1. Department of Homeland Security disclosure of security vulnerabilities (a) Vulnerability disclosure policy The Secretary of Homeland Security shall establish a policy applicable to individuals, organizations, and companies that report security vulnerabilities on Department of Homeland Security public internet websites that shall include— (1) the information technology to which the policy applies; (2) the conditions under which parties may legally operate to discover and report security vul­ner­a­bil­i­ties; (3) how individuals, organizations, and companies should disclose discovered security vul­ner­a­bil­i­ties to the Department; (4) the communication that parties that report security vulnerabilities should expect from the Department; and (5) how the Department will disclose, or how parties that report security vulnerabilities may disclose, reported security vulnerabilities. (b) Remediation process The Secretary shall develop a process for the Department of Homeland Security to address how the Department will mitigate or remediate security vulnerabilities reported through the policy developed in subsection (a). (c) Consultation In developing the security vulnerability disclosure policy under subsection (a), the Secretary shall consult with— (1) the Attorney General regarding how to ensure that individuals, organizations, and companies that comply with the requirements of the policy developed under subsection (a) are protected from prosecution under section 1030 of title 18, United States Code, civil lawsuits, and similar provisions of law with respect to specific activities authorized under the policy; (2) the Secretary of Defense and the Administrator of General Services regarding lessons that may be applied from existing vulnerability disclosure programs