1. Short title This Act may be cited as the Hack Your State Department Act . 2. Definitions In this Act: (1) Department The term Department means the Department of State. (2) Information technology The term information technology has the meaning given such term in section 11101 of title 40, United States Code. (3) Secretary The term Secretary means the Secretary of State. 3. Department of State Vulnerability Disclosure Program (a) In general Not later than 180 days after the date of the enactment of this Act, the Secretary shall design, establish, and make publicly known a Vulnerability Disclosure Program (VDP) to improve Department cybersecurity by— (1) providing security researchers with clear guidelines for— (A) conducting vulnerability discovery activities directed at Department information technology; and (B) submitting discovered security vulnerabilities to the Department; and (2) creating Department procedures and infrastructure to receive and fix discovered vulnerabilities. (b) Requirements In establishing the VDP pursuant to paragraph (1), the Secretary shall— (1) identify which Department information technology should be included in the program; (2) determine whether the program should differentiate among and specify the types of security vulnerabilities that may be targeted; (3) provide a readily available means of reporting discovered security vulnerabilities and the form in which such vulnerabilities should be reported; (4) identify which Department offices and positions will be responsible for receiving, prioritizing, and addressing security vulnerability disclosure reports; (5) consult with the Attorney General regarding how to ensure that approved individuals, organizations, and companies that comply with the requirements of the program are protected from prosecution under section 1030 of title 18, United States Code, and similar provisions of law for specific activities authorized under the program