SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Covert Testing and 
Risk Mitigation Improvement Act of 2019’’. 
SEC. 2. TSA COVERT TESTING AND RISK MITIGATION IM-
PROVEMENT. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act and annually thereafter, 
the Administrator of the Transportation Security Admin-
istration shall implement the following: 
(1) A system for conducting risk-informed 
headquarters-based covert tests of aviation security 
operations, including relating to airport passenger 
and baggage security screening operations, that can 
yield statistically valid data that can be used to iden-
tify 
and 
assess 
the 
nature 
and 
extent 
of 
vulnerabilities to such operations that are not miti-
gated by current security practices. The Adminis-
trator shall execute annually not fewer than three 
risk-informed covert testing projects designed to 
identify systemic vulnerabilities in the transportation 
security system, and shall document the assumptions 
and rationale guiding the selection of such projects. 
(2) A long-term headquarters-based covert test-
ing program, employing static but risk-informed 
threat vectors, designed to assess changes in overall 
screening effectiveness.
(b) MITIGATION.— 
(1) IN
GENERAL.—The Administrator of the 
Transportation Security Administration shall estab-
lish a system to address and mitigate the 
vulnerabilities identified and assessed pursuant to 
the testing conducted under subsection (a). 
(2) ANALYSIS.—Not later than 60 days after 
the identification of any such vulnerability, the Ad-
ministrator shall ensure a vulnerability described in 
paragraph (1) is analyzed to determine root causes. 
(3) DETERMINATION.—Not later than 120 days 
after the identification of any such vulnerability, the 
Administrator shall make a determination regarding 
whether or not to mitigate such vulnerability. The 
Administrator 
shall 
prioritize 
mitigating 
vulnerabilities based on their ability to reduce risk. 
If the Administrator determines— 
(A) to not mitigate such vulnerability, the 
Administrator shall document the reasons for 
the decision; or 
(B) to mitigate such vulnerability, the Ad-
ministrator shall establish and document— 
(i) key milestones appropriate for the 
level of effort required to so mitigate such 
vulnerability; and
(ii) a date by which measures to so 
mitigate such vulnerability shall be imple-
mented by the Transportation Security Ad-
ministration. 
(4) RETESTING.—Not later than 180 days after 
the date on which measures to mitigate a vulner-
ability are completed by the Transportation Security 
Administration pursuant to paragraph (3)(B)(ii), the 
Administrator shall conduct a covert test in accord-
ance with subsection (a) of the aviation security op-
eration with respect to which such vulnerability was 
identified to assess the effectiveness of such meas-
ures to mitigate such vulnerability. 
(c) COMPILATION OF LISTS.— 
(1) IN GENERAL.—Not later than 60 days after 
completing a covert testing protocol under sub-
section (a), the Administrator of the Transportation 
Security Administration shall compile a list (includ-
ing a classified annex if necessary) of the 
vulnerabilities identified and assessed pursuant to 
such testing. Each such list shall contain, at a min-
imum, the following: 
(A) A brief description of the nature of 
each vulnerability so identified and assessed.
(B) The date on which each vulnerability 
was so identified and assessed. 
(C) Key milestones appropriate for the 
level of effort required to mitigate each vulner-
ability, as well as an indication of whether each 
such milestone has been met. 
(D) An indication of whether each vulner-
ability has been mitigated or reduced and, if so, 
the date on which each such vulnerability was 
so mitigated or reduced. 
(E) If a vulnerability has not been fully 
mitigated, the date by which the Administrator 
shall so mitigate such vulnerability or a deter-
mination that it is not possible to fully mitigate 
such vulnerability. 
(F) The results of any subsequent covert 
testing undertaken to assess whether mitigation 
efforts have eliminated or reduced each vulner-
ability. 
(2) SUBMISSION TO CONGRESS.—The Adminis-
trator shall submit to the Committee on Homeland 
Security of the House of Representatives and the 
Committee on Commerce, Science, and Transpor-
tation of the Senate a comprehensive document 
tracking the status of the information required
under paragraph (1) together with the Transpor-
tation Security Administration’s annual budget re-
quest. 
(d) GAO REVIEW.—Not later than 3 years after the 
date of the enactment of this Act, the Comptroller General 
of the United States shall review and submit to the Ad-
ministrator of the Transportation Security Administration 
and the Committee on Homeland Security of the House 
of Representatives and the Committee on Commerce, 
Science, and Transportation of the Senate a report on the 
effectiveness of the Transportation Security Administra-
tion’s processes for conducting covert testing projects that 
yield statistically valid data that can be used to assess the 
nature and extent of vulnerabilities to aviation security op-
erations that are not effectively mitigated by current secu-
rity operations. 
Passed the House of Representatives December 9, 
2019. 
Attest: 
Clerk.
116TH CONGRESS 
1ST SESSION 
H. R. 3469 
AN ACT 
To direct the Transportation Security Administra-
tion to carry out covert testing and risk mitiga-
tion improvement of aviation security operations, 
and for other purposes.