1. Short title This Act may be cited as the Covert Testing and Risk Mitigation Improvement Act of 2019 . 2. TSA covert testing and risk mitigation improvement (a) In general Not later than 180 days after the date of the enactment of this Act and annually thereafter, the Administrator of the Transportation Security Administration shall implement the following: (1) A system for conducting risk-informed headquarters-based covert tests of aviation security operations, including relating to airport passenger and baggage security screening operations, that can yield statistically valid data that can be used to identify and assess the nature and extent of vulnerabilities to such operations that are not mitigated by current security practices. The Administrator shall execute annually not fewer than three risk-informed covert testing projects designed to identify systemic vulnerabilities in the transportation security system, and shall document the assumptions and rationale guiding the selection of such projects. (2) A long-term headquarters-based covert testing program, employing static but risk-informed threat vectors, designed to assess changes in overall screening effectiveness. (b) Mitigation (1) In general The Administrator of the Transportation Security Administration shall establish a system to address and mitigate the vulnerabilities identified and assessed pursuant to the testing conducted under subsection (a). (2) Analysis Not later than 60 days after the identification of any such vulnerability, the Administrator shall ensure a vulnerability described in paragraph (1) is analyzed to determine root causes. (3) Determination Not later than 120 days after the identification of any such vulnerability, the Administrator shall make a determination regarding whether or not to mitigate such vulnerability. The Administrator shall prioritize mitigating vulnerabilities based on their ability to reduce risk. If the Administrator determines— (A) to not mitigate such vulnerability, the Administrator shall document the