,i  #aah? ,,congress  #a/ ,session  ,h4 
,r4 #bhff  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,april #be1 #bjbc,mr4 
,torres ( ,new ,york introduc$ ! foll[+ 
bill2 :i* 0 ref]r$ to ! ,committee on   
,homel& ,security  ,a ,,bill  ,to am5d !
 ,homel& ,security ,act ( #bjjb to      
e/abli% ,critical ,te*nology ,security  
,c5t]s 9 ! ,dep>tm5t ( ,homel& ,security
 to evaluate & te/ ! security ( critical
 te*nology1 & = o!r purposes4  #a4 ,%ort
 title ,?is ,act may be cit$ z !        
,critical ,te*nology ,security ,c5t]s   
,act ( #bjbc4  #b4 ,critical te*nology  
security c5t]s  7a7 ,critical te*nology 
security c5t]s ,title ,,iii ( ! ,homel& 
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#aha et seq47 is am5d$ by add+ at ! end 
! foll[+ new section3  #cbd4 ,critical  
,te*nology ,security ,c5t]s  7a7        
,e/abli%m5t ,n lat] ?an #ahj days aft] !
 date ( ! enactm5t ( ?is section1 !     
,secret>y1 act+ ?r\gh ! ,"u ,secret>y = 
,sci5ce & ,te*nology1 & 9 coord9ation ) 
! ,director1 %all aw>d grants1          

contracts1 or coop]ative agreem5ts to   
cov]$ entities = ! e/abli%m5t ( n few]  
?an two cyb]security-focus$ ,critical   
,te*nology ,security ,c5t]s 79 ?is      
section ref]r$ to z ,c5t]s7 to evaluate 
& te/ ! security ( critical te*nology4  
7b7 ,evaluation & te/+ ,9 c>ry+ out !   
evaluation & te/+ ( ! security (        
critical te*nology pursuant to          
subsection 7a71 ! ,c5t]s %all address ! 
foll[+ te*nologies3 7#a7 ,! security (  
in=mation & communications te*nology t  
und]p9s national critical functions     
relat$ to communications4  7#b7 ,!      
security ( network$ indu/rial equipm5t1 
su* z connect$ programmable data logic  
controll]s & sup]visory control & data  
acquisition s]v]s4  7#c7 ,! security (  
op5 s\rce s(tw>e t und]p9s national     
critical functions4  7#d7 ,! security ( 
critical s(tw>e us$ by ! ,f$]al         
,gov]nm5t4  7c7 ,addition or t]m9ation (
 ,c5t]s  7#a7 ,9 g5]al ,! ,"u ,secret>y 
= ,sci5ce & ,te*nology may1 9           
coord9ation ) ! ,director1 aw>d or      

t]m9ate grants1 contracts1 or coop]ative
 agreem5ts to cov]$ entities = !        
e/abli%m5t ( additional or t]m9ation (  
exi/+ ,c5t]s to evaluate & te/ !        
security ( critical te*nologies4  7#b7  
,limitation ,! au?ority provid$ "u      
p>agraph 7#a7 may be ex]cis$ except if  
su* ex]cise w\ld result 9 ! op]ation at 
any "t ( few] ?an two ,c5t]s4  7d7      
,selection ( critical te*nologies  7#a7 
,9 g5]al ,be=e aw>d+ a grant1 contract1 
or coop]ative agreem5t to a cov]$ entity
 to e/abli% a ,c5t]1 ! ,"u ,secret>y =  
,sci5ce & ,te*nology %all coord9ate ) ! 
,director1 :o %all provide ! ,"u        
,secret>y a li/ ( critical te*nologies  
or guidance on su* te*nologies t w\ld be
 )9 ! remit ( any su* ,c5t]4  7#b7      
,expansion & modification ,! ,"u        
,secret>y = ,sci5ce & ,te*nology1 9     
coord9ation ) ! ,director1 is au?oriz$  
to exp& or modify at any "t ! li/ (     
critical te*nologies or guidance on     
te*nologies ref]r$ to 9 p>agraph 7#a7 t 
is )9 ! remit ( a propos$ or e/abli%$   

,c5t]4  7e7 ,responsibilities ,9 c>ry+  
out ! evaluation & te/+ ( ! security (  
critical te*nology pursuant to          
subsection 7a71 ! ,c5t]s %all ea* h !   
foll[+ responsibilities3 7#a7 ,conduct+ 
rigor\s security te/+ to id5tify        
vuln]abilities 9 su* te*nologies4  7#b7 
,utiliz+ ! coord9at$ vuln]ability       
disclosure processes e/abli%$ "u        
subsection 7g7 to report to ! develop]s 
( su* te*nologies &1 z appropriate1 to !
 ,director1 in=mation relat+ to         
vuln]abilities discov]$ & any in=mation 
necess>y to reproduce su*               
vuln]abilities4  7#c7 ,develop+ new     
capabilities = improv+ ! security ( su* 
te*nologies1 includ+ vuln]ability       
discov]y1 managem5t1 mitigation1 &      
rem$iation4  7#d7 ,assess+ ! security ( 
s(tw>e1 firmw>e1 & h>dw>e t und]p9      
national critical functions4  7#e7      
,support+ exi/+ communities ( int]e/1   
includ+ ?r\gh grant mak+1 9 mitigat+ &  
rem$iat+ vuln]abilities discov]$ )9 su* 
te*nologies4  7#f7 ,%>+ f9d+s to in=m & 

support ! future "w ( ! ,cyb]security & 
,infra/ructure ,security ,ag5cy4  7f7   
,risk-,bas$ evaluations ,unless o!rwise 
direct$ pursuant to guidance issu$ by ! 
,"u ,secret>y = ,sci5ce & ,te*nology or 
,director "u subsection 7d71 to !       
greate/ ext5t practicable activities    
c>ri$ out pursuant to ! responsibilities
 specifi$ 9 subsection 7e7 %all lev]age 
risk-bas$ evaluations to focus on       
activities t h ! greate/ effect on !    
security ( ! critical te*nologies )9 ea*
 ,c5t]'s remit1 su* z ! foll[+3 7#a7    
,develop+ capabilities t c detect or    
elim9ate entire classes (               
vuln]abilities4  7#b7 ,te/+ =           
vuln]abilities 9 ! mo/ widely us$       
critical te*nologies1 or vuln]abilities 
t affect _m su* critical te*nologies4   
7g7 ,coord9at$ vuln]ability disclosure  
processes ,ea* ,c5t] %all e/abli%1 9    
coord9ation ) ! ,director1 coord9at$    
vuln]ability disclosure processes reg>d+
 ! disclosure ( vuln]abilities t-- 7#a7 
are adh]$ to :5 a vuln]ability is       

discov]$ or disclos$ by ea* su* ,c5t]1  
consi/5t ) int]national /&>ds &         
coord9at$ vuln]ability disclosure be/   
practices2 &  7#b7 are publi%$ on !     
website ( ea* su* ,c5t]4  7h7           
,application ,to be eligible = an aw>d (
 a grant1 contract1 or coop]ative       
agreem5t z a ,c5t]1 a cov]$ entity %all 
submit to ! ,secret>y an application at 
su* "t1 9 su* mann]1 & includ+ su*      
in=mation z ! ,secret>y may require4    
7i7 ,public report+ ( vuln]abilities ,! 
,"u ,secret>y = ,sci5ce & ,te*nology    
%all ensure t vuln]abilities discov]$ by
 a ,c5t] are report$ to ! ,national     
,vuln]ability ,database ( ! ,national   
,in/itute ( ,/&>ds & ,te*nology1 z      
appropriate & us+ ! coord9at$           
vuln]ability disclosure processes       
e/abli%$ "u subsection 7g74  7j7        
,additional guidance ,! ,"u ,secret>y = 
,sci5ce & ,te*nology1 9 coord9ation ) ! 
,director1 %all develop1 & p]iodically  
update1 guidance1 includ+ eligibility & 
any additional requirem5ts1 relat+ to h[

 ,c5t]s may aw>d grants to communities (
 int]e/ pursuant to subsection 7e77#e7  
to mitigate & rem$iate vuln]abilities & 
take o!r actions "u su* subsection &    
subsection 7k74  7k7 ,op5 s\rce s(tw>e  
security grants  7#a7 ,9 g5]al ,any     
,c5t] address+ op5 s\rce s(tw>e security
 may1 9 consultation ) ! ,"u ,secret>y =
 ,sci5ce & ,te*nology & ,director1 aw>d 
grants to individual op5 s\rce s(tw>e   
develop]s & ma9ta9]s1 nonpr(it          
organizations1 & o!r non-,f$]al entities
 z det]m9$ appropriate by any su* ,c5t]1
 to fund improvem5ts 9 ! security ( !   
op5 s\rce s(tw>e ecosy/em4  7#b7        
,improvem5ts ,a grant aw>d$ "u p>agraph 
7#a7 may include improvem5ts su* z !    
foll[+3 7,a7 ,security audits4  7,b7    
,fund+ = develop]s to pat*              
vuln]abilities4  7,c7 ,address+ code1   
infra/ructure1 & /ructural weaknesses1  
includ+ rewrites ( op5 s\rce s(tw>e     
compon5ts 9 memory-safe programm+       
languages4  7,d7 ,rese>* & tools to     
assess & improve ! ov]all security ( !  

op5 s\rce s(tw>e ecosy/em1 su* z improv$
 s(tw>e fault isolation te*niques4  7,e7
 ,tra9+ & o!r tools to aid op5 s\rce    
s(tw>e develop]s 9 ! secure developm5t (
 op5 s\rce s(tw>e1 includ+ secure cod+  
practices & secure sy/ems ar*itecture4  
7#c7 ,priority ,9 aw>d+ grants "u       
p>agraph 7#a71 a ,c5t] %all prioritize1 
to ! greate/ ext5t practicable1 !       
foll[+3 7,a7 ,:]e applicable1 op5 s\rce 
s(tw>e compon5ts id5tifi$ 9 guidance f !
 ,director1 or if no su* guidance is s  
provid$1 utiliz+ ! risk-bas$ evaluation 
describ$ 9 subsection 7f74  7,b7        
,activities t mo/ promote ! long-t]m    
security ( ! op5 s\rce s(tw>e ecosy/em4 
7l7 ,bi5nial reports to ,"u ,secret>y ,n
 lat] ?an "o ye> aft] ! date ( !        
enactm5t ( ?is section & e two ye>s     
!reaft]1 ea* ,c5t] %all submit to ! ,"u 
,secret>y = ,sci5ce & ,te*nology1       
,director1 & ! appropriate congressional
 committees a report t includes !       
foll[+3 7#a7 ,a summ>y ( ! "w p]=m$ by  
su* ,c5t]4  7#b7 ,in=mation relat+ to ! 

allocation ( ,f$]al funds at su* ,c5t]4 
7#c7 ,a li/ ( critical te*nologies /udi$
 by su* ,c5t]4  7#d7 ,a description (   
ea* vuln]ability t has be5 publicly     
disclos$ pursuant to subsection 7g71    
includ+ in=mation relat+ to !           
correspond+ s(tw>e weakness4  7#e7 ,an  
assessm5t ( ! criticality ( ea* su*     
vuln]ability4  7#f7 ,an ov]view ( !     
me?odologies us$ by su* ,c5t]1 su* z    
tactics1 te*niques1 & proc$ures4  7#g7  
,a description ( su* ,c5t]'s developm5t 
( capabilities = vuln]ability discov]y1 
managem5t1 & mitigation4  7#h7 ,a summ>y
 ( su* ,c5t]'s support to exi/+         
communities ( int]e/1 includ+ an acc\nt+
 ( disp]s$ grant funds4  7#i7 ,= su*    
,c5t]1 if applicable1 a summ>y ( any    
grants aw>d$ dur+ ! p]iod cov]$ by !    
report t includes ! foll[+3 7,a7 ,an    
id5tification ( ! entity to :i* ea* su* 
grant 0 aw>d$4  7,b7 ,! am\nt ( ea* su* 
grant4  7,c7 ,! purpose ( ea* su* grant4
  7,d7 ,! expect$ impact ( ea* su*      
grant4  7#aj7 ,! coord9at$ vuln]ability 

disclosure processes e/abli%$ by su*    
,c5t]4  7m7 ,reports to ,congress ,^u   
receiv+ ! reports requir$ "u subsection 
7l71 ! ,"u ,secret>y = ,sci5ce &        
,te*nology %all submit to ! appropriate 
congressional committees a summ>y ( su* 
reports1 &1 :]e applicable1 an          
explanation = any deviations 9 ! li/ (  
critical te*nologies /udi$ by a ,c5t] f 
! li/ ( critical te*nologies or guidance
 relat+ to su* te*nologies provid$ by ! 
,director pursuant to subsection 7d74   
7n7 ,consultation ) relevant ag5cies ,9 
c>ry+ out ?is section1 ! ,"u ,secret>y  
%all consult ) ! heads ( o!r ,f$]al     
ag5cies conduct+ cyb]security rese>*1   
includ+ ! foll[+3 7#a7 ,! ,national     
,in/itute ( ,/&>ds & ,te*nology4  7#b7  
,! ,national ,sci5ce ,f\ndation4  7#c7  
,relevant ag5cies ( ! ,dep>tm5t (       
,en]gy4  7#d7 ,relevant ag5cies ( !     
,dep>tm5t ( ,def5se4  7o7 ,au?orization 
( appropriations ,!re are au?oriz$ to be
 appropriat$ to c>ry out ?is section !  
foll[+3 7#a7 #db1jjj1jjj = fiscal ye>   

#bjbd4  7#b7 #dd1jjj1jjj = fiscal ye>   
#bjbe4  7#c7 #df1jjj1jjj = fiscal ye>   
#bjbf4  7#d7 #di1jjj1jjj = fiscal ye>   
#bjbg4  7#e7 #eb1jjj1jjj = fiscal ye>   
#bjbh4  7p7 ,def9itions ,9 ?is section3 
7#a7 ,appropriate congressional         
committees ,! t]m appropriate           
congressional committees means-- 7,a7 ! 
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives2 &  7,b7 !      
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate4  7#b7  
,cov]$ entity ,! t]m cov]$ entity means 
a univ]sity or f$]ally-fund$ rese>* &   
developm5t c5t]1 includ+ a national     
laboratory1 or a consortia !re(4  7#c7  
,critical te*nology ,! t]m critical     
te*nology means te*nology t und]p9s "o  
or m national critical functions4  7#d7 
,critical s(tw>e ,! t]m critical s(tw>e 
has ! mean+ giv5 su* t]m by ! ,national 
,in/itute ( ,/&>ds & ,te*nology pursuant
 to ,executive ,ord] #adjbh or any      
successor provision4  7#e7 ,op5 s\rce   
s(tw>e ,! t]m op5 s\rce s(tw>e means    

s(tw>e = :i* ! human-readable s\rce code
 is made available to ! public = use1   
/udy1 re-use1 modification1 enhancem5t1 
& r$i/ribution4  7#f7 ,director ,! t]m  
,director means ! ,director ( !         
,cyb]security & ,infra/ructure ,security
 ,ag5cy4  4  7b7 ,id5tification ( c]ta9 
te*nology ,p>agraph 7#a7 ( section      
#bbjb7;e7 ( ! ,homel& ,security ,act (  
#bjjb 7#f ,u4,s4,c4 #feb7;e77 is am5d$  
by add+ at ! end ! foll[+ new           
subp>agraph3  7,s7 ,to id5tify !        
critical te*nologies 7z su* t]m is def9$
 9 section #cbd7 or develop guidance    
relat+ to su* te*nologies )9 ! remits ( 
! ,critical ,te*nology ,security ,c5t]s 
z describ$ 9 su* section4  4  7c7       
,cl]ical am5dm5t ,! table ( cont5ts 9   
section #a7;b7 ( ! ,homel& ,security    
,act ( #bjjb is am5d$ by ins]t+ aft] !  
item relat+ to section #cbc ! foll[+ new
 item3  ,sec4 #cbd4 ,critical ,te*nology
 ,security ,c5t]s4  4