IIB 
115TH CONGRESS 
2D SESSION 
H. R. 6735 
IN THE SENATE OF THE UNITED STATES 
SEPTEMBER 26, 2018 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To direct the Secretary of Homeland Security to establish 
a vulnerability disclosure policy for Department of Home-
land Security internet websites, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
02:17 Sep 27, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6735.RFS
H6735
dlhill on DSK3GLQ082PROD with BILLS
HR 6735 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Public-Private Cyber-
security Cooperation Act’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY DISCLO-
SURE OF SECURITY VULNERABILITIES. 
(a) VULNERABILITY DISCLOSURE POLICY.—The Sec-
retary of Homeland Security shall establish a policy appli-
cable to individuals, organizations, and companies that re-
port security vulnerabilities on appropriate information 
systems of Department of Homeland Security. Such policy 
shall include each of the following: 
(1) The appropriate information systems of the 
Department that individuals, organizations, and 
companies may use to discover and report security 
vulnerabilities on appropriate information systems. 
(2) The conditions and criteria under which in-
dividuals, organizations, and companies may operate 
to discover and report security vulnerabilities. 
(3) How individuals, organizations, and compa-
nies may disclose to the Department security 
vulnerabilities discovered on appropriate information 
systems of the Department. 
(4) The ways in which the Department may 
communicate with individuals, organizations, and 
companies that report security vulnerabilities. 
VerDate Sep 11 2014 
02:17 Sep 27, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6735.RFS
H6735
dlhill on DSK3GLQ082PROD with BILLS
HR 6735 RFS
(5) The process the Department shall use for 
public disclosure of reported security vulnerabilities. 
(b) REMEDIATION
PROCESS.—The Secretary of 
Homeland Security shall develop a process for the Depart-
ment of Homeland Security to address the mitigation or 
remediation of the security vulnerabilities reported 
through the policy developed in subsection (a). 
(c) CONSULTATION.—In developing the security vul-
nerability disclosure policy under subsection (a), the Sec-
retary of Homeland Security shall consult with each of the 
following: 
(1) The Attorney General regarding how to en-
sure that individuals, organizations, and companies 
that comply with the requirements of the policy de-
veloped under subsection (a) are protected from 
prosecution under section 1030 of title 18, United 
States Code, civil lawsuits, and similar provisions of 
law with respect to specific activities authorized 
under the policy. 
(2) The Secretary of Defense and the Adminis-
trator of General Services regarding lessons that 
may be applied from existing vulnerability disclosure 
policies. 
(3) Non-governmental security researchers. 
VerDate Sep 11 2014 
02:17 Sep 27, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6735.RFS
H6735
dlhill on DSK3GLQ082PROD with BILLS
HR 6735 RFS
(d) PUBLIC AVAILABILITY.—The Secretary of Home-
land Security shall make the policy developed under sub-
section (a) publicly available. 
(e) SUBMISSION TO CONGRESS.— 
(1) DISCLOSURE
POLICY
AND
REMEDIATION 
PROCESS.—Not later than 90 days after the date of 
the enactment of this Act, the Secretary of Home-
land Security shall submit to Congress a copy of the 
policy required under subsection (a) and the remedi-
ation process required under subsection (b). 
(2) REPORT AND BRIEFING.— 
(A) REPORT.—Not later than one year 
after establishing the policy required under sub-
section (a), the Secretary of Homeland Security 
shall submit to Congress a report on such pol-
icy and the remediation process required under 
subsection (b). 
(B) ANNUAL BRIEFINGS.—One year after 
the date of the submission of the report under 
subparagraph (A), and annually thereafter for 
each of the next three years, the Secretary of 
Homeland Security shall provide to Congress a 
briefing on the policy required under subsection 
(a) and the process required under subsection 
(b). 
VerDate Sep 11 2014 
02:17 Sep 27, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6735.RFS
H6735
dlhill on DSK3GLQ082PROD with BILLS
HR 6735 RFS
(2) The term ‘‘information system’’ has the 
meaning given that term by section 3502(12) of title 
44, United States Code. 
(3) The term ‘‘appropriate information system’’ 
means an information system that the Secretary of 
Homeland Security selects for inclusion under the 
vulnerability disclosure policy required by subsection 
(a). 
Passed the House of Representatives September 25, 
2018. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Sep 11 2014 
02:17 Sep 27, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6735.RFS
H6735
dlhill on DSK3GLQ082PROD with BILLS