117TH CONGRESS 

1ST SESSION H. R. 1833 

AN ACT 

To amend the Homeland Security Act of 2002 to provide 

for the responsibility of the Cybersecurity and Infrastructure Security Agency to maintain capabilities to identify 

threats to industrial control systems, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

2 

•HR 1833 EH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘DHS Industrial Con3 trol Systems Capabilities Enhancement Act of 2021’’. 

4 SEC. 2. CAPABILITIES OF THE CYBERSECURITY AND INFRA5 STRUCTURE SECURITY AGENCY TO IDENTIFY 

6 THREATS TO INDUSTRIAL CONTROL SYS7 TEMS. 

8 (a) IN GENERAL.—Section 2209 of the Homeland 

9 Security Act of 2002 (6 U.S.C. 659) is amended— 

10 (1) in subsection (e)(1)— 

11 (A) in subparagraph (G), by striking 

12 ‘‘and’’ after the semicolon; 

13 (B) in subparagraph (H), by inserting 

14 ‘‘and’’ after the semicolon; and 

15 (C) by adding at the end the following new 

16 subparagraph: 

17 ‘‘(I) activities of the Center address the se18 curity of both information technology and oper19 ational technology, including industrial control 

20 systems;’’; and 

21 (2) by adding at the end the following new sub22 section: 

23 ‘‘(p) INDUSTRIAL CONTROL SYSTEMS.—The Director 

24 shall maintain capabilities to identify and address threats 

25 and vulnerabilities to products and technologies intended 

26 for use in the automated control of critical infrastructure 

3 

•HR 1833 EH

1 processes. In carrying out this subsection, the Director 

2 shall— 

3 ‘‘(1) lead Federal Government efforts, in con4 sultation with Sector Risk Management Agencies, as 

5 appropriate, to identify and mitigate cybersecurity 

6 threats to industrial control systems, including su7 pervisory control and data acquisition systems; 

8 ‘‘(2) maintain threat hunting and incident re9 sponse capabilities to respond to industrial control 

10 system cybersecurity risks and incidents; 

11 ‘‘(3) provide cybersecurity technical assistance 

12 to industry end-users, product manufacturers, Sector 

13 Risk Management Agencies, other Federal agencies, 

14 and other industrial control system stakeholders to 

15 identify, evaluate, assess, and mitigate 

16 vulnerabilities; 

17 ‘‘(4) collect, coordinate, and provide vulner18 ability information to the industrial control systems 

19 community by, as appropriate, working closely with 

20 security researchers, industry end-users, product 

21 manufacturers, Sector Risk Management Agencies, 

22 other Federal agencies, and other industrial control 

23 systems stakeholders; and 

24 ‘‘(5) conduct such other efforts and assistance 

25 as the Secretary determines appropriate.’’. 

4 

•HR 1833 EH

1 (b) REPORT TO CONGRESS.—Not later than 180 days 

2 after the date of the enactment of this Act and every six 

3 months thereafter during the subsequent 4-year period, 

4 the Director of the Cybersecurity and Infrastructure Secu5 rity Agency of the Department of Homeland Security shall 

6 provide to the Committee on Homeland Security of the 

7 House of Representatives and the Committee on Home8 land Security and Governmental Affairs of the Senate a 

9 briefing on the industrial control systems capabilities of 

10 the Agency under section 2209 of the Homeland Security 

11 Act of 2002 (6 U.S.C. 659), as amended by subsection 

12 (a). 

13 (c) GAO REVIEW.—Not later than 2 years after the 

14 date of the enactment of this Act, the Comptroller General 

15 of the United States shall review implementation of the 

16 requirements of subsections (e)(1)(I) and (p) of section 

17 2209 of the Homeland Security Act of 2002 (6 U.S.C. 

18 659), as amended by subsection (a), and submit to the 

19 Committee on Homeland Security in the House of Rep20 resentatives and the Committee on Homeland Security 

21 and Government Affairs of the Senate a report containing 

22 findings and recommendations relating to such implemen23 tation. Such report shall include information on the fol24 lowing: 

5 

•HR 1833 EH

1 (1) Any interagency coordination challenges to 

2 the ability of the Director of the Cybersecurity and 

3 Infrastructure Agency of the Department of Home4 land Security to lead Federal efforts to identify and 

5 mitigate cybersecurity threats to industrial control 

6 systems pursuant to subsection (p)(1) of such sec7 tion. 

8 (2) The degree to which the Agency has ade9 quate capacity, expertise, and resources to carry out 

10 threat hunting and incident response capabilities to 

11 mitigate cybersecurity threats to industrial control 

12 systems pursuant to subsection (p)(2) of such sec13 tion, as well as additional resources that would be 

14 needed to close any operational gaps in such capa15 bilities. 

16 (3) The extent to which industrial control sys17 tem stakeholders sought cybersecurity technical as18 sistance from the Agency pursuant to subsection 

19 (p)(3) of such section, and the utility and effective20 ness of such technical assistance. 

21 (4) The degree to which the Agency works with 

22 security researchers and other industrial control sys23 tems stakeholders, pursuant to subsection (p)(4) of 

6 

•HR 1833 EH

1 such section, to provide vulnerability information to 

2 the industrial control systems community. 

Passed the House of Representatives July 20, 2021. 

Attest: 

Clerk. 

117TH CONGRESS 

1ST SESSION H. R. 1833 

AN ACT 

To amend the Homeland Security Act of 2002 to 

trol systems, and for other purposes. capabilities to identify threats to industrial conand Infrastructure Security Agency to maintain provide for the responsibility of the Cybersecurity