109 
year agreements entered into under subsection 
(d)(1). 
(2) REPORT.—Not later than 90 days after the 
date on which the first 1-year agreement entered 
into under subsection (d) expires, the Director of the 
Cybersecurity and Infrastructure Security Agency 
shall submit to appropriate congressional committees 
a report on— 
(A) the agreement; and 
(B) any additional agreements entered into 
with agencies under subsection (d). 
SEC. 304. ENDPOINT DETECTION AND RESPONSE AS A 
SERVICE PILOT. 
(a) PURPOSE.—The Cybersecurity and Infrastruc-
ture Security Agency is directed to establish and conduct 
a pilot to determine the feasibility, value, and efficacy of 
providing endpoint detection and response capabilities as 
a shared service to Federal agencies to reduce costs, en-
hance interoperability, and continuously detect and miti-
gate threat activity on Federal networks. 
(b) PLAN.—Not later than 90 days after the date of 
the enactment of this Act, the Director of the Cybersecu-
rity and Infrastructure Security Agency shall develop a 
plan to establish a centralized endpoint detection and re-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
110 
sponse shared service offering within the Cybersecurity 
and Infrastructure Security Agency. 
(c) CONTENTS.—The plan required under subsection 
(b) shall include considerations for— 
(1) understanding and assessing the full extent 
of endpoints across the Federal civilian environment; 
(2) maximizing the value of existing agency in-
vestments in endpoint detection and response tools 
and services; 
(3) aggregating the available contract vehicles 
and options that provide agencies with appropriate 
capability for their environment and architecture; 
(4) equipping all endpoints and services of pilot 
agencies with endpoint detection and response pro-
grams; 
(5) aggregating network, cloud, and endpoint 
data from both within the agency and across agen-
cies to provide enterprise-wide monitoring of the net-
work to detect abnormal network behavior and auto-
mate defensive capabilities; and 
(6) appropriate interagency agreements, con-
cepts of operations, and governance plans. 
(d) PILOT PROGRAM.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date on which the plan required under sub-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
111 
section (b) is developed, the Director of the Cyberse-
curity and Infrastructure Security Agency, in con-
sultation with the Director, shall enter into a 1-year 
agreement with not less than 2 agencies to offer 
endpoint detection and response as a shared service. 
(2) ADDITIONAL AGREEMENTS.—After the date 
on which the briefing required under subsection 
(e)(1) is provided, the Director of the Cybersecurity 
and Infrastructure Security Agency, in consultation 
with the Director, may enter into additional 1-year 
agreements described in paragraph (1) with agen-
cies. 
(e) BRIEFING AND REPORT.— 
(1) BRIEFING.—Not later than 270 days after 
the date of the enactment of this Act, the Director 
of the Cybersecurity and Infrastructure Security 
Agency shall provide to the Committee on Homeland 
Security and Governmental Affairs of the Senate 
and the Committee on Homeland Security and the 
Committee on Oversight and Reform of the House 
of Representatives a briefing on the parameters of 
any 1-year agreements entered into under subsection 
(d)(1). 
(2) REPORT.—Not later than 90 days after the 
date on which the first 1-year agreement entered 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
112 
into under subsection (d) expires, the Director of the 
Cybersecurity and Infrastructure Security Agency 
shall submit to the Committee on Homeland Secu-
rity and Governmental Affairs of the Senate and the 
Committee on Homeland Security and the Com-
mittee on Oversight and Reform of the House of 
Representatives a report on— 
(A) the agreement; and 
(B) any additional agreements entered into 
with agencies under subsection (d). 
Æ 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6301
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS