Updating processes and procedures relating to cybersecurity vulnerabilities

(a) Definitions In this section: (1) Common Vulnerabilities and Exposures Program The term Common Vulnerabilities and Exposures Program means the reference guide and classification system for publicly known information security vulnerabilities sponsored by the Cybersecurity and Infrastructure Security Agency. (2) Relevant congressional committees The term relevant congressional committees means— (A) the Committee on Homeland Security and Governmental Affairs, the Committee on Commerce, Science, and Transportation, the Select Committee on Intelligence, and the Committee on the Judiciary of the Senate; and (B) the Committee on Oversight and Government Reform, the Committee on Energy and Commerce, the Permanent Select Committee on Intelligence, and the Committee on the Judiciary of the House of Representatives. (b) Processes and procedures for vulnerability management Not later than 180 days after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall— (1) comprehensively evaluate, and develop a strategic plan to reform, the structure and processes of the National Vulnerability Database in light of significant increase in the volume of vulnerabilities in information systems identified by artificial intelligence systems, including recommendations and guidance related to assisting in determining prioritization of identified vulnerability patching and mitigation; (2) initiate a process to utilize advanced artificial intelligence systems to characterize vulnerabilities as part of the National Vulnerability Database; (3) initiate a process to update processes and procedures associated with the National Vulnerability Database of the Institute to ensure that the database and associated vulnerability management processes incorporate artificial intelligence security vulnerabilities to the greatest extent practicable; (4) identify any characteristics of artificial intelligence security vulnerabilities that make utilization of the National Vulnerability Database inappropriate and develop processes and procedures for vulnerability management for those vulnerabilities; and (5) initiate a process to update the Secure Software Development Framework set forth in National Institute of Standards and Technology Special Publication 800–218 and include guidance and best practices for using artificial intelligence in code generation and security review. (c) Updates to Common Vulnerabilities and Exposures Program Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall— (1) initiate a process to update processes and procedures associated with the Common Vulnerabilities and Exposures Program to ensure that the program and associated processes identify and enumerate artificial intelligence security vulnerabilities to the greatest extent practicable; and (2) identify any characteristic of artificial intelligence security vulnerabilities that make utilization of the Common Vulnerabilities and Exposures Program inappropriate and develop processes and procedures for vulnerability identification and enumeration for those artificial intelligence security vulnerabilities. (d) Submission to Congress Upon completion of the processes required in subsections (a) and (b), the Director of the National Institute of Standards and Technology and the Director of the Cybersecurity and Infrastructure Security Agency, respectively, shall submit a strategic plan to Congress identifying courses of action under existing authorities, or identifying specific legislative amendments, necessary to address accelerating security risks associated with artificial intelligence systems. (e) Evaluation of consensus standards for vulnerability disclosure (1) In general Not later than 30 days after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, initiate a multi-stakeholder process to evaluate whether existing voluntary consensus standards and processes for vulnerability reporting processes associated with the security of information systems effectively accommodate the significant increased volume of vulnerabilities in information systems identified by artificial intelligence systems, as well as the unique nature of artificial intelligence security vulnerabilities. (2) Report (A) Submission Not later than 180 days after the date on which the evaluation under paragraph (1) is carried out, the Director shall submit a report to the relevant congressional committees on the sufficiency of existing vulnerability reporting processes and standards to accommodate the significant increased volume of vulnerabilities in information systems identified by artificial intelligence systems, as well as artificial intelligence security vulnerabilities. (B) Post-report action If the Director concludes in the report submitted under subparagraph (A) that existing vulnerability reporting processes and standards do not effectively accommodate the significant increased volume of vulnerabilities in information systems identified by artificial intelligence systems, as well as the reporting of artificial intelligence security vulnerabilities, the Director shall initiate a process, in consultation with the Director of the National Institute of Standards and Technology and the Director of the Office of Management and Budget, to update relevant vulnerability reporting processes, including the Department of Homeland Security Binding Operational Directive 20–01, or any subsequent directive.