IIB 

117TH CONGRESS 

1ST SESSION H. R. 2980 

IN THE SENATE OF THE UNITED STATES 

JULY 21, 2021 

Received; read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

AN ACT 

To amend the Homeland Security Act of 2002 to provide 

for the remediation of cybersecurity vulnerabilities, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK79L0C42PROD with BILLS
2 

HR 2980 RFS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Cybersecurity Vulner3 ability Remediation Act’’. 

4 SEC. 2. CYBERSECURITY VULNERABILITIES. 

5 Section 2209 of the Homeland Security Act of 2002 

6 (6 U.S.C. 659) is amended— 

7 (1) in subsection (a)— 

8 (A) in paragraph (5), by striking ‘‘and’’ 

9 after the semicolon at the end; 

10 (B) by redesignating paragraph (6) as 

11 paragraph (7); and 

12 (C) by inserting after paragraph (5) the 

13 following new paragraph: 

14 ‘‘(6) the term ‘cybersecurity vulnerability’ has 

15 the meaning given the term ‘security vulnerability’ 

16 in section 102 of the Cybersecurity Information 

17 Sharing Act of 2015 (6 U.S.C. 1501); and’’. 

18 (2) in subsection (c)— 

19 (A) in paragraph (5)— 

20 (i) in subparagraph (A), by striking 

21 ‘‘and’’ after the semicolon at the end; 

22 (ii) by redesignating subparagraph 

23 (B) as subparagraph (C); 

24 (iii) by inserting after subparagraph 

25 (A) the following new subparagraph: 


kjohnson on DSK79L0C42PROD with BILLS
3 

HR 2980 RFS

1 ‘‘(B) sharing mitigation protocols to counter cy2 bersecurity vulnerabilities pursuant to subsection 

3 (n); and’’; and 

4 (iv) in subparagraph (C), as so redes5 ignated, by inserting ‘‘and mitigation pro6 tocols to counter cybersecurity 

7 vulnerabilities in accordance with subpara8 graph (B)’’ before ‘‘with Federal’’; 

9 (B) in paragraph (7)(C), by striking 

10 ‘‘sharing’’ and inserting ‘‘share’’; and 

11 (C) in paragraph (9), by inserting ‘‘mitiga12 tion protocols to counter cybersecurity 

13 vulnerabilities,’’ after ‘‘measures,’’; 

14 (3) in subsection (e)(1)(G), by striking the 

15 semicolon after ‘‘and’’ at the end; 

16 (4) by redesignating subsection (o) as sub17 section (p); and 

18 (5) by inserting after subsection (n) following 

19 new subsection: 

20 ‘‘(o) PROTOCOLS TO COUNTER CERTAIN CYBERSE21 CURITY VULNERABILITIES.—The Director may, as appro22 priate, identify, develop, and disseminate actionable proto23 cols to mitigate cybersecurity vulnerabilities to informa24 tion systems and industrial control systems, including in 

25 circumstances in which such vulnerabilities exist because 


kjohnson on DSK79L0C42PROD with BILLS
4 

HR 2980 RFS

1 software or hardware is no longer supported by a ven2 dor.’’. 

3 SEC. 3. REPORT ON CYBERSECURITY VULNERABILITIES. 

4 (a) REPORT.—Not later than 1 year after the date 

5 of the enactment of this Act, the Director of the Cyberse6 curity and Infrastructure Security Agency of the Depart7 ment of Homeland Security shall submit to the Committee 

8 on Homeland Security of the House of Representatives 

9 and the Committee on Homeland Security and Govern10 mental Affairs of the Senate a report on how the Agency 

11 carries out subsection (n) of section 2209 of the Homeland 

12 Security Act of 2002 to coordinate vulnerability disclo13 sures, including disclosures of cybersecurity vulnerabilities 

14 (as such term is defined in such section), and subsection 

15 (o) of such section (as added by section 2) to disseminate 

16 actionable protocols to mitigate cybersecurity 

17 vulnerabilities to information systems and industrial con18 trol systems, that includes the following: 

19 (1) A description of the policies and procedures 

20 relating to the coordination of vulnerability disclo21 sures. 

22 (2) A description of the levels of activity in fur23 therance of such subsections (n) and (o) of such sec24 tion 2209. 


kjohnson on DSK79L0C42PROD with BILLS
5 

HR 2980 RFS

1 (3) Any plans to make further improvements to 

2 how information provided pursuant to such sub3 sections can be shared (as such term is defined in 

4 such section 2209) between the Department and in5 dustry and other stakeholders. 

6 (4) Any available information on the degree to 

7 which such information was acted upon by industry 

8 and other stakeholders. 

9 (5) A description of how privacy and civil lib10 erties are preserved in the collection, retention, use, 

11 and sharing of vulnerability disclosures. 

12 (b) FORM.—The report required under subsection (b) 

13 shall be submitted in unclassified form but may contain 

14 a classified annex. 

15 SEC. 4. COMPETITION RELATING TO CYBERSECURITY 

16 VULNERABILITIES. 

17 The Under Secretary for Science and Technology of 

18 the Department of Homeland Security, in consultation 

19 with the Director of the Cybersecurity and Infrastructure 

20 Security Agency of the Department, may establish an in21 centive-based program that allows industry, individuals, 

22 academia, and others to compete in identifying remedi23 ation solutions for cybersecurity vulnerabilities (as such 

24 term is defined in section 2209 of the Homeland Security 

25 Act of 2002, as amended by section 2) to information sysVerDate Sep 11 2014 02:19 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H2980.RFS H2980

kjohnson on DSK79L0C42PROD with BILLS
6 

HR 2980 RFS

1 tems (as such term is defined in such section 2209) and 

2 industrial control systems, including supervisory control 

3 and data acquisition systems. 

4 SEC. 5. TITLE XXII TECHNICAL AND CLERICAL AMEND5 MENTS. 

6 (a) TECHNICAL AMENDMENTS.— 

7 (1) HOMELAND SECURITY ACT OF 2002.—Sub8 title A of title XXII of the Homeland Security Act 

9 of 2002 (6 U.S.C. 651 et seq.) is amended— 

10 (A) in the first section 2215 (6 U.S.C. 

11 665; relating to the duties and authorities relat12 ing to .gov internet domain), by amending the 

13 section enumerator and heading to read as fol14 lows: 

15 ‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 

16 INTERNET DOMAIN.’’; 

17 (B) in the second section 2215 (6 U.S.C. 

18 665b; relating to the joint cyber planning of19 fice), by amending the section enumerator and 

20 heading to read as follows: 

21 ‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 

22 (C) in the third section 2215 (6 U.S.C. 

23 665c; relating to the Cybersecurity State Coor24 dinator), by amending the section enumerator 

25 and heading to read as follows: 


kjohnson on DSK79L0C42PROD with BILLS
7 

HR 2980 RFS

1 ‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 

2 (D) in the fourth section 2215 (6 U.S.C. 

3 665d; relating to Sector Risk Management 

4 Agencies), by amending the section enumerator 

5 and heading to read as follows: 

6 ‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 

7 (E) in section 2216 (6 U.S.C. 665e; relat8 ing to the Cybersecurity Advisory Committee), 

9 by amending the section enumerator and head10 ing to read as follows: 

11 ‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; and 

12 (F) in section 2217 (6 U.S.C. 665f; relat13 ing to Cybersecurity Education and Training 

14 Programs), by amending the section enu15 merator and heading to read as follows: 

16 ‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 

17 PROGRAMS.’’. 

18 (2) CONSOLIDATED APPROPRIATIONS ACT, 

19 2021.—Paragraph (1) of section 904(b) of division U 

20 of the Consolidated Appropriations Act, 2021 (Pub21 lic Law 116–260) is amended, in the matter pre22 ceding subparagraph (A), by inserting ‘‘of 2002’’ 

23 after ‘‘Homeland Security Act’’. 

24 (b) CLERICAL AMENDMENT.—The table of contents 

25 in section 1(b) of the Homeland Security Act of 2002 is 


kjohnson on DSK79L0C42PROD with BILLS
8 

HR 2980 RFS

1 amended by striking the items relating to sections 2214 

2 through 2217 and inserting the following new items: 

‘‘Sec. 2214. National Asset Database. 

‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 

‘‘Sec. 2216. Joint cyber planning office. 

‘‘Sec. 2217. Cybersecurity State Coordinator. 

‘‘Sec. 2218. Sector Risk Management Agencies. 

‘‘Sec. 2219. Cybersecurity Advisory Committee. 

‘‘Sec. 2220. Cybersecurity Education and Training Programs.’’. 

Passed the House of Representatives July 20, 2021. 

Attest: CHERYL L. JOHNSON, 

Clerk. 


kjohnson on DSK79L0C42PROD with BILLS