1. Short title This Act may be cited as the Cybersecurity Vulnerability Identification and Notification Act of 2020 . 2. Subpoena authority (a) In general Section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ) is amended— (1) in subsection (a)— (A) in this subsection, by inserting , cybersecurity purpose , after cyber threat indicator ; (B) by redesignating paragraphs (3) through (6) as paragraphs (4) through (7), respectively; (C) by inserting after this subsection the following new paragraph: (3) the term enterprise device or system — (A) means a device or information system commonly used to perform industrial, commercial, scientific, or governmental functions or processes that relate to critical infrastructure, including operational and industrial control systems, distributed control systems, and programmable logic controllers; and (B) does not include personal devices and systems, such as consumer mobile devices, home computers, residential wireless routers, or residential internet-enabled consumer devices; ; and (D) in paragraph (6), as so redesignated, by striking term information system has the meaning given that term in section 3502(8) of title 44; and and inserting terms information system and security vulnerability have the meanings given those terms in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ); ; (2) in subsection (c)— (A) in paragraph (8)(C), by striking sharing and inserting share ; (B) in paragraph (10), by striking and after the semicolon at the end; (C) in paragraph (11), by striking the period at the end and inserting ; and ; and (D) by adding at the end the following new paragraph: (12) detecting, identifying, and receiving information about security vulnerabilities relating to information systems for a cybersecurity purpose.