I 
118TH CONGRESS 
1ST SESSION 
H. R. 285 
To amend the Homeland Security Act of 2002 to provide for the remediation 
of cybersecurity vulnerabilities, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 11, 2023 
Ms. JACKSON LEE introduced the following bill; which was referred to the 
Committee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to provide 
for the remediation of cybersecurity vulnerabilities, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Vulner-
ability Remediation Act’’. 
SEC. 2. CYBERSECURITY VULNERABILITIES. 
Section 2209 of the Homeland Security Act of 2002 
(6 U.S.C. 659) is amended— 
(1) in subsection (a)— 
VerDate Sep 11 2014 
04:45 Jan 21, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H285.IH
H285
pbinns on DSKJLVW7X2PROD with $$_JOB
(A) 
by 
redesignating 
paragraphs 
(6) 
through (9) as paragraphs (7) through (10), re-
spectively; and 
(B) by inserting after paragraph (5) the 
following new paragraph: 
‘‘(6) the term ‘cybersecurity vulnerability’ has 
the meaning given the term ‘security vulnerability’ 
in section 102 of the Cybersecurity Information 
Sharing Act of 2015 (6 U.S.C. 1501); and’’; 
(2) in subsection (c)— 
(A) in paragraph (5)— 
(i) in subparagraph (A), by striking 
‘‘and’’ after the semicolon at the end; 
(ii) by redesignating subparagraphs 
(B) and (C) as subparagraphs (C) and 
(D), respectively; 
(iii) by inserting after subparagraph 
(A) the following new subparagraph: 
‘‘(B) sharing mitigation protocols to counter cy-
bersecurity vulnerabilities pursuant to subsection 
(n); and’’; and 
(iv) in subparagraph (C), as so redes-
ignated, by inserting ‘‘and mitigation pro-
tocols 
to 
counter 
cybersecurity 
VerDate Sep 11 2014 
04:45 Jan 21, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H285.IH
H285
pbinns on DSKJLVW7X2PROD with $$_JOB
vulnerabilities in accordance with subpara-
graph (B)’’ before ‘‘with Federal’’; and 
(B) in paragraph (9), by inserting ‘‘mitiga-
tion 
protocols 
to 
counter 
cybersecurity 
vulnerabilities,’’ after ‘‘measures,’’; 
(3) by redesignating the second subsections (p) 
and (q) (relating to coordination on cybersecurity for 
SLITT entities and a report, respectively) as sub-
sections (r) and (s), respectively; and 
(4) by adding at the end the following new sub-
section: 
‘‘(t) PROTOCOLS TO COUNTER CERTAIN CYBERSE-
CURITY VULNERABILITIES.—The Director may, as appro-
priate, identify, develop, and disseminate actionable proto-
cols to mitigate cybersecurity vulnerabilities to informa-
tion systems and industrial control systems, including in 
circumstances in which such vulnerabilities exist because 
software or hardware is no longer supported by a ven-
dor.’’. 
SEC. 3. REPORT ON CYBERSECURITY VULNERABILITIES. 
(a) REPORT.—Not later than one year after the date 
of the enactment of this Act, the Director of the Cyberse-
curity and Infrastructure Security Agency of the Depart-
ment of Homeland Security shall submit to the Committee 
on Homeland Security of the House of Representatives 
VerDate Sep 11 2014 
04:45 Jan 21, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H285.IH
H285
pbinns on DSKJLVW7X2PROD with $$_JOB
(5) A description of how privacy and civil lib-
erties are preserved in the collection, retention, use, 
and sharing of vulnerability disclosures. 
(b) FORM.—The report required under subsection (b) 
shall be submitted in unclassified form but may contain 
a classified annex. 
SEC. 4. COMPETITION RELATING TO CYBERSECURITY 
VULNERABILITIES. 
The Under Secretary for Science and Technology of 
the Department of Homeland Security, in consultation 
with the Director of the Cybersecurity and Infrastructure 
Security Agency of the Department, may establish an in-
centive-based program that allows industry, individuals, 
academia, and others to compete in identifying remedi-
ation solutions for cybersecurity vulnerabilities (as such 
term is defined in section 2209 of the Homeland Security 
Act of 2002, as amended by section 2) to information sys-
tems (as such term is defined in such section 2209) and 
industrial control systems, including supervisory control 
and data acquisition systems. 
Æ 
VerDate Sep 11 2014 
04:45 Jan 21, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H285.IH
H285
pbinns on DSKJLVW7X2PROD with $$_JOB