,,ii  #aag? ,,congress  #b;d ,session   
,s4 #chid  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,m>* #bb1 #bjbb,mr4    
,cornyn 7= himself & ,ms4 ,hassan7      
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
  ,a ,,bill  ,to am5d ! ,homel&         
,security ,act ( #bjjb to au?orize !    
,secret>y ( ,homel& ,security to e/abli%
 a cont9u\s diagno/ics & mitigation     
program 9 ! ,cyb]security &             
,infra/ructure ,security ,ag5cy ( !     
,dep>tm5t ( ,homel& ,security1 & = o!r  
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,advanc+ ,cyb]security     
,?r\gh ,cont9u\s ,diagno/ics &          
,mitigation ,act4  #b4 ,e/abli%m5t (    
,f$]al intrusion detection & prev5tion  
sy/em & cont9u\s diagno/ics & mitigation
 program 9 ! ,cyb]security &            
,infra/ructure ,security ,ag5cy  7a7 ,9 
g5]al ,section #bbac ( ! ,homel&        
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#ffc7 is am5d$ by add+ at ! end !       

foll[+3  7g7 ,cont9u\s diagno/ics &     
mitigation  7#a7 ,program  7,a7 ,9 g5]al
 ,! ,secret>y1 act+ ?r\gh ! ,director1  
%all1 ) or )\t reimbursem5t1 deploy1    
op]ate1 & ma9ta9 a cont9u\s diagno/ics &
 mitigation program = ag5cies "u :i* !  
,secret>y %all-- 7i7 assi/ ag5cies to   
cont9u\sly diagnose & mitigate cyb]     
?reats & vuln]abilities2  7ii7 develop &
 provide ! capability to collect1       
analyze1 & visualize in=mation relat+ to
 security data & cyb]security risks at  
ag5cies2  7iii7 employ %>$ s]vices1     
collective pur*as+1 blanket pur*ase     
agreem5ts1 & any o!r economic or        
procurem5t models ! ,secret>y det]m9es  
appropriate to maximize ! co/s sav+s    
associat$ ) implem5t+ ! program2  7iv7  
assi/ ag5cies 9 sett+ in=mation security
 priorities & assess+ & manag+          
cyb]security risks2  7v7 develop        
policies & proc$ures = report+ sy/emic  
cyb]security risks & pot5tial incid5ts  
bas$ ^u data collect$ "u ! program2 &   
7vi7 promote ! adoption ( a z]o tru/    

security model 9 improv+ ag5cy          
cyb]security read9ess4  7,b7 ,regul>    
improvem5t ,! ,secret>y %all regul>ly-- 
7i7 deploy new te*nologies & modify     
exi/+ te*nologies to ! cont9u\s         
diagno/ics & mitigation program requir$ 
"u subp>agraph 7,a71 z appropriate1 to  
improve ! program2 &  7ii7 update !     
te*nical requirem5ts docum5tation ( !   
cont9u\s diagno/ics & mitigation program
 requir$ "u subp>agraph 7,a7 to acc\nt =
 em]g+ te*nology capabilities su* z cl\d
 comput+ & compreh5sive cl\d security   
controls4  7#b7 ,ag5cy responsibilities 
,not)/&+ any o!r provision ( law1 ea*   
ag5cy t uses ! cont9u\s diagno/ics &    
mitigation program "u p>agraph 7#a7     
%all1 cont9u\sly & 9 real "t1 provide to
 & all[ access = ! ,secret>y to collect 
all in=mation1 assessm5ts1 analyses1 &  
raw data collect$ by ! program1 9 a     
mann] specifi$ by ! ,secret>y4  7#c7    
,responsibilities ( ! ,secret>y ,9 c>ry+
 out ! cont9u\s diagno/ics & mitigation 
program "u p>agraph 7#a71 ! ,secret>y1  

act+ ?r\gh ! ,director1 %all-- 7,a7 %>e 
) ag5cies relevant analysis & products  
develop$ "u ! program2  7,b7 provide    
regul> reports on cyb]security risks to 
ag5cies2  7,c7 provide comp>ative       
assessm5ts ( cyb]security risks =       
ag5cies2  7,d7 ov]see ! integration (   
cont9u\s diagno/ics & mitigation        
products & s]vices into ag5cy sy/ems2   
7,e7 e/abli% p]=mance requirem5ts =     
product integrators2  7,f7 at ! reque/ (
 an ag5cy1 provide te*nical assi/ance 9 
select+1 procur+1 & integrat+ cont9u\s  
diagno/ics & mitigation products &      
s]vices2  7,g7 n less ?an once ea*      
fiscal ye>1 submit to ! appropriate     
committees ( ,congress a report t       
includes-- 7i7 ! progress made by ea*   
ag5cy to meet cont9u\s diagno/ics &     
mitigation b5*m>ks f ! beg9n+ ( !       
implem5tation ?r\gh ! date ( ! report2 &
  7ii7 a summ>y ( ! ef=ts ( ea* ag5cy to
 acc\nt = em]g+ te*nology capabilities2 
&  7,h7 take /eps to ensure t ! security
 data collect$ ?r\gh ! program is       

aggregat$ ) o!r ,gov]nm5t-wide          
cyb]security programs to bett] automate 
def5sive capabilities4  4  7b7 ,cont9u\s
 diagno/ics & mitigation /rategy  7#a7  
,9 g5]al ,n lat] ?an #ahj days aft] !   
date ( ! enactm5t ( ?is ,act1 !         
,secret>y ( ,homel& ,security %all      
develop a compreh5sive cont9u\s         
diagno/ics & mitigation /rategy to c>ry 
out ! cont9u\s diagno/ics & mitigation  
program requir$ "u subsection 7g7 (     
section #bbac ( ! ,homel& ,security ,act
 ( #bjjb 7#f ,u4,s4,c4 #ffc71 z add$ by 
subsection 7a74  7#b7 ,scope ,! /rategy 
requir$ "u p>agraph 7#a7 %all include ! 
foll[+3 7,a7 ,a description ( !         
coord9ation & fund+ requir$ to deploy1  
in/all1 & ma9ta9 ! tools1 capabilities1 
& s]vices t ! ,secret>y ( ,homel&       
,security det]m9es to be necess>y to    
satisfy ! requirem5ts ( su* program4    
7,b7 ,a description ( any ob/acles fac+ 
! deploym5t1 in/allation1 & ma9t5ance ( 
tools1 capabilities1 & s]vices "u su*   
program4  7,c7 ,guidel9es to help ma9ta9

 & cont9u\sly upgrade tools1            
capabilities1 & s]vices provid$ "u su*  
program4  7,d7 ,a plan = us+ ! data     
collect$ by su* program = creat+ a      
common framework = data analytics1      
visualization ( ent]prise-wide risks1 & 
real-"t report+1 & comp>ative assessm5ts
 = cyb]security risks4  7,e7            
,recomm5dations = us+ ! data to enable !
 ,cyb]security & ,infra/ructure         
,security ,ag5cy to engage 9 cyb] hunt &
 detection & response activities4  7,f7 
,recomm5dations = future ef=ts &        
activities1 includ+ = ! roll\t ( new &  
em]g+ tools1 capabilities & s]vices1    
propos$ timel9es = deliv]y1 & :e!r to   
cont9ue ! use ( phas$ roll\t plans1     
relat$ to secur+ networks1 devices1     
data1 & in=mation & op]ational te*nology
 assets ?r\gh ! use ( su* program4  7,g7
 ,recomm5dations = improv+ ! integration
 process ( cont9u\s diagno/ics &        
mitigation products & capabilities )9   
ag5cy sy/ems4  7#c7 ,=m ,! /rategy      
requir$ "u p>agraph 7#a7 %all be        

submitt$ 9 an unclassifi$ =m1 b may     
conta9 a classifi$ annex4  #c4 ,f$]al   
intrusion detection & prev5tion sy/em & 
cont9u\s diagno/ics & mitigation pilot  
program = ,/ate1 local1 ,tribal1 &      
t]ritorial gov]nm5ts  7a7 ,def9itions ,9
 ?is section-- 7#a7 ! t]ms local        
gov]nm5t & ,/ate h ! mean+s giv5 ^? t]ms
 9 section #c ( ! ,homel& ,security ,act
 ( #bjjb 7#f ,u4,s4,c4 #aja72  7#b7 !   
t]m ,secret>y means ! ,secret>y (       
,homel& ,security2 &  7#c7 ! t]m ,tribal
 gov]nm5t means ! recogniz$ gov]n+ body 
( any ,indian or ,alaska ,native ,tribe1
 b&1 nation1 pueblo1 village1 community1
 compon5t b&1 or compon5t res]vation1 t 
is individually id5tifi$ 7includ+       
p>5!tically7 9 ! mo/ rec5t li/ publi%$  
pursuant to section #ajd ( ! ,f$]ally   
,recogniz$ ,indian ,tribe ,li/ ,act (   
#aiid 7#be ,u4,s4,c4 #eaca74  7b7       
,e/abli%m5t ,! ,secret>y %all conduct a 
,cont9u\s ,diagno/ics & ,mitigation     
,pilot ,program ) n less ?an #e ,/ate1  
local1 ,tribal1 or t]ritorial gov]nm5ts 

to-- 7#a7 promote ! use ( te*nologies & 
s]vices 9 ! cont9u\s diagno/ics &       
mitigation program describ$ 9 subsection
 7g7 ( section #bbac ( ! ,homel&        
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#ffc71 z add$ by section #b ( ?is ,act1 
at ! ,/ate1 local1 ,tribal1 & t]ritorial
 gov]nm5t level2  7#b7 ) or )\t         
reimbursem5t1 make access+ ! te*nologies
 & s]vices describ$ 9 p>agraph 7#a7 by  
,/ate1 local1 ,tribal1 & t]ritorial     
gov]nm5ts z af=dable & simple z         
possible2  7#c7 promote ! adoption ( a  
z]o tru/ security model 9 improv+       
cyb]security read9ess at ! ,/ate1 local1
 ,tribal1 & t]ritorial gov]nm5t level2 &
  7#d7 provide te*nical assi/ance 9     
integrat+ cont9u\s diagno/ics &         
mitigation te*nologies & products into  
,/ate1 local1 ,tribal1 & t]ritorial     
gov]nm5t sy/ems4  7c7 ,consid]ations ,9 
select+ a ,/ate1 local1 or ,tribal      
gov]nm5t = p>ticipation 9 ! pilot       
program e/abli%$ "u subsection 7b71 !   
,secret>y %all consid]-- 7#a7 ! ext5t to

 :i* ! ,/ate1 local1 ,tribal1 or        
t]ritorial gov]nm5t aligns its          
cyb]security policies ) ! ,c5t] =       
,int]net ,security ,critical ,security  
,controls1 ! ,national ,in/itute (      
,/&>ds & ,te*nology ,cyb]security       
,framework1 or o!r widely accept$       
cyb]security frameworks2 &  7#b7 !      
capability ( ! ,/ate1 local1 ,tribal1 or
 t]ritorial gov]nm5t to deploy & ma9ta9 
ov] "t cont9u\s diagno/ics & mitigation 
products & s]vices4  7d7 ,program       
requirem5ts ,! pilot program e/abli%$ "u
 ?is section-- 7#a7 may n require       
p>ticipants to utilize c]ta9 /rategies  
or tools1 & %all all[ p>ticipants to    
select & integrate tools = meet+ !      
objectives ( ! pilot program2 &  7#b7   
%all include compreh5sive tra9+         
curriculum & integration assi/ance to   
close ! te*nical exp]tise gap betwe5    
employees ( ,/ate1 local1 ,tribal1 &    
t]ritorial gov]nm5ts & employees ( !    
,cyb]security & ,infra/ructure ,security
 ,ag5cy4  7e7 ,report ,n lat] ?an #ahj  

days aft] ! date on :i* ! pilot program 
t]m9ates "u ?is section1 ! ,secret>y    
%all submit to ,congress a report t     
includes-- 7#a7 an assessm5t ( !        
replicability & ! co/s & b5efits (      
conduct+ a p]man5t ,/ate1 local1        
,tribal1 & t]ritorial gov]nm5t cont9u\s 
diagno/ics & mitigation program z       
describ$ 9 subsection 7g7 ( section     
#bbac ( ! ,homel& ,security ,act ( #bjjb
 7#f ,u4,s4,c4 #ffc71 z add$ by section 
#b ( ?is ,act2  7#b7 ! ext5t to :i*     
,/ate1 local1 ,tribal1 & t]ritorial     
gov]nm5ts 9 ! pilot program adh]e to    
widely accept$ cyb]security /&>ds &     
frameworks & ! impact t ^? policies h on
 pot5tial widespread sub-,f$]al cont9u\s
 diagno/ics & mitigation integration2 & 
7#c7 an assessm5t ( ! cyb]security      
read9ess ( p>ticipants 9 ! pilot program
 e/abli%$ "u ?is section prior to       
p>ticipation 9 ! pilot program z comp>$ 
to aft] completion ( ! pilot program4   
7f7 ,t]m9ation ,! au?ority to conduct ! 
pilot program "u subsections 7a7 ?r\gh  

7d7 %all t]m9ate on ! date t is #c ye>s 
aft] ! date ( enactm5t ( ?is ,act4