,,ii #aagth ,,congress #b;d ,session ,s4 #chid ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #bb1 #bjbb,mr4 ,cornyn 7for himself and ,ms4 ,hassan7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to authorize the ,secretary of ,homeland ,security to establish a continuous diagnostics and mitigation program in the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,advancing ,cybersecurity ,through ,continuous ,diagnostics and ,mitigation ,act4 #b4 ,establishment of ,federal intrusion detection and prevention system and continuous diagnostics and mitigation program in the ,cybersecurity and ,infrastructure ,security ,agency 7a7 ,in general ,section #bbac of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffc7 is amended by adding at the end the following3 7g7 ,continuous diagnostics and mitigation 7#a7 ,program 7,a7 ,in general ,the ,secretary1 acting through the ,director1 shall1 with or without reimbursement1 deploy1 operate1 and maintain a continuous diagnostics and mitigation program for agencies under which the ,secretary shall-- 7i7 assist agencies to continuously diagnose and mitigate cyber threats and vulnerabilities2 7ii7 develop and provide the capability to collect1 analyze1 and visualize information relating to security data and cybersecurity risks at agencies2 7iii7 employ shared services1 collective purchasing1 blanket purchase agreements1 and any other economic or procurement models the ,secretary determines appropriate to maximize the costs savings associated with implementing the program2 7iv7 assist agencies in setting information security priorities and assessing and managing cybersecurity risks2 7v7 develop policies and procedures for reporting systemic cybersecurity risks and potential incidents based upon data collected under the program2 and 7vi7 promote the adoption of a zero trust security model in improving agency cybersecurity readiness4 7,b7 ,regular improvement ,the ,secretary shall regularly-- 7i7 deploy new technologies and modify existing technologies to the continuous diagnostics and mitigation program required under subparagraph 7,a71 as appropriate1 to improve the program2 and 7ii7 update the technical requirements documentation of the continuous diagnostics and mitigation program required under subparagraph 7,a7 to account for emerging technology capabilities such as cloud computing and comprehensive cloud security controls4 7#b7 ,agency responsibilities ,notwithstanding any other provision of law1 each agency that uses the continuous diagnostics and mitigation program under paragraph 7#a7 shall1 continuously and in real time1 provide to and allow access for the ,secretary to collect all information1 assessments1 analyses1 and raw data collected by the program1 in a manner specified by the ,secretary4 7#c7 ,responsibilities of the ,secretary ,in carrying out the continuous diagnostics and mitigation program under paragraph 7#a71 the ,secretary1 acting through the ,director1 shall-- 7,a7 share with agencies relevant analysis and products developed under the program2 7,b7 provide regular reports on cybersecurity risks to agencies2 7,c7 provide comparative assessments of cybersecurity risks for agencies2 7,d7 oversee the integration of continuous diagnostics and mitigation products and services into agency systems2 7,e7 establish performance requirements for product integrators2 7,f7 at the request of an agency1 provide technical assistance in selecting1 procuring1 and integrating continuous diagnostics and mitigation products and services2 7,g7 not less than once each fiscal year1 submit to the appropriate committees of ,congress a report that includes-- 7i7 the progress made by each agency to meet continuous diagnostics and mitigation benchmarks from the beginning of the implementation through the date of the report2 and 7ii7 a summary of the efforts of each agency to account for emerging technology capabilities2 and 7,h7 take steps to ensure that the security data collected through the program is aggregated with other ,government-wide cybersecurity programs to better automate defensive capabilities4 4 7b7 ,continuous diagnostics and mitigation strategy 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security shall develop a comprehensive continuous diagnostics and mitigation strategy to carry out the continuous diagnostics and mitigation program required under subsection 7g7 of section #bbac of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffc71 as added by subsection 7a74 7#b7 ,scope ,the strategy required under paragraph 7#a7 shall include the following3 7,a7 ,a description of the coordination and funding required to deploy1 install1 and maintain the tools1 capabilities1 and services that the ,secretary of ,homeland ,security determines to be necessary to satisfy the requirements of such program4 7,b7 ,a description of any obstacles facing the deployment1 installation1 and maintenance of tools1 capabilities1 and services under such program4 7,c7 ,guidelines to help maintain and continuously upgrade tools1 capabilities1 and services provided under such program4 7,d7 ,a plan for using the data collected by such program for creating a common framework for data analytics1 visualization of enterprise-wide risks1 and real-time reporting1 and comparative assessments for cybersecurity risks4 7,e7 ,recommendations for using the data to enable the ,cybersecurity and ,infrastructure ,security ,agency to engage in cyber hunt and detection and response activities4 7,f7 ,recommendations for future efforts and activities1 including for the rollout of new and emerging tools1 capabilities and services1 proposed timelines for delivery1 and whether to continue the use of phased rollout plans1 related to securing networks1 devices1 data1 and information and operational technology assets through the use of such program4 7,g7 ,recommendations for improving the integration process of continuous diagnostics and mitigation products and capabilities within agency systems4 7#c7 ,form ,the strategy required under paragraph 7#a7 shall be submitted in an unclassified form1 but may contain a classified annex4 #c4 ,federal intrusion detection and prevention system and continuous diagnostics and mitigation pilot program for ,state1 local1 ,tribal1 and territorial governments 7a7 ,definitions ,in this section-- 7#a7 the terms local government and ,state have the meanings given those terms in section #c of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja72 7#b7 the term ,secretary means the ,secretary of ,homeland ,security2 and 7#c7 the term ,tribal government means the recognized governing body of any ,indian or ,alaska ,native ,tribe1 band1 nation1 pueblo1 village1 community1 component band1 or component reservation1 that is individually identified 7including parenthetically7 in the most recent list published pursuant to section #ajd of the ,federally ,recognized ,indian ,tribe ,list ,act of #aiid 7#be ,u4,s4,c4 #eaca74 7b7 ,establishment ,the ,secretary shall conduct a ,continuous ,diagnostics and ,mitigation ,pilot ,program with not less than #e ,state1 local1 ,tribal1 or territorial governments to-- 7#a7 promote the use of technologies and services in the continuous diagnostics and mitigation program described in subsection 7g7 of section #bbac of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffc71 as added by section #b of this ,act1 at the ,state1 local1 ,tribal1 and territorial government level2 7#b7 with or without reimbursement1 make accessing the technologies and services described in paragraph 7#a7 by ,state1 local1 ,tribal1 and territorial governments as affordable and simple as possible2 7#c7 promote the adoption of a zero trust security model in improving cybersecurity readiness at the ,state1 local1 ,tribal1 and territorial government level2 and 7#d7 provide technical assistance in integrating continuous diagnostics and mitigation technologies and products into ,state1 local1 ,tribal1 and territorial government systems4 7c7 ,considerations ,in selecting a ,state1 local1 or ,tribal government for participation in the pilot program established under subsection 7b71 the ,secretary shall consider-- 7#a7 the extent to which the ,state1 local1 ,tribal1 or territorial government aligns its cybersecurity policies with the ,center for ,internet ,security ,critical ,security ,controls1 the ,national ,institute of ,standards and ,technology ,cybersecurity ,framework1 or other widely accepted cybersecurity frameworks2 and 7#b7 the capability of the ,state1 local1 ,tribal1 or territorial government to deploy and maintain over time continuous diagnostics and mitigation products and services4 7d7 ,program requirements ,the pilot program established under this section-- 7#a7 may not require participants to utilize certain strategies or tools1 and shall allow participants to select and integrate tools for meeting the objectives of the pilot program2 and 7#b7 shall include comprehensive training curriculum and integration assistance to close the technical expertise gap between employees of ,state1 local1 ,tribal1 and territorial governments and employees of the ,cybersecurity and ,infrastructure ,security ,agency4 7e7 ,report ,not later than #ahj days after the date on which the pilot program terminates under this section1 the ,secretary shall submit to ,congress a report that includes-- 7#a7 an assessment of the replicability and the costs and benefits of conducting a permanent ,state1 local1 ,tribal1 and territorial government continuous diagnostics and mitigation program as described in subsection 7g7 of section #bbac of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffc71 as added by section #b of this ,act2 7#b7 the extent to which ,state1 local1 ,tribal1 and territorial governments in the pilot program adhere to widely accepted cybersecurity standards and frameworks and the impact that those policies have on potential widespread sub-,federal continuous diagnostics and mitigation integration2 and 7#c7 an assessment of the cybersecurity readiness of participants in the pilot program established under this section prior to participation in the pilot program as compared to after completion of the pilot program4 7f7 ,termination ,the authority to conduct the pilot program under subsections 7a7 through 7d7 shall terminate on the date that is #c years after the date of enactment of this ,act4