Us Congress 2023-2024 Regular Session

Us Congress House Bill HB285 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	I
2	2	118THCONGRESS
3	3	1
4	4	STSESSION H. R. 285
5	5	To amend the Homeland Security Act of 2002 to provide for the remediation
6	6	of cybersecurity vulnerabilities, and for other purposes.
7	7	IN THE HOUSE OF REPRESENTATIVES
8	8	JANUARY11, 2023
9	9	Ms. J
10	10	ACKSONLEEintroduced the following bill; which was referred to the
11	11	Committee on Homeland Security
12	12	A BILL
13	13	To amend the Homeland Security Act of 2002 to provide
14	14	for the remediation of cybersecurity vulnerabilities, and
15	15	for other purposes.
16	16	Be it enacted by the Senate and House of Representa-1
17	17	tives of the United States of America in Congress assembled, 2
18	18	SECTION 1. SHORT TITLE. 3
19	19	This Act may be cited as the ‘‘Cybersecurity Vulner-4
20	20	ability Remediation Act’’. 5
21	21	SEC. 2. CYBERSECURITY VULNERABILITIES. 6
22	22	Section 2209 of the Homeland Security Act of 2002 7
23	23	(6 U.S.C. 659) is amended— 8
24	24	(1) in subsection (a)— 9
25	25	VerDate Sep 11 2014 04:45 Jan 21, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H285.IH H285
26	26	pbinns on DSKJLVW7X2PROD with $$_JOB 2
27	27	•HR 285 IH
28	28	(A) by redesignating paragraphs (6) 1
29	29	through (9) as paragraphs (7) through (10), re-2
30	30	spectively; and 3
31	31	(B) by inserting after paragraph (5) the 4
32	32	following new paragraph: 5
33	33	‘‘(6) the term ‘cybersecurity vulnerability’ has 6
34	34	the meaning given the term ‘security vulnerability’ 7
35	35	in section 102 of the Cybersecurity Information 8
36	36	Sharing Act of 2015 (6 U.S.C. 1501); and’’; 9
37	37	(2) in subsection (c)— 10
38	38	(A) in paragraph (5)— 11
39	39	(i) in subparagraph (A), by striking 12
40	40	‘‘and’’ after the semicolon at the end; 13
41	41	(ii) by redesignating subparagraphs 14
42	42	(B) and (C) as subparagraphs (C) and 15
43	43	(D), respectively; 16
44	44	(iii) by inserting after subparagraph 17
45	45	(A) the following new subparagraph: 18
46	46	‘‘(B) sharing mitigation protocols to counter cy-19
47	47	bersecurity vulnerabilities pursuant to subsection 20
48	48	(n); and’’; and 21
49	49	(iv) in subparagraph (C), as so redes-22
50	50	ignated, by inserting ‘‘and mitigation pro-23
51	51	tocols to counter cybersecurity 24
52	52	VerDate Sep 11 2014 04:45 Jan 21, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H285.IH H285
53	53	pbinns on DSKJLVW7X2PROD with $$_JOB 3
54	54	•HR 285 IH
55	55	vulnerabilities in accordance with subpara-1
56	56	graph (B)’’ before ‘‘with Federal’’; and 2
57	57	(B) in paragraph (9), by inserting ‘‘mitiga-3
58	58	tion protocols to counter cybersecurity 4
59	59	vulnerabilities,’’ after ‘‘measures,’’; 5
60	60	(3) by redesignating the second subsections (p) 6
61	61	and (q) (relating to coordination on cybersecurity for 7
62	62	SLITT entities and a report, respectively) as sub-8
63	63	sections (r) and (s), respectively; and 9
64	64	(4) by adding at the end the following new sub-10
65	65	section: 11
66	66	‘‘(t) P
67	67	ROTOCOLSTOCOUNTERCERTAINCYBERSE-12
68	68	CURITYVULNERABILITIES.—The Director may, as appro-13
69	69	priate, identify, develop, and disseminate actionable proto-14
70	70	cols to mitigate cybersecurity vulnerabilities to informa-15
71	71	tion systems and industrial control systems, including in 16
72	72	circumstances in which such vulnerabilities exist because 17
73	73	software or hardware is no longer supported by a ven-18
74	74	dor.’’. 19
75	75	SEC. 3. REPORT ON CYBERSECURITY VULNERABILITIES. 20
76	76	(a) R
77	77	EPORT.—Not later than one year after the date 21
78	78	of the enactment of this Act, the Director of the Cyberse-22
79	79	curity and Infrastructure Security Agency of the Depart-23
80	80	ment of Homeland Security shall submit to the Committee 24
81	81	on Homeland Security of the House of Representatives 25
82	82	VerDate Sep 11 2014 04:45 Jan 21, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H285.IH H285
83	83	pbinns on DSKJLVW7X2PROD with $$_JOB 4
84	84	•HR 285 IH
85	85	and the Committee on Homeland Security and Govern-1
86	86	mental Affairs of the Senate a report on how the Agency 2
87	87	carries out subsection (n) of section 2209 of the Homeland 3
88	88	Security Act of 2002 to coordinate vulnerability disclo-4
89	89	sures, including disclosures of cybersecurity vulnerabilities 5
90	90	(as such term is defined in such section), and subsection 6
91	91	(t) of such section (as added by section 2) to disseminate 7
92	92	actionable protocols to mitigate cybersecurity 8
93	93	vulnerabilities to information systems and industrial con-9
94	94	trol systems, that includes the following: 10
95	95	(1) A description of the policies and procedures 11
96	96	relating to the coordination of vulnerability disclo-12
97	97	sures. 13
98	98	(2) A description of the levels of activity in fur-14
99	99	therance of such subsections (n) and (t) of such sec-15
100	100	tion 2209. 16
101	101	(3) Any plans to make further improvements to 17
102	102	how information provided pursuant to such sub-18
103	103	sections can be shared (as such term is defined in 19
104	104	such section 2209) between the Department and in-20
105	105	dustry and other stakeholders. 21
106	106	(4) Any available information on the degree to 22
107	107	which such information was acted upon by industry 23
108	108	and other stakeholders. 24
109	109	VerDate Sep 11 2014 04:45 Jan 21, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H285.IH H285
110	110	pbinns on DSKJLVW7X2PROD with $$_JOB 5
111	111	•HR 285 IH
112	112	(5) A description of how privacy and civil lib-1
113	113	erties are preserved in the collection, retention, use, 2
114	114	and sharing of vulnerability disclosures. 3
115	115	(b) F
116	116	ORM.—The report required under subsection (b) 4
117	117	shall be submitted in unclassified form but may contain 5
118	118	a classified annex. 6
119	119	SEC. 4. COMPETITION RELATING TO CYBERSECURITY 7
120	120	VULNERABILITIES. 8
121	121	The Under Secretary for Science and Technology of 9
122	122	the Department of Homeland Security, in consultation 10
123	123	with the Director of the Cybersecurity and Infrastructure 11
124	124	Security Agency of the Department, may establish an in-12
125	125	centive-based program that allows industry, individuals, 13
126	126	academia, and others to compete in identifying remedi-14
127	127	ation solutions for cybersecurity vulnerabilities (as such 15
128	128	term is defined in section 2209 of the Homeland Security 16
129	129	Act of 2002, as amended by section 2) to information sys-17
130	130	tems (as such term is defined in such section 2209) and 18
131	131	industrial control systems, including supervisory control 19
132	132	and data acquisition systems. 20
133	133	Æ
134	134	VerDate Sep 11 2014 04:45 Jan 21, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H285.IH H285
135	135	pbinns on DSKJLVW7X2PROD with $$_JOB