IIB 

116TH CONGRESS 

1ST SESSION H. R. 3710 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 15, 2019 

Received; read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

AN ACT 

To amend the Homeland Security Act of 2002 to provide 

for the remediation of cybersecurity vulnerabilities, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK79L0C42 with BILLS
2 

HR 3710 RFS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Cybersecurity Vulner3 ability Remediation Act’’. 

4 SEC. 2. CYBERSECURITY VULNERABILITIES. 

5 Section 2209 of the Homeland Security Act of 2002 

6 (6 U.S.C. 659) is amended— 

7 (1) in subsection (a)— 

8 (A) in paragraph (5), by striking ‘‘and’’ 

9 after the semicolon at the end; 

10 (B) by redesignating paragraph (6) as 

11 paragraph (7); and 

12 (C) by inserting after paragraph (5) the 

13 following new paragraph: 

14 ‘‘(6) the term ‘cybersecurity vulnerability’ has 

15 the meaning given the term ‘security vulnerability’ 

16 in section 102 of the Cybersecurity Information 

17 Sharing Act of 2015 (6 U.S.C. 1501); and’’. 

18 (2) in subsection (c)— 

19 (A) in paragraph (5)— 

20 (i) in subparagraph (A), by striking 

21 ‘‘and’’ after the semicolon at the end; 

22 (ii) by redesignating subparagraph 

23 (B) as subparagraph (C); 

24 (iii) by inserting after subparagraph 

25 (A) the following new subparagraph: 


kjohnson on DSK79L0C42 with BILLS
3 

HR 3710 RFS

1 ‘‘(B) sharing mitigation protocols to counter cy2 bersecurity vulnerabilities pursuant to subsection 

3 (n); and’’; and 

4 (iv) in subparagraph (C), as so redes5 ignated, by inserting ‘‘and mitigation pro6 tocols to counter cybersecurity 

7 vulnerabilities in accordance with subpara8 graph (B)’’ before ‘‘with Federal’’; 

9 (B) in paragraph (7)(C), by striking 

10 ‘‘sharing’’ and inserting ‘‘share’’; and 

11 (C) in paragraph (9), by inserting ‘‘mitiga12 tion protocols to counter cybersecurity 

13 vulnerabilities,’’ after ‘‘measures,’’; 

14 (3) in subsection (e)(1)(G), by striking the 

15 semicolon after ‘‘and’’ at the end; and 

16 (4) by adding at the end the following new sub17 section: 

18 ‘‘(n) PROTOCOLS TO COUNTER CYBERSECURITY

19 VULNERABILITIES.—The Director may, as appropriate, 

20 identify, develop, and disseminate actionable protocols to 

21 mitigate cybersecurity vulnerabilities, including in cir22 cumstances in which such vulnerabilities exist because 

23 software or hardware is no longer supported by a ven24 dor.’’. 


kjohnson on DSK79L0C42 with BILLS
4 

HR 3710 RFS

1 SEC. 3. REPORT ON CYBERSECURITY VULNERABILITIES. 

2 (a) REPORT.—Not later than 1 year after the date 

3 of the enactment of this Act, the Director of the Cyberse4 curity and Infrastructure Security Agency of the Depart5 ment of Homeland Security shall submit to the Committee 

6 on Homeland Security of the House of Representatives 

7 and the Committee on Homeland Security and Govern8 mental Affairs of the Senate a report on how the Agency 

9 carries out subsection (m) of section 2209 of the Home10 land Security Act of 2002 to coordinate vulnerability dis11 closures, including disclosures of cybersecurity 

12 vulnerabilities (as such term is defined in such section), 

13 and subsection (n) of such section (as added by section 

14 2) to disseminate actionable protocols to mitigate cyberse15 curity vulnerabilities, that includes the following: 

16 (1) A description of the policies and procedures 

17 relating to the coordination of vulnerability disclo18 sures. 

19 (2) A description of the levels of activity in fur20 therance of such subsections (m) and (n) of such 

21 section 2209. 

22 (3) Any plans to make further improvements to 

23 how information provided pursuant to such sub24 sections can be shared (as such term is defined in 

25 such section 2209) between the Department and in26 dustry and other stakeholders. 


kjohnson on DSK79L0C42 with BILLS
5 

HR 3710 RFS

1 (4) Any available information on the degree to 

2 which such information was acted upon by industry 

3 and other stakeholders. 

4 (5) A description of how privacy and civil lib5 erties are preserved in the collection, retention, use, 

6 and sharing of vulnerability disclosures. 

7 (b) FORM.—The report required under subsection (b) 

8 shall be submitted in unclassified form but may contain 

9 a classified annex. 

10 SEC. 4. COMPETITION RELATING TO CYBERSECURITY 

11 VULNERABILITIES. 

12 The Under Secretary for Science and Technology of 

13 the Department of Homeland Security, in consultation 

14 with the Director of the Cybersecurity and Infrastructure 

15 Security Agency of the Department, may establish an in16 centive-based program that allows industry, individuals, 

17 academia, and others to compete in providing remediation 

18 solutions for cybersecurity vulnerabilities (as such term is 

19 defined in section 2209 of the Homeland Security Act of 

20 2002, as amended by section 2). 

Passed the House of Representatives September 26, 

2019. 

Attest: CHERYL L. JOHNSON, 

Clerk. 


kjohnson on DSK79L0C42 with BILLS