I 
116TH CONGRESS 
1ST SESSION H. R. 4237 
To amend the Homeland Security Act of 2002 to authorize the Secretary 
of Homeland Security to establish a continuous diagnostics and mitiga-
tion program in the Cybersecurity and Infrastructure Security Agency 
of the Department of Homeland Security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 6, 2019 
Mr. RATCLIFFE (for himself and Mr. KHANNA) introduced the following bill; 
which was referred to the Committee on Oversight and Reform, and in 
addition to the Committee on Homeland Security, for a period to be sub-
sequently determined by the Speaker, in each case for consideration of 
such provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To amend the Homeland Security Act of 2002 to authorize 
the Secretary of Homeland Security to establish a contin-
uous diagnostics and mitigation program in the Cyberse-
curity and Infrastructure Security Agency of the Depart-
ment of Homeland Security, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Advancing Cybersecu-
rity Diagnostics and Mitigation Act’’. 
VerDate Sep 11 2014 
21:07 Sep 06, 2019
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4237.IH
H4237
pamtmann on DSKBC07HB2PROD with BILLS
SEC. 2. ESTABLISHMENT OF CONTINUOUS DIAGNOSTICS 
AND MITIGATION PROGRAM IN THE CYBER-
SECURITY AND INFRASTRUCTURE SECURITY 
AGENCY. 
(a) IN GENERAL.—Section 2213 of the Homeland 
Security Act of 2002 (6 U.S.C. 663) is amended by adding 
at the end the following: 
‘‘(g) CONTINUOUS DIAGNOSTICS AND MITIGATION.— 
‘‘(1) PROGRAM.— 
‘‘(A) IN GENERAL.—The Secretary, acting 
through the Director of Cybersecurity and In-
frastructure Security, shall deploy, operate, and 
maintain a continuous diagnostics and mitiga-
tion program for agencies. Under such pro-
gram, the Secretary shall— 
‘‘(i) assist agencies to continuously di-
agnose and mitigate cyber threats and 
vulnerabilities; 
‘‘(ii) develop and provide the capa-
bility to collect, analyze, and visualize in-
formation relating to security data and cy-
bersecurity risks at agencies; 
‘‘(iii) make program capabilities avail-
able for use, with or without reimburse-
ment, to civilian agencies and State, local, 
Tribal, and territorial governments; 
VerDate Sep 11 2014 
21:07 Sep 06, 2019
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4237.IH
H4237
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(iv) employ shared services, collective 
purchasing, blanket purchase agreements, 
and any other economic or procurement 
models the Secretary determines appro-
priate to maximize the costs savings asso-
ciated with implementing an information 
system; 
‘‘(v) assist entities in setting informa-
tion security priorities and assessing and 
managing cybersecurity risks; and 
‘‘(vi) develop policies and procedures 
for reporting systemic cybersecurity risks 
and potential incidents based upon data 
collected under such program. 
‘‘(B) REGULAR IMPROVEMENT.—The Sec-
retary shall regularly deploy new technologies 
and modify existing technologies to the contin-
uous diagnostics and mitigation program re-
quired under subparagraph (A), as appropriate, 
to improve the program. 
‘‘(2) 
AGENCY
RESPONSIBILITIES.—Notwith-
standing any other provision of law, each agency 
that uses the continuous diagnostics and mitigation 
program under paragraph (1) shall, continuously 
and in real time, provide to the Secretary all infor-
VerDate Sep 11 2014 
21:07 Sep 06, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4237.IH
H4237
pamtmann on DSKBC07HB2PROD with BILLS
mation, assessments, analyses, and raw data col-
lected by the program, in a manner specified by the 
Secretary. 
‘‘(3) RESPONSIBILITIES OF THE SECRETARY.— 
In carrying out the continuous diagnostics and miti-
gation program under paragraph (1), the Secretary 
shall, as appropriate— 
‘‘(A) share with agencies relevant analysis 
and products developed under such program; 
‘‘(B) provide regular reports on cybersecu-
rity risks to agencies; and 
‘‘(C) provide comparative assessments of 
cybersecurity risks for agencies.’’. 
(b) CONTINUOUS DIAGNOSTICS
AND MITIGATION 
STRATEGY.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Sec-
retary of Homeland Security shall develop a com-
prehensive continuous diagnostics and mitigation 
strategy to carry out the continuous diagnostics and 
mitigation program required under subsection (g) of 
section 2213 of the Homeland Security Act of 2002 
(6 U.S.C. 663), as added by subsection (a). 
(2) SCOPE.—The strategy required under para-
graph (1) shall include the following: 
VerDate Sep 11 2014 
21:07 Sep 06, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4237.IH
H4237
pamtmann on DSKBC07HB2PROD with BILLS
ing, and comparative assessments for cyberse-
curity risks. 
(F) Recommendations for future efforts 
and activities, including for the rollout of new 
and emerging tools, capabilities and services, 
proposed timelines for delivery, and whether to 
continue the use of phased rollout plans, related 
to securing networks, devices, data, and infor-
mation 
and 
operational 
technology 
assets 
through the use of such program. 
(3) FORM.—The strategy required under para-
graph (1) shall be submitted in an unclassified form, 
but may contain a classified annex. 
(c) REPORT.—Not later than 180 days after the de-
velopment of the strategy required under subsection (b), 
the Secretary of Homeland Security shall submit to the 
Committee on Homeland Security and Governmental Af-
fairs of the Senate and the Committee on Homeland Secu-
rity of the House of Representative a report on cybersecu-
rity risk posture based on the data collected through the 
continuous diagnostics and mitigation program under sub-
section (g) of section 2213 of the Homeland Security Act 
of 2002 (6 U.S.C. 663), as added by subsection (a). 
(d) GAO REPORT.—Not later than 1 year after the 
date of enactment of this Act, the Comptroller General 
VerDate Sep 11 2014 
21:07 Sep 06, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4237.IH
H4237
pamtmann on DSKBC07HB2PROD with BILLS
of the United States shall submit a report to Congress 
on the potential impacts and benefits of replacing the re-
porting requirements under chapter 35 of title 44, United 
States Code, with periodical real-time data provided by the 
continuous diagnostics and mitigation program under sub-
section (g) of section 2213 of the Homeland Security Act 
of 2002 (6 U.S.C. 663), as added by subsection (a). 
Æ 
VerDate Sep 11 2014 
21:07 Sep 06, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6301
E:\BILLS\H4237.IH
H4237
pamtmann on DSKBC07HB2PROD with BILLS