1. Short title This Act may be cited as the Cybersecurity Vulnerability Identification and Notification Act of 2019 . 2. Subpoena authority (a) In general Section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ) is amended— (1) in subsection (a)— (A) by redesignating paragraph (6) as paragraph (7); and (B) by inserting after paragraph (5) the following: (6) the term security vulnerability has the meaning given that term in section 102(17) of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501(17) ); ; (2) in subsection (c)— (A) in paragraph (10), by striking and at the end; (B) in paragraph (11), by striking the period at the end and inserting ; and ; and (C) by adding at the end the following: (12) detecting, identifying, and receiving information about security vulnerabilities relating to critical infrastructure in the information systems and devices of Federal and non-Federal entities for a cybersecurity purpose, as defined in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ). ; and (3) by adding at the end the following: (n) Subpoena authority (1) Definition In this subsection, the term enterprise device or system — (A) means a device or system commonly used to perform industrial, commercial, scientific, or governmental functions or processes that relate to critical infrastructure, including operational and industrial control systems, distributed control systems, and programmable logic controllers