I 

117TH CONGRESS 

1ST SESSION H. R. 2980 

To amend the Homeland Security Act of 2002 to provide for the remediation 

of cybersecurity vulnerabilities, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MAY 4, 2021 

Ms. JACKSON LEE introduced the following bill; which was referred to the 

Committee on Homeland Security 

A BILL 

To amend the Homeland Security Act of 2002 to provide 

for the remediation of cybersecurity vulnerabilities, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity Vulner5 ability Remediation Act’’. 

6 SEC. 2. CYBERSECURITY VULNERABILITIES. 

7 Section 2209 of the Homeland Security Act of 2002 

8 (6 U.S.C. 659) is amended— 

9 (1) in subsection (a)— 


SSpencer on DSK126QN23PROD with BILLS
2 

•HR 2980 IH

1 (A) in paragraph (5), by striking ‘‘and’’ 

2 after the semicolon at the end; 

3 (B) by redesignating paragraph (6) as 

4 paragraph (7); and 

5 (C) by inserting after paragraph (5) the 

6 following new paragraph: 

7 ‘‘(6) the term ‘cybersecurity vulnerability’ has 

8 the meaning given the term ‘security vulnerability’ 

9 in section 102 of the Cybersecurity Information 

10 Sharing Act of 2015 (6 U.S.C. 1501); and’’. 

11 (2) in subsection (c)— 

12 (A) in paragraph (5)— 

13 (i) in subparagraph (A), by striking 

14 ‘‘and’’ after the semicolon at the end; 

15 (ii) by redesignating subparagraph 

16 (B) as subparagraph (C); 

17 (iii) by inserting after subparagraph 

18 (A) the following new subparagraph: 

19 ‘‘(B) sharing mitigation protocols to counter cy20 bersecurity vulnerabilities pursuant to subsection 

21 (n); and’’; and 

22 (iv) in subparagraph (C), as so redes23 ignated, by inserting ‘‘and mitigation pro24 tocols to counter cybersecurity vulnerabiliVerDate Sep 11 2014 01:47 May 14, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H2980.IH H2980

SSpencer on DSK126QN23PROD with BILLS
3 

•HR 2980 IH

1 ties in accordance with subparagraph (B)’’ 

2 before ‘‘with Federal’’; 

3 (B) in paragraph (7)(C), by striking 

4 ‘‘sharing’’ and inserting ‘‘share’’; and 

5 (C) in paragraph (9), by inserting ‘‘mitiga6 tion protocols to counter cybersecurity 

7 vulnerabilities,’’ after ‘‘measures,’’; 

8 (3) in subsection (e)(1)(G), by striking the 

9 semicolon after ‘‘and’’ at the end; and 

10 (4) by adding at the end the following new sub11 section: 

12 ‘‘(n) PROTOCOLS TO COUNTER CYBERSECURITY

13 VULNERABILITIES.—The Director may, as appropriate, 

14 identify, develop, and disseminate actionable protocols to 

15 mitigate cybersecurity vulnerabilities, including in cir16 cumstances in which such vulnerabilities exist because 

17 software or hardware is no longer supported by a ven18 dor.’’. 

19 SEC. 3. REPORT ON CYBERSECURITY VULNERABILITIES. 

20 (a) REPORT.—Not later than one year after the date 

21 of the enactment of this Act, the Director of the Cyberse22 curity and Infrastructure Security Agency of the Depart23 ment of Homeland Security shall submit to the Committee 

24 on Homeland Security of the House of Representatives 

25 and the Committee on Homeland Security and GovernVerDate Sep 11 2014 01:47 May 14, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H2980.IH H2980

SSpencer on DSK126QN23PROD with BILLS
4 

•HR 2980 IH

1 mental Affairs of the Senate a report on how the Agency 

2 carries out subsection (m) of section 2209 of the Home3 land Security Act of 2002 to coordinate vulnerability dis4 closures, including disclosures of cybersecurity vulnerabili5 ties (as such term is defined in such section), and sub6 section (n) of such section (as added by section 2) to dis7 seminate actionable protocols to mitigate cybersecurity 

8 vulnerabilities, that includes the following: 

9 (1) A description of the policies and procedures 

10 relating to the coordination of vulnerability disclo11 sures. 

12 (2) A description of the levels of activity in fur13 therance of such subsections (m) and (n) of such 

14 section 2209. 

15 (3) Any plans to make further improvements to 

16 how information provided pursuant to such sub17 sections can be shared (as such term is defined in 

18 such section 2209) between the Department and in19 dustry and other stakeholders. 

20 (4) Any available information on the degree to 

21 which such information was acted upon by industry 

22 and other stakeholders. 

23 (5) A description of how privacy and civil lib24 erties are preserved in the collection, retention, use, 

25 and sharing of vulnerability disclosures. 


SSpencer on DSK126QN23PROD with BILLS
5 

•HR 2980 IH

1 (b) FORM.—The report required under subsection (b) 

2 shall be submitted in unclassified form but may contain 

3 a classified annex. 

4 SEC. 4. COMPETITION RELATING TO CYBERSECURITY 

5 VULNERABILITIES. 

6 The Under Secretary for Science and Technology of 

7 the Department of Homeland Security, in consultation 

8 with the Director of the Cybersecurity and Infrastructure 

9 Security Agency of the Department, may establish an in10 centive-based program that allows industry, individuals, 

11 academia, and others to compete in providing remediation 

12 solutions for cybersecurity vulnerabilities (as such term is 

13 defined in section 2209 of the Homeland Security Act of 

14 2002, as amended by section 2). 

Æ 


SSpencer on DSK126QN23PROD with BILLS