the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate of the results 
of such review. 
‘‘(10) RESOURCE ASSESSMENT.—Not later than 
120 days after the date of the enactment of this 
subsection, the Director shall submit to the Com-
mittee on Homeland Security of the House of Rep-
resentatives and the Committee on Homeland Secu-
rity and Governmental Affairs of the Senate an as-
sessment regarding whether additional resources are 
required to— 
‘‘(A)(i) ensure timely notifications to enti-
ties at risk pursuant to paragraph (6); and 
‘‘(ii) provide such entities at risk with 
timely 
support 
to 
mitigate 
security 
vulnerabilities; and 
‘‘(B) provide associated training applicable 
to employees and operations of the Agency to 
comply with internal procedures established 
pursuant to paragraph (8). 
‘‘(11) PUBLICATION
OF
INFORMATION.—Not 
later than 120 days after establishing the internal 
procedures and policies under paragraph (8), the Di-
rector shall make publicly available, including on a 
Department website, information regarding the sub-
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
poena process under this subsection, including re-
garding the following: 
‘‘(A) The purpose for subpoenas issued 
under this subsection. 
‘‘(B) The subpoena process. 
‘‘(C) The criteria for the critical infra-
structure security risk assessment conducted 
prior to issuing a subpoena. 
‘‘(D) Policies and procedures on retention 
and sharing of data obtained by a subpoena. 
‘‘(E) The process for providing notice to 
each entity at risk identified by information ob-
tained pursuant to a subpoena issued under 
this subsection, and contact information that 
such an entity may use to confirm the authen-
ticity of such notice. 
‘‘(F) Guidelines on how entities at risk 
contacted by the Director may respond to notice 
of a subpoena. 
‘‘(G) The internal procedures of the Agen-
cy established pursuant to paragraph (8). 
‘‘(12) ANNUAL REPORTS.—Not later than six 
months after the establishment of the internal proce-
dures and associated training pursuant to paragraph 
(8) and annually thereafter, the Director shall sub-
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
mit to the Committee on Homeland Security and 
Governmental Affairs of the Senate and the Com-
mittee on Homeland Security of the House of Rep-
resentatives a report (which may include a classified 
annex but with the presumption of declassification) 
on the use of subpoenas under this subsection by the 
Director, which shall include the following: 
‘‘(A) A discussion of the following: 
‘‘(i) The effectiveness of the use of 
subpoenas 
to 
mitigate 
security 
vulnerabilities. 
‘‘(ii) The critical infrastructure secu-
rity risk assessment process conducted for 
subpoenas issued under this subsection. 
‘‘(iii) The number of subpoenas issued 
under this subsection by the Director dur-
ing the preceding year. 
‘‘(iv) To the extent practicable, the 
number of vulnerable enterprise devices or 
systems mitigated under this subsection by 
the Agency during the preceding year. 
‘‘(v) The number of entities notified 
by the Director under this subsection, and 
their responses, during the preceding year. 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) For each subpoena issued under this 
subsection, the following: 
‘‘(i) The source of the security vulner-
ability at issue detected, identified, or re-
ceived by the Director. 
‘‘(ii) A description of the efforts un-
dertaken to identify the entity at risk prior 
to issuing each such subpoena. 
‘‘(iii) A description of the outcome of 
each such subpoena, including discussion 
regarding the resolution or mitigation of 
the security vulnerability at issue. 
‘‘(iv) A description of any additional 
support provided by the Director to the en-
tity at risk. 
‘‘(13) PUBLICATION
OF
THE
ANNUAL
RE-
PORTS.—The Director shall make publicly available 
a version of each annual report required under para-
graph (12), which shall at a minimum include the 
findings described in clause (iii), (iv), and (v) of this 
subsection of such paragraph. 
‘‘(14) DHS INSPECTOR
GENERAL
REPORT.— 
Not later than one year after the date of the enact-
ment of this subsection, the Inspector General of the 
Department shall submit to the Committee on 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
Homeland Security of the House of Representatives 
and the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate a report evaluating 
the Agency’s compliance with the following: 
‘‘(A) The inter-agency procedures estab-
lished under paragraph (4). 
‘‘(B) The internal procedures and associ-
ated training established pursuant to paragraph 
(8).’’. 
Æ 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6301
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS