IB 
Union Calendar No. 706 
115TH CONGRESS 
2D SESSION 
H. R. 6443 
[Report No. 115–910] 
To amend the Homeland Security Act of 2002 to authorize the Secretary 
of Homeland Security to establish a continuous diagnostics and mitiga-
tion program at the Department of Homeland Security, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 19, 2018 
Mr. RATCLIFFE (for himself, Mr. RICHMOND, Mr. MCCAUL, Mr. KATKO, and 
Mr. FITZPATRICK) introduced the following bill; which was referred to the 
Committee on Homeland Security 
AUGUST 28, 2018 
Additional sponsor: Mr. DONOVAN 
AUGUST 28, 2018 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on July 19, 2018] 
VerDate Sep 11 2014 
20:40 Aug 28, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H6443.RH
H6443
daltland on DSKBBV9HB2PROD with BILLS
A BILL 
To amend the Homeland Security Act of 2002 to authorize 
the Secretary of Homeland Security to establish a contin-
uous diagnostics and mitigation program at the Depart-
ment of Homeland Security, and for other purposes. 
VerDate Sep 11 2014 
20:40 Aug 28, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H6443.RH
H6443
daltland on DSKBBV9HB2PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Advancing Cybersecu-
rity Diagnostics and Mitigation Act’’. 
SEC. 2. ESTABLISHMENT OF CONTINUOUS DIAGNOSTICS 
AND MITIGATION PROGRAM IN DEPARTMENT 
OF HOMELAND SECURITY. 
(a) IN GENERAL.—Section 230 of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 151) is amended by adding at 
the end the following new subsection: 
‘‘(g) CONTINUOUS DIAGNOSTICS AND MITIGATION.— 
‘‘(1) PROGRAM.— 
‘‘(A) IN GENERAL.—The Secretary shall de-
ploy, operate, and maintain a continuous 
diagnostics and mitigation program. Under such 
program, the Secretary shall— 
‘‘(i) develop and provide the capability 
to collect, analyze, and visualize informa-
tion relating to security data and cybersecu-
rity risks; 
‘‘(ii) make program capabilities avail-
able for use, with or without reimbursement; 
‘‘(iii) employ shared services, collective 
purchasing, blanket purchase agreements, 
VerDate Sep 11 2014 
20:40 Aug 28, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H6443.RH
H6443
daltland on DSKBBV9HB2PROD with BILLS
and any other economic or procurement 
models the Secretary determines appro-
priate to maximize the costs savings associ-
ated with implementing an information 
system; 
‘‘(iv) assist entities in setting informa-
tion security priorities and managing cy-
bersecurity risks; and 
‘‘(v) develop policies and procedures for 
reporting systemic cybersecurity risks and 
potential incidents based upon data col-
lected under such program. 
‘‘(B) REGULAR
IMPROVEMENT.—The Sec-
retary shall regularly deploy new technologies 
and modify existing technologies to the contin-
uous diagnostics and mitigation program re-
quired under subparagraph (A), as appropriate, 
to improve the program. 
‘‘(2) ACTIVITIES.—In carrying out the contin-
uous diagnostics and mitigation program under 
paragraph (1), the Secretary shall ensure, to the ex-
tent practicable, that— 
‘‘(A) timely, actionable, and relevant cyber-
security risk information, assessments, and anal-
ysis are provided in real time; 
VerDate Sep 11 2014 
20:40 Aug 28, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H6443.RH
H6443
daltland on DSKBBV9HB2PROD with BILLS
‘‘(B) share the analysis and products devel-
oped under such program; 
‘‘(C) all information, assessments, analyses, 
and raw data under such program is made 
available to the national cybersecurity and com-
munications integration center of the Depart-
ment; and 
‘‘(D) provide regular reports on cybersecu-
rity risks.’’. 
(b) CONTINUOUS
DIAGNOSTICS
AND
MITIGATION 
STRATEGY.— 
(1) IN GENERAL.—Not later than 180 days after 
the date of the enactment of this Act, the Secretary of 
Homeland Security shall develop a comprehensive 
continuous diagnostics and mitigation strategy to 
carry out the continuous diagnostics and mitigation 
program required under subsection (g) of section 230 
of such Act, as added by subsection (a). 
(2) SCOPE.—The strategy required under para-
graph (1) shall include the following: 
(A) 
A 
description 
of 
the 
continuous 
diagnostics and mitigation program, including 
efforts by the Secretary of Homeland Security to 
assist with the deployment of program tools, ca-
pabilities, and services, from the inception of the 
VerDate Sep 11 2014 
20:40 Aug 28, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H6443.RH
H6443
daltland on DSKBBV9HB2PROD with BILLS
program referred to in paragraph (1) to the date 
of the enactment of this Act. 
(B) A description of the coordination re-
quired to deploy, install, and maintain the tools, 
capabilities, and services that the Secretary of 
Homeland Security determines to be necessary to 
satisfy the requirements of such program. 
(C) A description of any obstacles facing the 
deployment, installation, and maintenance of 
tools, capabilities, and services under such pro-
gram. 
(D) Recommendations and guidelines to 
help maintain and continuously upgrade tools, 
capabilities, and services provided under such 
program. 
(E) Recommendations for using the data 
collected by such program for creating a common 
framework for data analytics, visualization of 
enterprise-wide risks, and real-time reporting. 
(F) Recommendations for future efforts and 
activities, including for the rollout of new tools, 
capabilities and services, proposed timelines for 
delivery, and whether to continue the use of 
phased rollout plans, related to securing net-
VerDate Sep 11 2014 
20:40 Aug 28, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H6443.RH
H6443
daltland on DSKBBV9HB2PROD with BILLS
works, devices, data, and information technology 
assets through the use of such program. 
(3) FORM.—The strategy required under sub-
paragraph (A) shall be submitted in an unclassified 
form, but may contain a classified annex. 
(c) REPORT.—Not later than 90 days after the develop-
ment of the strategy required under subsection (b), the Sec-
retary of Homeland Security shall submit to the Committee 
on Homeland Security and Governmental Affairs of the 
Senate and the Committee on Homeland Security of the 
House of Representative a report on cybersecurity risk pos-
ture based on the data collected through the continuous 
diagnostics and mitigation program under subsection (g) 
of section 230 of the Homeland Security Act of 2002, as 
added by subsection (a). 
VerDate Sep 11 2014 
20:40 Aug 28, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H6443.RH
H6443
daltland on DSKBBV9HB2PROD with BILLS
Union Calendar No. 706 
115TH CONGRESS 
2D SESSION 
H. R. 6443 
[Report No. 115–910] 
A BILL 
To amend the Homeland Security Act of 2002 to 
authorize the Secretary of Homeland Security to 
establish a continuous diagnostics and mitigation 
program at the Department of Homeland Secu-
rity, and for other purposes. 
AUGUST 28, 2018 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
20:40 Aug 28, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\H6443.RH
H6443
daltland on DSKBBV9HB2PROD with BILLS