IIB 
115TH CONGRESS 
2D SESSION 
H. R. 6443 
IN THE SENATE OF THE UNITED STATES 
SEPTEMBER 5, 2018 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend the Homeland Security Act of 2002 to authorize 
the Secretary of Homeland Security to establish a contin-
uous diagnostics and mitigation program at the Depart-
ment of Homeland Security, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
23:51 Sep 05, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.RFS
H6443
pbinns on DSK79D2C42PROD with BILLS
HR 6443 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Advancing Cybersecu-
rity Diagnostics and Mitigation Act’’. 
SEC. 2. ESTABLISHMENT OF CONTINUOUS DIAGNOSTICS 
AND MITIGATION PROGRAM IN DEPARTMENT 
OF HOMELAND SECURITY. 
(a) IN GENERAL.—Section 230 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 151) is amended by adding 
at the end the following new subsection: 
‘‘(g) CONTINUOUS DIAGNOSTICS AND MITIGATION.— 
‘‘(1) PROGRAM.— 
‘‘(A) IN
GENERAL.—The Secretary shall 
deploy, operate, and maintain a continuous 
diagnostics and mitigation program. Under 
such program, the Secretary shall— 
‘‘(i) develop and provide the capability 
to collect, analyze, and visualize informa-
tion relating to security data and cyberse-
curity risks; 
‘‘(ii) make program capabilities avail-
able for use, with or without reimburse-
ment; 
‘‘(iii) employ shared services, collective 
purchasing, blanket purchase agreements, 
and any other economic or procurement 
models the Secretary determines appro-
VerDate Sep 11 2014 
23:51 Sep 05, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.RFS
H6443
pbinns on DSK79D2C42PROD with BILLS
HR 6443 RFS
priate to maximize the costs savings asso-
ciated with implementing an information 
system; 
‘‘(iv) assist entities in setting informa-
tion security priorities and managing cy-
bersecurity risks; and 
‘‘(v) develop policies and procedures 
for reporting systemic cybersecurity risks 
and potential incidents based upon data 
collected under such program. 
‘‘(B) REGULAR IMPROVEMENT.—The Sec-
retary shall regularly deploy new technologies 
and modify existing technologies to the contin-
uous diagnostics and mitigation program re-
quired under subparagraph (A), as appropriate, 
to improve the program. 
‘‘(2) ACTIVITIES.—In carrying out the contin-
uous diagnostics and mitigation program under 
paragraph (1), the Secretary shall ensure, to the ex-
tent practicable, that— 
‘‘(A) timely, actionable, and relevant cyber-
security risk information, assessments, and 
analysis are provided in real time; 
‘‘(B) share the analysis and products de-
veloped under such program; 
VerDate Sep 11 2014 
23:51 Sep 05, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.RFS
H6443
pbinns on DSK79D2C42PROD with BILLS
HR 6443 RFS
‘‘(C) all information, assessments, anal-
yses, and raw data under such program is made 
available to the national cybersecurity and com-
munications integration center of the Depart-
ment; and 
‘‘(D) provide regular reports on cybersecu-
rity risks.’’. 
(b) CONTINUOUS DIAGNOSTICS
AND MITIGATION 
STRATEGY.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Sec-
retary of Homeland Security shall develop a com-
prehensive continuous diagnostics and mitigation 
strategy to carry out the continuous diagnostics and 
mitigation program required under subsection (g) of 
section 230 of such Act, as added by subsection (a). 
(2) SCOPE.—The strategy required under para-
graph (1) shall include the following: 
(A) A description of the continuous 
diagnostics and mitigation program, including 
efforts by the Secretary of Homeland Security 
to assist with the deployment of program tools, 
capabilities, and services, from the inception of 
the program referred to in paragraph (1) to the 
date of the enactment of this Act. 
VerDate Sep 11 2014 
23:51 Sep 05, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.RFS
H6443
pbinns on DSK79D2C42PROD with BILLS
HR 6443 RFS
(B) A description of the coordination re-
quired to deploy, install, and maintain the tools, 
capabilities, and services that the Secretary of 
Homeland Security determines to be necessary 
to satisfy the requirements of such program. 
(C) A description of any obstacles facing 
the deployment, installation, and maintenance 
of tools, capabilities, and services under such 
program. 
(D) Recommendations and guidelines to 
help maintain and continuously upgrade tools, 
capabilities, and services provided under such 
program. 
(E) Recommendations for using the data 
collected by such program for creating a com-
mon framework for data analytics, visualization 
of enterprise-wide risks, and real-time report-
ing. 
(F) Recommendations for future efforts 
and activities, including for the rollout of new 
tools, 
capabilities 
and 
services, 
proposed 
timelines for delivery, and whether to continue 
the use of phased rollout plans, related to se-
curing networks, devices, data, and information 
VerDate Sep 11 2014 
23:51 Sep 05, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.RFS
H6443
pbinns on DSK79D2C42PROD with BILLS
HR 6443 RFS
technology assets through the use of such pro-
gram. 
(3) FORM.—The strategy required under sub-
paragraph (A) shall be submitted in an unclassified 
form, but may contain a classified annex. 
(c) REPORT.—Not later than 90 days after the devel-
opment of the strategy required under subsection (b), the 
Secretary of Homeland Security shall submit to the Com-
mittee on Homeland Security and Governmental Affairs 
of the Senate and the Committee on Homeland Security 
of the House of Representative a report on cybersecurity 
risk posture based on the data collected through the con-
tinuous diagnostics and mitigation program under sub-
section (g) of section 230 of the Homeland Security Act 
of 2002, as added by subsection (a). 
Passed the House of Representatives September 4, 
2018. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Sep 11 2014 
23:51 Sep 05, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.RFS
H6443
pbinns on DSK79D2C42PROD with BILLS