69–006 

115TH CONGRESS REPORT " ! HOUSE OF REPRESENTATIVES 1st Session 115–283 

CYBER VULNERABILITY DISCLOSURE REPORTING ACT 

SEPTEMBER 1, 2017.—Committed to the Committee of the Whole House on the State 

of the Union and ordered to be printed 

Mr. MCCAUL, from the Committee on Homeland Security, 

submitted the following 

R E P O R T 

[To accompany H.R. 3202] 

The Committee on Homeland Security, to whom was referred the 

bill (H.R. 3202) to require the Secretary of Homeland Security to 

submit a report on cyber vulnerability disclosures, and for other 

purposes, having considered the same, reports favorably thereon 

without amendment and recommends that the bill do pass. 

CONTENTS 

Page 

Purpose and Summary ............................................................................................ 1 

Background and Need for Legislation .................................................................... 2 

Hearings ................................................................................................................... 2 

Committee Consideration ........................................................................................ 2 

Committee Votes ...................................................................................................... 2 

Committee Oversight Findings ............................................................................... 3 

New Budget Authority, Entitlement Authority, and Tax Expenditures ............. 3 

Congressional Budget Office Estimate ................................................................... 3 

Statement of General Performance Goals and Objectives .................................... 3 

Duplicative Federal Programs ................................................................................ 3 

Congressional Earmarks, Limited Tax Benefits, and Limited Tariff Benefits ... 3 

Federal Mandates Statement ................................................................................. 3 

Preemption Clarification ......................................................................................... 4 

Disclosure of Directed Rule Makings ..................................................................... 4 

Advisory Committee Statement .............................................................................. 4 

Applicability to Legislative Branch ........................................................................ 4 

Section-by-Section Analysis of the Legislation ...................................................... 4 

Changes in Existing Law Made by the Bill, as Reported ..................................... 5 

PURPOSE AND SUMMARY

The Secretary of Homeland Security is directed to provide a report to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and GovVerDate Sep 11 2014 01:28 Sep 02, 2017 Jkt 069006 PO 00000 Frm 00001 Fmt 6659 Sfmt 6602 E:\HR\OC\HR283.XXX HR283
2 

resentatives and the Committee on Homeland Security and Governmental Affairs of the Senate containing a description of the policies and procedures developed by the Department of Homeland Security to coordinate the disclosure of cyber vulnerabilities. Further, 

the report should contain, where available, information on the degree to which the information was acted upon by industry and 

other stakeholders. The report may also contain a description of 

how the Secretary is working with other Federal entities and critical infrastructure owners and operators to prevent, detect, and 

mitigate cyber vulnerabilities. 

BACKGROUND AND NEED FOR LEGISLATION

Computers are ubiquitous: we use them dozens of times a day in 

everyday life—banking, communications, and work. As the world 

has become increasingly interconnected through the internet of 

things vulnerabilities in the computer code that run the systems 

can expose them to exploitation by a variety of people from hackers 

and criminals to nation States. 

The Nation’s critical infrastructure is diverse and complex. It includes distributed networks, interdependent functions and systems 

in both the physical space and cyberspace. The Department of 

Homeland Security was given the authority by the Cybersecurity 

Act of 2015 to improve cybersecurity in the United States through 

enhanced sharing of information about cybersecurity threats. 

The Homeland Security Act of 2002 (Section 227(m)) allows the 

Secretary to coordinate with industry to develop Department policies and procedures for coordinating the disclosure of cyber 

vulnerabilities. This disclosure is important as it highlights 

vulnerabilities and allows the public and private sector to work to 

prevent and mitigate cyber threats. 

H.R. 3202 directs the Secretary of the Department of Homeland 

Security to produce a report that describes the policies and procedures developed to coordinate the disclosure of cyber 

vulnerabilities. 

HEARINGS

No hearings were held on H.R. 3202 in the 115th Congress. 

COMMITTEE CONSIDERATION

The Committee met on July 26, 2017, to consider H.R. 3202, and 

ordered the measure to be reported to the House with a favorable 

recommendation, without amendment, by voice vote. 

COMMITTEE VOTES

Clause 3(b) of Rule XIII of the Rules of the House of Representatives requires the Committee to list the recorded votes on the motion to report legislation and amendments thereto. 

No recorded votes were requested during Committee consideration of H.R. 3202. 

3 

COMMITTEE OVERSIGHT FINDINGS

Pursuant to clause 3(c)(1) of Rule XIII of the Rules of the House 

of Representatives, the Committee has held oversight hearings and 

made findings that are reflected in this report. 

NEW BUDGET AUTHORITY, ENTITLEMENT AUTHORITY, AND TAX

EXPENDITURES

In compliance with clause 3(c)(2) of Rule XIII of the Rules of the 

House of Representatives, the Committee finds that H.R. 3202, the 

Cyber Vulnerability Disclosure Reporting Act, would result in no 

new or increased budget authority, entitlement authority, or tax 

expenditures or revenues. 

CONGRESSIONAL BUDGET OFFICE ESTIMATE

Pursuant to clause 3(c)(3) of Rule XIII of the Rules of the House 

of Representatives, a cost estimate provided by the Congressional 

Budget Office pursuant to section 402 of the Congressional Budget 

Act of 1974 was not made available to the Committee in time for 

the filing of this report. The Chairman of the Committee shall 

cause such estimate to be printed in the Congressional Record upon 

its receipt by the Committee. 

STATEMENT OF GENERAL PERFORMANCE GOALS AND OBJECTIVES

Pursuant to clause 3(c)(4) of Rule XIII of the Rules of the House 

of Representatives, H.R. 3202 contains the following general performance goals and objectives, including outcome related goals and 

objectives authorized. 

H.R. 3202 directs the Secretary of the Department of Homeland 

Security produce a report that describes the policies and procedures developed to coordinate the disclosure of cyber 

vulnerabilities. 

DUPLICATIVE FEDERAL PROGRAMS

Pursuant to clause 3(c) of Rule XIII, the Committee finds that 

H.R. 21626 does not contain any provision that establishes or reauthorizes a program known to be duplicative of another Federal program. 

CONGRESSIONAL EARMARKS, LIMITED TAX BENEFITS, AND LIMITED

TARIFF BENEFITS

In compliance with Rule XXI of the Rules of the House of Representatives, this bill, as reported, contains no congressional earmarks, limited tax benefits, or limited tariff benefits as defined in 

clause 9(e), 9(f), or 9(g) of the Rule XXI. 

FEDERAL MANDATES STATEMENT

An estimate of Federal mandates prepared by the Director of the 

Congressional Budget Office pursuant to section 423 of the Unfunded Mandates Reform Act was not made available to the Committee in time for the filing of this report. The Chairman of the 

Committee shall cause such estimate to be printed in the Congressional Record upon its receipt by the Committee. 

4 

PREEMPTION CLARIFICATION

In compliance with section 423 of the Congressional Budget Act 

of 1974, requiring the report of any Committee on a bill or joint 

resolution to include a statement on the extent to which the bill or 

joint resolution is intended to preempt State, local, or Tribal law, 

the Committee finds that H.R. 3202 does not preempt any State, 

local, or Tribal law. 

DISCLOSURE OF DIRECTED RULE MAKINGS

The Committee estimates that H.R. 3202 would require no directed rule makings. 

ADVISORY COMMITTEE STATEMENT

No advisory committees within the meaning of section 5(b) of the 

Federal Advisory Committee Act were created by this legislation. 

APPLICABILITY TO LEGISLATIVE BRANCH

The Committee finds that the legislation does not relate to the 

terms and conditions of employment or access to public services or 

accommodations within the meaning of section 102(b)(3) of the Congressional Accountability Act. 

SECTION-BY-SECTION ANALYSIS OF THE LEGISLATION

Section 1. Short Title. 

This section provides that this bill may be cited as the ‘‘Cyber 

Vulnerability Disclosure Reporting Act’’. 

Sec. 2. Report on Cyber Vulnerabilities. 

This section directs the Secretary of Homeland Security to submit a report within 240 days to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate. The report 

shall contain a description of the policies and procedures developed 

by the Department of Homeland Security to coordinate the disclosure of cyber vulnerabilities, in accordance with section 227(m) of 

the Homeland Security Act of 2002 (6 U.S.C. 148(m)). 

To the extent possible, the report shall include an annex with information describing the occasions on which such policies and procedures were used to disclose cyber vulnerabilities in the year prior 

to the date that the report is required. Further, the report should 

contain, where available, information on the degree to which the 

information was acted upon by industry and other stakeholders. 

The report may also contain a description of how the Secretary is 

working with other Federal entities and critical infrastructure owners and operators to prevent, detect, and mitigate cyber 

vulnerabilities. 

The report should be unclassified, but may contain a classified 

annex. 

5 

CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

As reported, H.R. 3202 makes no changes to existing law. 

Æ