US HB4126

TSA Administrator must establish within 180 days a headquarters-based covert testing program for aviation security operations, including passenger and baggage screening, using risk-informed scenarios based on annual threat assessments

At least 3 covert testing scenarios must be conducted annually, with every Category X airport tested at least once per fiscal year to identify systemic vulnerabilities

Vulnerabilities identified through testing require root cause analysis within 90 days and a mitigation determination within 150 days, with retesting required within 180 days after mitigation measures are implemented

Annual reports on covert testing results must be submitted to Congress by November 30 each year, and TSA must publicly publish aggregate pass/fail rates for Category X airport testing on its website

GAO must submit a report within 3 years evaluating the effectiveness of TSA's covert testing processes in producing statistically valid data to assess aviation security vulnerabilities