IB 
Union Calendar No. 749 
115TH CONGRESS 
2D SESSION 
H. R. 6735 
[Report No. 115–961] 
To direct the Secretary of Homeland Security to establish a vulnerability 
disclosure policy for Department of Homeland Security internet websites, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 7, 2018 
Mr. MCCARTHY (for himself, Mr. HURD, Mr. LANGEVIN, and Mr. RATCLIFFE) 
introduced the following bill; which was referred to the Committee on 
Homeland Security 
SEPTEMBER 25, 2018 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on September 7, 2018] 
VerDate Sep 11 2014 
23:34 Sep 25, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H6735.RH
H6735
lotter on DSKBCFDHB2PROD with BILLS
A BILL 
To direct the Secretary of Homeland Security to establish 
a vulnerability disclosure policy for Department of Home-
land Security internet websites, and for other purposes. 
VerDate Sep 11 2014 
23:34 Sep 25, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H6735.RH
H6735
lotter on DSKBCFDHB2PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Public-Private Cyberse-
curity Cooperation Act’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY DISCLO-
SURE OF SECURITY VULNERABILITIES. 
(a) VULNERABILITY DISCLOSURE POLICY.—The Sec-
retary of Homeland Security shall establish a policy appli-
cable to individuals, organizations, and companies that re-
port security vulnerabilities on appropriate information 
systems of Department of Homeland Security. Such policy 
shall include each of the following: 
(1) The appropriate information systems of the 
Department that individuals, organizations, and com-
panies may use to discover and report security 
vulnerabilities on appropriate information systems. 
(2) The conditions and criteria under which in-
dividuals, organizations, and companies may operate 
to discover and report security vulnerabilities. 
(3) How individuals, organizations, and compa-
nies may disclose to the Department security 
vulnerabilities discovered on appropriate information 
systems of the Department. 
VerDate Sep 11 2014 
23:34 Sep 25, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H6735.RH
H6735
lotter on DSKBCFDHB2PROD with BILLS
(4) The ways in which the Department may 
communicate with individuals, organizations, and 
companies that report security vulnerabilities. 
(5) The process the Department shall use for 
public disclosure of reported security vulnerabilities. 
(b) REMEDIATION PROCESS.—The Secretary of Home-
land Security shall develop a process for the Department 
of Homeland Security to address the mitigation or remedi-
ation of the security vulnerabilities reported through the 
policy developed in subsection (a). 
(c) CONSULTATION.—In developing the security vul-
nerability disclosure policy under subsection (a), the Sec-
retary of Homeland Security shall consult with each of the 
following: 
(1) The Attorney General regarding how to en-
sure that individuals, organizations, and companies 
that comply with the requirements of the policy devel-
oped under subsection (a) are protected from prosecu-
tion under section 1030 of title 18, United States 
Code, civil lawsuits, and similar provisions of law 
with respect to specific activities authorized under the 
policy. 
(2) The Secretary of Defense and the Adminis-
trator of General Services regarding lessons that may 
VerDate Sep 11 2014 
23:34 Sep 25, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H6735.RH
H6735
lotter on DSKBCFDHB2PROD with BILLS
be applied from existing vulnerability disclosure poli-
cies. 
(3) Non-governmental security researchers. 
(d) PUBLIC AVAILABILITY.—The Secretary of Home-
land Security shall make the policy developed under sub-
section (a) publicly available. 
(e) SUBMISSION TO CONGRESS.— 
(1) DISCLOSURE
POLICY
AND
REMEDIATION 
PROCESS.—Not later than 90 days after the date of 
the enactment of this Act, the Secretary of Homeland 
Security shall submit to Congress a copy of the policy 
required under subsection (a) and the remediation 
process required under subsection (b). 
(2) REPORT AND BRIEFING.— 
(A) REPORT.—Not later than one year after 
establishing the policy required under subsection 
(a), the Secretary of Homeland Security shall 
submit to Congress a report on such policy and 
the remediation process required under sub-
section (b). 
(B) ANNUAL
BRIEFINGS.—One year after 
the date of the submission of the report under 
subparagraph (A), and annually thereafter for 
each of the next three years, the Secretary of 
Homeland Security shall provide to Congress a 
VerDate Sep 11 2014 
23:34 Sep 25, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H6735.RH
H6735
lotter on DSKBCFDHB2PROD with BILLS
briefing on the policy required under subsection 
(a) and the process required under subsection 
(b). 
(C) MATTERS FOR INCLUSION.—The report 
required under subparagraph (A) and the brief-
ings required under subparagraph (B) shall in-
clude each of the following with respect to the 
policy required under subsection (a) and the 
process required under subsection (b) for the pe-
riod covered by the report or briefing, as the case 
may be: 
(i) The number of unique security 
vulnerabilities reported. 
(ii) The number of previously unknown 
security vulnerabilities mitigated or remedi-
ated. 
(iii) The number of unique individ-
uals, organizations, and companies that re-
ported security vulnerabilities. 
(iv) The average length of time between 
the reporting of security vulnerabilities and 
mitigation 
or 
remediation 
of 
such 
vulnerabilities. 
(f) DEFINITIONS.—In this section: 
VerDate Sep 11 2014 
23:34 Sep 25, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H6735.RH
H6735
lotter on DSKBCFDHB2PROD with BILLS
(1) The term ‘‘security vulnerability’’ has the 
meaning given that term in section 102(17) of the Cy-
bersecurity Information Sharing Act of 2015 (6 
U.S.C. 1501(17)), in information technology. 
(2) The term ‘‘information system’’ has the 
meaning given that term by section 3502(12) of title 
44, United States Code. 
(3) The term ‘‘appropriate information system’’ 
means an information system that the Secretary of 
Homeland Security selects for inclusion under the 
vulnerability disclosure policy required by subsection 
(a). 
VerDate Sep 11 2014 
23:34 Sep 25, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H6735.RH
H6735
lotter on DSKBCFDHB2PROD with BILLS
Union Calendar No. 749 
115TH CONGRESS 
2D SESSION 
H. R. 6735 
[Report No. 115–961] 
A BILL 
To direct the Secretary of Homeland Security to es-
tablish a vulnerability disclosure policy for De-
partment 
of 
Homeland 
Security 
internet 
websites, and for other purposes. 
SEPTEMBER 25, 2018 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
23:34 Sep 25, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\H6735.RH
H6735
lotter on DSKBCFDHB2PROD with BILLS