storing, using, and retaining such informa-
tion, including by— 
‘‘(I) prohibiting sensitive infor-
mation from being saved, stored, 
transferred, or otherwise accessed 
after initial discovery; 
‘‘(II) directing that sensitive in-
formation be viewed only to the extent 
required to identify a vulnerability 
and that the information not be re-
tained; or 
‘‘(III) limiting use of information 
obtained from interacting with the 
systems or services to be explored by 
the researcher to activities directly re-
lated 
to 
reporting 
security 
vulnerabilities; 
‘‘(iv) a description of how an indi-
vidual may submit a vulnerability report 
that includes— 
‘‘(I) the location of where to send 
the report, such as a web form or 
email address; 
‘‘(II) a description of the type of 
information necessary to find and 
VerDate Sep 11 2014 
01:36 Aug 30, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5310.IH
H5310
kjohnson on DSK79L0C42PROD with BILLS
analyze the vulnerability (such as a 
description, the location, and potential 
impact of the vulnerability, the tech-
nical information needed to reproduce 
the vulnerability, and any proof of 
concept); and 
‘‘(III) a clear statement— 
‘‘(aa) that any individual 
that submits a vulnerability re-
port may do so anonymously; and 
‘‘(bb) on how and whether 
any incomplete submission is 
evaluated; 
‘‘(v) a commitment from the con-
tractor that the contractor will not pursue 
civil action for any accidental, good faith 
violation of the vulnerability disclosure pol-
icy; 
‘‘(vi) a commitment from the con-
tractor that if an individual acting in ac-
cordance with the vulnerability disclosure 
policy of the contractor is sued by a third 
party, the contractor will inform the public 
or the court that the individual was acting 
VerDate Sep 11 2014 
01:36 Aug 30, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5310.IH
H5310
kjohnson on DSK79L0C42PROD with BILLS
in compliance with the vulnerability disclo-
sure policy; 
‘‘(vii) a statement that describes the 
time frame in which the individual that 
submits a report, if known, will receive a 
notification of receipt of the report and a 
description of what steps will be taken by 
the contractor during the remediation 
process; and 
‘‘(viii) a set of guidelines that estab-
lishes what type of activity by a researcher 
are acceptable and unacceptable; and 
‘‘(B) does not— 
‘‘(i) require the submission of person-
ally identifiable information of a re-
searcher; and 
‘‘(ii) limit testing solely to entities ap-
proved by the contractor but rather au-
thorizes the public to search for and report 
any vulnerability. 
‘‘(2) A description of additional procedures that 
describe how the contractor will communicate with 
the researcher, and how and when any communica-
tion occurs. 
VerDate Sep 11 2014 
01:36 Aug 30, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5310.IH
H5310
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) A description of the target timelines for 
and tracking of the following: 
‘‘(A) Notification of receipt to the indi-
vidual that submits the report, if known. 
‘‘(B) An initial assessment, such as deter-
mining whether any disclosed vulnerability is 
valid. 
‘‘(C) Resolution of a vulnerability, includ-
ing notification of the outcome to the re-
searcher. 
‘‘(4) A page on the website of the contractor 
that— 
‘‘(A) 
allows 
for 
the 
submission 
of 
vulnerabilities by anyone relating to the infor-
mation technology; 
‘‘(B) lists the contact information, such as 
a phone number or email address for an indi-
vidual or team responsible for reviewing any 
such submission under subparagraph (A); and 
‘‘(C) describes the process by which a re-
view is conducted, including how long it will 
take for the contractor to respond to researcher 
and whether or not monetary rewards will be 
paid to the reporter for identifying a vulner-
ability. 
VerDate Sep 11 2014 
01:36 Aug 30, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5310.IH
H5310
kjohnson on DSK79L0C42PROD with BILLS
‘‘(5) In the case of a discovered vulnerability 
that the contractor is not responsible for patching, 
the contractor shall submit the vulnerability to the 
responsible party or direct the researcher to the ap-
propriate party. 
‘‘(b) REPORTING REQUIREMENTS AND METRICS.— 
Not later than 7 days after the date on which the vulner-
ability disclosure policy described in subsection (a) is pub-
lished, and on an ongoing basis as vulnerability reports 
are received, an information technology contractor shall 
report to the Cybersecurity and Infrastructure Security 
Agency of the Department of Homeland Security the fol-
lowing information: 
‘‘(1) Any valid or credible report of a not pre-
viously known public vulnerability (including any 
misconfiguration) on a system that uses commercial 
software or services that affect or are likely to affect 
other parties in government or industry once a patch 
or viable mitigation is available. 
‘‘(2) Any other situation where the contractor 
determines it would be helpful or necessary to in-
volve the Cybersecurity and Infrastructure Security 
Agency. 
‘‘(c) CISA SUBMISSION OF VULNERABILITIES.—The 
Cybersecurity and Infrastructure Security Agency shall 
VerDate Sep 11 2014 
01:36 Aug 30, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5310.IH
H5310
kjohnson on DSK79L0C42PROD with BILLS
communicate 
with 
and 
submit, 
as 
necessary, 
vulnerabilities to the MITRE Common Vulnerabilities and 
Exposures database and the National Institute of Stand-
ards and Technology National Vulnerability Database. 
‘‘(d) DEFINITIONS.—In this section: 
‘‘(1) EXECUTIVE AGENCY.—The term ‘executive 
agency’ has the meaning given that term in section 
133. 
‘‘(2) RESEARCHER.—The term ‘researcher’ 
means the individual who submits a vulnerability re-
port. 
‘‘(3) INFORMATION
TECHNOLOGY.—The term 
‘information technology’ has the meaning given that 
term in section 11101 of title 40.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of sections for chapter 47 of division C of sub-
title I of title 41, United States Code, is amended by add-
ing at the end the following new item: 
‘‘4715. Vulnerability disclosure policy and program required.’’. 
(c) APPLICABILITY.—The amendments made by this 
section shall take effect on the date of the enactment of 
this section and shall apply to any contract entered into 
on or after such effective date. 
Æ 
VerDate Sep 11 2014 
01:36 Aug 30, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H5310.IH
H5310
kjohnson on DSK79L0C42PROD with BILLS