; table of contents. Title I—Department of Homeland Security information security and other matters Sec. 101. Department of Homeland Security disclosure of security vulnerabilities. Sec. 102. Department of Homeland Security bug bounty pilot program. Sec. 103. Congressional submittal of reports relating to certain special access programs and similar programs. Title II—Federal acquisition supply chain security Sec. 201. Short title. Sec. 202. Federal acquisition supply chain security. Sec. 203. Authorities of executive agencies relating to mitigating supply chain risks in the procurement of covered articles. Sec. 204. Federal Information Security Modernization Act. Sec. 205. Effective date. I Department of Homeland Security information security and other matters 101. Department of Homeland Security disclosure of security vulnerabilities (a) Vulnerability disclosure policy The Secretary of Homeland Security shall establish a policy applicable to individuals, organizations, and companies that report security vulnerabilities on appropriate information systems of Department of Homeland Security. Such policy shall include each of the following: (1) The appropriate information systems of the Department that individuals, organizations, and companies may use to discover and report security vulnerabilities on appropriate information systems. (2) The conditions and criteria under which individuals, organizations, and companies may operate to discover and report security vulnerabilities. (3) How individuals, organizations, and companies may disclose to the Department security vulnerabilities discovered on appropriate information systems of the Department. (4) The ways in which the Department may communicate with individuals, organizations, and companies that report security vulnerabilities. (5) The process the Department shall use for public disclosure of reported security vulnerabilities. (b) Remediation process The Secretary of Homeland Security shall develop a process for the Department of Homeland Security to address the