115TH CONGRESS 
2D SESSION 
H. R. 6443 
AN ACT 
To amend the Homeland Security Act of 2002 to authorize 
the Secretary of Homeland Security to establish a contin-
uous diagnostics and mitigation program at the Depart-
ment of Homeland Security, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Advancing Cybersecu-
rity Diagnostics and Mitigation Act’’. 
SEC. 2. ESTABLISHMENT OF CONTINUOUS DIAGNOSTICS 
AND MITIGATION PROGRAM IN DEPARTMENT 
OF HOMELAND SECURITY. 
(a) IN GENERAL.—Section 230 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 151) is amended by adding 
at the end the following new subsection: 
‘‘(g) CONTINUOUS DIAGNOSTICS AND MITIGATION.— 
‘‘(1) PROGRAM.— 
‘‘(A) IN
GENERAL.—The Secretary shall 
deploy, operate, and maintain a continuous 
diagnostics and mitigation program. Under 
such program, the Secretary shall— 
‘‘(i) develop and provide the capability 
to collect, analyze, and visualize informa-
tion relating to security data and cyberse-
curity risks; 
‘‘(ii) make program capabilities avail-
able for use, with or without reimburse-
ment; 
‘‘(iii) employ shared services, collective 
purchasing, blanket purchase agreements, 
and any other economic or procurement 
models the Secretary determines appro-
priate to maximize the costs savings asso-
ciated with implementing an information 
system; 
‘‘(iv) assist entities in setting informa-
tion security priorities and managing cy-
bersecurity risks; and 
‘‘(v) develop policies and procedures 
for reporting systemic cybersecurity risks 
and potential incidents based upon data 
collected under such program. 
‘‘(B) REGULAR IMPROVEMENT.—The Sec-
retary shall regularly deploy new technologies 
and modify existing technologies to the contin-
uous diagnostics and mitigation program re-
quired under subparagraph (A), as appropriate, 
to improve the program. 
‘‘(2) ACTIVITIES.—In carrying out the contin-
uous diagnostics and mitigation program under 
paragraph (1), the Secretary shall ensure, to the ex-
tent practicable, that— 
‘‘(A) timely, actionable, and relevant cyber-
security risk information, assessments, and 
analysis are provided in real time; 
‘‘(B) share the analysis and products de-
veloped under such program;
‘‘(C) all information, assessments, anal-
yses, and raw data under such program is made 
available to the national cybersecurity and com-
munications integration center of the Depart-
ment; and 
‘‘(D) provide regular reports on cybersecu-
rity risks.’’. 
(b) CONTINUOUS DIAGNOSTICS
AND MITIGATION 
STRATEGY.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Sec-
retary of Homeland Security shall develop a com-
prehensive continuous diagnostics and mitigation 
strategy to carry out the continuous diagnostics and 
mitigation program required under subsection (g) of 
section 230 of such Act, as added by subsection (a). 
(2) SCOPE.—The strategy required under para-
graph (1) shall include the following: 
(A) A description of the continuous 
diagnostics and mitigation program, including 
efforts by the Secretary of Homeland Security 
to assist with the deployment of program tools, 
capabilities, and services, from the inception of 
the program referred to in paragraph (1) to the 
date of the enactment of this Act.
(B) A description of the coordination re-
quired to deploy, install, and maintain the tools, 
capabilities, and services that the Secretary of 
Homeland Security determines to be necessary 
to satisfy the requirements of such program. 
(C) A description of any obstacles facing 
the deployment, installation, and maintenance 
of tools, capabilities, and services under such 
program. 
(D) Recommendations and guidelines to 
help maintain and continuously upgrade tools, 
capabilities, and services provided under such 
program. 
(E) Recommendations for using the data 
collected by such program for creating a com-
mon framework for data analytics, visualization 
of enterprise-wide risks, and real-time report-
ing. 
(F) Recommendations for future efforts 
and activities, including for the rollout of new 
tools, 
capabilities 
and 
services, 
proposed 
timelines for delivery, and whether to continue 
the use of phased rollout plans, related to se-
curing networks, devices, data, and information