I 

116TH CONGRESS 

1ST SESSION H. R. 1158 

To authorize cyber incident response teams at the Department of Homeland 

Security, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 13, 2019 

Mr. MCCAUL (for himself, Mr. LANGEVIN, Mr. KATKO, Mr. RUPPERSBERGER, 

and Mr. RATCLIFFE) introduced the following bill; which was referred to 

the Committee on Homeland Security 

A BILL 

To authorize cyber incident response teams at the 

Department of Homeland Security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘DHS Cyber Incident 

5 Response Teams Act of 2019’’. 

6 SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER IN7 CIDENT RESPONSE TEAMS. 

8 (a) IN GENERAL.—Section 2209 of the Homeland 

9 Security Act of 2002 (6 U.S.C. 148) is amended— 


pbinns on DSK79D2C42PROD with BILLS
2 

•HR 1158 IH

1 (1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 

2 including cybersecurity specialists’’ after ‘‘entities’’; 

3 (2) by redesignating subsections (f) through 

4 (m) as subsections (g) through (n), respectively; 

5 (3) by inserting after subsection (d) the fol6 lowing new subsection (f): 

7 ‘‘(f) CYBER INCIDENT RESPONSE TEAMS.— 

8 ‘‘(1) IN GENERAL.—The Center shall maintain 

9 cyber hunt and incident response teams for the pur10 pose of providing, as appropriate and upon request, 

11 assistance, including the following: 

12 ‘‘(A) Assistance to asset owners and opera13 tors in restoring services following a cyber inci14 dent. 

15 ‘‘(B) The identification of cybersecurity 

16 risk and unauthorized cyber activity. 

17 ‘‘(C) Mitigation strategies to prevent, 

18 deter, and protect against cybersecurity risks. 

19 ‘‘(D) Recommendations to asset owners 

20 and operators for improving overall network 

21 and control systems security to lower cybersecu22 rity risks, and other recommendations, as ap23 propriate. 


pbinns on DSK79D2C42PROD with BILLS
3 

•HR 1158 IH

1 ‘‘(E) Such other capabilities as the Under 

2 Secretary appointed under section 103(a)(1)(H) 

3 determines appropriate. 

4 ‘‘(2) CYBERSECURITY SPECIALISTS.—The Sec5 retary may include cybersecurity specialists from the 

6 private sector on cyber hunt and incident response 

7 teams. 

8 ‘‘(3) ASSOCIATED METRICS.—The Center shall 

9 continually assess and evaluate the cyber incident re10 sponse teams and their operations using robust 

11 metrics. 

12 ‘‘(4) SUBMITTAL OF INFORMATION TO CON13 GRESS.—Upon the conclusion of each of the first 

14 four fiscal years ending after the date of the enact15 ment of this subsection, the Center shall submit to 

16 the Committee on Homeland Security of the House 

17 of Representatives and the Homeland Security and 

18 Governmental Affairs Committee of the Senate, in19 formation on the metrics used for evaluation and as20 sessment of the cyber incident response teams and 

21 operations pursuant to paragraph (3), including the 

22 resources and staffing of such cyber incident re23 sponse teams. Such information shall include each of 

24 the following for the period covered by the report: 


pbinns on DSK79D2C42PROD with BILLS
4 

•HR 1158 IH

1 ‘‘(A) The total number of incident re2 sponse requests received. 

3 ‘‘(B) The number of incident response 

4 tickets opened. 

5 ‘‘(C) All interagency staffing of incident 

6 response teams. 

7 ‘‘(D) The interagency collaborations estab8 lished to support incident response teams.’’; and 

9 (4) in subsection (g), as redesignated by para10 graph (2)— 

11 (A) in paragraph (1), by inserting ‘‘, or 

12 any team or activity of the Center,’’ after ‘‘Cen13 ter’’; and 

14 (B) in paragraph (2), by inserting ‘‘, or 

15 any team or activity of the Center,’’ after ‘‘Cen16 ter’’. 

17 (b) NO ADDITIONAL FUNDS AUTHORIZED.—No ad18 ditional funds are authorized to be appropriated to carry 

19 out the requirements of this Act and the amendments 

20 made by this Act. Such requirements shall be carried out 

21 using amounts otherwise authorized to be appropriated. 

Æ 


pbinns on DSK79D2C42PROD with BILLS