
submit to ! ,committee on ,=eign        
,affairs ( ! ,h\se ( ,repres5tatives & !
 ,committee on ,=eign ,relations ( !    
,s5ate a report on ! ,,vdp1 includ+     
in=mation relat+ to ! foll[+3 7#a7 ,!   
numb] & sev]ity ( all security          
vuln]abilities report$4  7#b7 ,! numb] (
 previ\sly unid5tifi$ security          
vuln]abilities rem$iat$ z a result4     
7#c7 ,! curr5t numb] ( out/&+ previ\sly 
unid5tifi$ security vuln]abilities &    
,dep>tm5t ( ,/ate rem$iation plans4     
7#d7 ,! av]age l5g? ( "t betwe5 !       
report+ ( security vuln]abilities &     
rem$iation ( su* vuln]abilities4  7#e7  

,! res\rces1 surge /aff+1 roles1 &      
responsibilities )9 ! ,dep>tm5t us$ to  
implem5t ! ,,vdp & complete security    
vuln]ability rem$iation4  7#f7 ,any o!r 
in=mation ! ,secret>y det]m9es relevant4
  #d4 ,dep>tm5t ( ,/ate bug b\nty pilot 
program  7a7 ,e/abli%m5t ( pilot program
  7#a7 ,9 g5]al ,n lat] ?an "o ye> aft] 
! date ( ! enactm5t ( ?is ,act1 !       
,secret>y %all e/abli% a bug b\nty pilot
 program to m9imize security            
vuln]abilities ( int]net-fac+ in=mation 
te*nology ( ! ,dep>tm5t4  7#b7          
,requirem5ts ,9 e/abli%+ ! pilot program
 describ$ 9 p>agraph 7#a71 ! ,secret>y  
%all-- 7,a7 provide comp5sation =       
reports ( previ\sly unid5tifi$ security 
vuln]abilities )9 ! websites1           
applications1 & o!r int]net-fac+        
in=mation te*nology ( ! ,dep>tm5t t are 
accessible to ! public2  7,b7 aw>d      
contracts to entities1 z necess>y1 to   
manage su* pilot program & = execut+ !  
rem$iation ( security vuln]abilities    
id5tifi$ pursuant to subp>agraph 7,a72  

7,c7 id5tify :i* ,dep>tm5t in=mation    
te*nology %\ld be includ$ 9 su* pilot   
program2  7,d7 consult ) ! ,attorney    
,g5]al on h[ to ensure t individuals1   
organizations1 or companies t comply ) !
 requirem5ts ( su* pilot program are    
protect$ f prosecution "u section #ajcj 
( title #ah1 ,unit$ ,/ates ,code1 &     
simil> provisions ( law = specific      
activities au?oriz$ "u su* pilot        
program2  7,e7 consult ) ! relevant     
(fices at ! ,dep>tm5t ( ,def5se t 7     
responsible = laun*+ ! #bjaf ,hack !    
,p5tagon pilot program & subsequ5t      
,dep>tm5t ( ,def5se bug b\nty programs2 
7,f7 develop a process by :i* an approv$
 individual1 organization1 or company c 
regi/] ) ! entity ref]r$ to 9           
subp>agraph 7,b71 submit to a backgr\nd 
*eck z det]m9$ by ! ,dep>tm5t1 & receive
 a det]m9ation z to eligibility =       
p>ticipation 9 su* pilot program2  7,g7 
engage qualifi$ int]e/$ p]sons1 includ+ 
nongov]nm5tal sector repres5tatives1    
ab\t ! /ructure ( su* pilot program z   

con/ructive & to ! ext5t practicable2 & 
7,h7 consult ) relevant ,unit$ ,/ates   
,gov]nm5t (ficials to ensure t su* pilot
 program complem5ts p]si/5t network &   
vuln]ability scans ( ! ,dep>tm5t (      
,/ate's int]net-accessible sy/ems1 su* z
 ! scans conduct$ pursuant to ,b9d+     
,op]ational ,directive ,,bod-#ai-jb or  
successor ,directive4  7#c7 ,duration ,!
 pilot program e/abli%$ "u p>agraph 7#a7
 %\ld be %ort-t]m 9 duration & n la/    
long] ?an "o ye>4  7b7 ,report ,n lat]  
?an #ahj days aft] ! date on :i* ! bug  
b\nty pilot program "u subsection 7a7 is
 complet$1 ! ,secret>y %all submit to ! 
,committee on ,=eign ,relations ( !     
,s5ate & ! ,committee on ,=eign ,affairs
 ( ! ,h\se ( ,repres5tatives a report on
 su* pilot program1 includ+ in=mation   
relat+ to-- 7#a7 ! numb] ( approv$      
individuals1 organizations1 or companies
 involv$ 9 su* pilot program1 brok5 d[n 
by ! numb] ( approv$ individuals1       
organizations1 or companies t-- 7,a7    
regi/]$2  7,b7 7 approv$2  7,c7 submitt$

 security vuln]abilities2 &  7,d7       
receiv$ comp5sation2  7#b7 ! numb] &    
sev]ity ( all security vuln]abilities   
report$ z "p ( su* pilot program2  7#c7 
! numb] ( previ\sly unid5tifi$ security 
vuln]abilities rem$iat$ z a result ( su*
 pilot program2  7#d7 ! curr5t numb] (  
out/&+ previ\sly unid5tifi$ security    
vuln]abilities & ,dep>tm5t rem$iation   
plans2  7#e7 ! av]age l5g? ( "t betwe5 !
 report+ ( security vuln]abilities &    
rem$iation ( su* vuln]abilities2  7#f7 !
 types ( comp5sation provid$ "u su*     
pilot program2 &  7#g7 ! lessons le>n$ f
 su* pilot program4