James Langevin actually said...
The Department of Defense does, the General Services Administration does, DHS does not.
Context
Langevin highlights the absence of a vulnerability disclosure program at DHS compared to other agencies.
04/25/2018