S. 1157 115th Congress Senate

PATCH Act of 2017

Official title: A bill to establish the Vulnerability Equities Review Board, and for other purposes.

Introduced: May 17, 2017 Introduced by: Brian Schatz Democratic · Hawaii See on congress.gov

Government Operations and Politics Computer security and identity theftExecutive agency funding and structureGovernment information and archivesGovernment studies and investigations

More subjectsShow fewer subjects

Intelligence activities, surveillance, classified informationPublic contracts and procurement

Everywhere this bill has been 2 steps

Introduced

In committee

Reported out

Passed House

Passed Senate

To President

Became law

May 17, 2017

Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

May 17, 2017

Introduced in Senate

Ask about this bill AI · grounded in the bill text

Have a question about what this bill does? Ask in plain English; the answer is drawn from the bill's actual text and official record, and it'll tell you when something isn't in the text rather than guess.

AI answers can be imperfect; always confirm against the full bill text.

Latest action May 17, 2017

Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Plain-English summary Congressional Research Service

Protecting Our Ability to Counter Hacking Act of 2017 or the PATCH Act of 2017

This bill establishes the Vulnerability Equities Review Board to establish and make available to the public policies on matters relating to whether, when, how, to whom, and to what degree information about a vulnerability in a technology, product, system, service, or application that is not publicly known should be shared or released by the government to a non-federal entity. The board must submit to Congress and the President a draft of such policies, along with a description of challenges or impediments requiring legislative or administrative action.

Each federal agency shall, upon obtaining information about such a vulnerability, subject such information to a process established by the board for sharing or releasing the information. Process considerations shall include:

which technologies, products, systems, services, or applications are subject to the vulnerability;
the potential risks of leaving the vulnerability unpatched or unmitigated;
the likelihood that a non-federal entity will discover the vulnerability; and
whether the vulnerability can be patched or otherwise mitigated.

An agency may share or release such information to a non-federal entity without subjecting it to such process if the agency determines that the information is presumptively shareable or releasable.

If the board determines that such information should be shared with or released to the vendor that developed or maintains the technology, it shall provide the information to the Department of Homeland Security, which shall share or release the information as directed by the board.

Related & companion bills 1