I 
115TH CONGRESS 
2D SESSION 
H. R. 6443 
To amend the Homeland Security Act of 2002 to authorize the Secretary 
of Homeland Security to establish a continuous diagnostics and mitiga-
tion program at the Department of Homeland Security, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 19, 2018 
Mr. RATCLIFFE (for himself, Mr. RICHMOND, Mr. MCCAUL, Mr. KATKO, and 
Mr. FITZPATRICK) introduced the following bill; which was referred to the 
Committee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to authorize 
the Secretary of Homeland Security to establish a contin-
uous diagnostics and mitigation program at the Depart-
ment of Homeland Security, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Advancing Cybersecu-
rity Diagnostics and Mitigation Act’’. 
VerDate Sep 11 2014 
04:49 Jul 26, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.IH
H6443
dlhill on DSK3GLQ082PROD with BILLS
SEC. 2. ESTABLISHMENT OF CONTINUOUS DIAGNOSTICS 
AND MITIGATION PROGRAM IN DEPARTMENT 
OF HOMELAND SECURITY. 
(a) IN GENERAL.—Section 230 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 151) is amended by adding 
at the end the following new subsection: 
‘‘(g) CONTINUOUS DIAGNOSTICS AND MITIGATION.— 
‘‘(1) PROGRAM.— 
‘‘(A) IN
GENERAL.—The Secretary shall 
deploy, operate, and maintain a continuous 
diagnostics and mitigation program. Under 
such program, the Secretary shall— 
‘‘(i) develop and provide the capability 
to collect, analyze, and visualize informa-
tion relating to security data and cyberse-
curity risks; 
‘‘(ii) make program capabilities avail-
able for use, with or without reimburse-
ment; 
‘‘(iii) employ shared services, collective 
purchasing, blanket purchase agreements, 
and any other economic or procurement 
models the Secretary determines appro-
priate to maximize the costs savings asso-
ciated with implementing an information 
system; 
VerDate Sep 11 2014 
04:49 Jul 26, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.IH
H6443
dlhill on DSK3GLQ082PROD with BILLS
‘‘(iv) assist entities in setting informa-
tion security priorities and managing cy-
bersecurity risks; and 
‘‘(v) develop policies and procedures 
for reporting systemic cybersecurity risks 
and potential incidents based upon data 
collected under such program. 
‘‘(B) REGULAR IMPROVEMENT.—The Sec-
retary shall regularly deploy new technologies 
and modify existing technologies to the contin-
uous diagnostics and mitigation program re-
quired under subparagraph (A), as appropriate, 
to improve the program. 
‘‘(2) ACTIVITIES.—In carrying out the contin-
uous diagnostics and mitigation program under 
paragraph (1), the Secretary shall ensure, to the ex-
tent practicable, that— 
‘‘(A) timely, actionable, and relevant cyber-
security risk information, assessments, and 
analysis are provided in real time; 
‘‘(B) share the analysis and products de-
veloped under such program; 
‘‘(C) all information, assessments, anal-
yses, and raw data under such program is made 
available to the national cybersecurity and com-
VerDate Sep 11 2014 
04:49 Jul 26, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.IH
H6443
dlhill on DSK3GLQ082PROD with BILLS
munications integration center of the Depart-
ment; and 
‘‘(D) provide regular reports on cybersecu-
rity risks.’’. 
(b) CONTINUOUS DIAGNOSTICS
AND MITIGATION 
STRATEGY.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Sec-
retary of Homeland Security shall develop a com-
prehensive continuous diagnostics and mitigation 
strategy to carry out the continuous diagnostics and 
mitigation program required under subsection (g) of 
section 230 of such Act, as added by subsection (a). 
(2) SCOPE.—The strategy required under para-
graph (1) shall include the following: 
(A) A description of the continuous 
diagnostics and mitigation program, including 
efforts by the Secretary of Homeland Security 
to assist with the deployment of program tools, 
capabilities, and services, from the inception of 
the program referred to in paragraph (1) to the 
date of the enactment of this Act. 
(B) A description of the coordination re-
quired to deploy, install, and maintain the tools, 
capabilities, and services that the Secretary of 
VerDate Sep 11 2014 
04:49 Jul 26, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6443.IH
H6443
dlhill on DSK3GLQ082PROD with BILLS
mittee on Homeland Security and Governmental Affairs 
of the Senate and the Committee on Homeland Security 
of the House of Representative a report on cybersecurity 
risk posture based on the data collected through the con-
tinuous diagnostics and mitigation program under sub-
section (g) of section 230 of the Homeland Security Act 
of 2002, as added by subsection (a). 
Æ 
VerDate Sep 11 2014 
04:49 Jul 26, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6301
E:\BILLS\H6443.IH
H6443
dlhill on DSK3GLQ082PROD with BILLS