IB 

Union Calendar No. 64 

116TH CONGRESS 

1ST SESSION H. R. 1158 

[Report No. 116–89] 

To authorize cyber incident response teams at the Department of Homeland 

Security, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 13, 2019 

Mr. MCCAUL (for himself, Mr. LANGEVIN, Mr. KATKO, Mr. RUPPERSBERGER, 

and Mr. RATCLIFFE) introduced the following bill; which was referred to 

the Committee on Homeland Security 

MAY 30, 2019 

Committed to the Committee of the Whole House on the State of the Union 

and ordered to be printed 


pamtmann on DSKBFK8HB2PROD with BILLS
2 

•HR 1158 RH

A BILL 

To authorize cyber incident response teams at the 

Department of Homeland Security, and for other purposes. 


pamtmann on DSKBFK8HB2PROD with BILLS
3 

•HR 1158 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘DHS Cyber Incident 

5 Response Teams Act of 2019’’. 

6 SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER IN7 CIDENT RESPONSE TEAMS. 

8 (a) IN GENERAL.—Section 2209 of the Homeland 

9 Security Act of 2002 (6 U.S.C. 148) is amended— 

10 (1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 

11 including cybersecurity specialists’’ after ‘‘entities’’; 

12 (2) by redesignating subsections (f) through 

13 (m) as subsections (g) through (n), respectively; 

14 (3) by inserting after subsection (d) the fol15 lowing new subsection (f): 

16 ‘‘(f) CYBER INCIDENT RESPONSE TEAMS.— 

17 ‘‘(1) IN GENERAL.—The Center shall maintain 

18 cyber hunt and incident response teams for the pur19 pose of providing, as appropriate and upon request, 

20 assistance, including the following: 

21 ‘‘(A) Assistance to asset owners and opera22 tors in restoring services following a cyber inci23 dent. 

24 ‘‘(B) The identification of cybersecurity 

25 risk and unauthorized cyber activity. 


pamtmann on DSKBFK8HB2PROD with BILLS
4 

•HR 1158 RH

1 ‘‘(C) Mitigation strategies to prevent, 

2 deter, and protect against cybersecurity risks. 

3 ‘‘(D) Recommendations to asset owners 

4 and operators for improving overall network 

5 and control systems security to lower cybersecu6 rity risks, and other recommendations, as ap7 propriate. 

8 ‘‘(E) Such other capabilities as the Under 

9 Secretary appointed under section 103(a)(1)(H) 

10 determines appropriate. 

11 ‘‘(2) CYBERSECURITY SPECIALISTS.—The Sec12 retary may include cybersecurity specialists from the 

13 private sector on cyber hunt and incident response 

14 teams. 

15 ‘‘(3) ASSOCIATED METRICS.—The Center shall 

16 continually assess and evaluate the cyber incident re17 sponse teams and their operations using robust 

18 metrics. 

19 ‘‘(4) SUBMITTAL OF INFORMATION TO CON20 GRESS.—Upon the conclusion of each of the first 

21 four fiscal years ending after the date of the enact22 ment of this subsection, the Center shall submit to 

23 the Committee on Homeland Security of the House 

24 of Representatives and the Homeland Security and 

25 Governmental Affairs Committee of the Senate, inVerDate Sep 11 2014 22:14 May 30, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H1158.RH H1158

pamtmann on DSKBFK8HB2PROD with BILLS
5 

•HR 1158 RH

1 formation on the metrics used for evaluation and as2 sessment of the cyber incident response teams and 

3 operations pursuant to paragraph (3), including the 

4 resources and staffing of such cyber incident re5 sponse teams. Such information shall include each of 

6 the following for the period covered by the report: 

7 ‘‘(A) The total number of incident re8 sponse requests received. 

9 ‘‘(B) The number of incident response 

10 tickets opened. 

11 ‘‘(C) All interagency staffing of incident 

12 response teams. 

13 ‘‘(D) The interagency collaborations estab14 lished to support incident response teams.’’; and 

15 (4) in subsection (g), as redesignated by para16 graph (2)— 

17 (A) in paragraph (1), by inserting ‘‘, or 

18 any team or activity of the Center,’’ after ‘‘Cen19 ter’’; and 

20 (B) in paragraph (2), by inserting ‘‘, or 

21 any team or activity of the Center,’’ after ‘‘Cen22 ter’’. 

23 (b) NO ADDITIONAL FUNDS AUTHORIZED.—No ad24 ditional funds are authorized to be appropriated to carry 

25 out the requirements of this Act and the amendments 


pamtmann on DSKBFK8HB2PROD with BILLS
6 

•HR 1158 RH

1 made by this Act. Such requirements shall be carried out 

2 using amounts otherwise authorized to be appropriated. 


pamtmann on DSKBFK8HB2PROD with BILLS

pamtmann on DSKBFK8HB2PROD with BILLS
Union Calendar No. 64 

116TH CONGRESS 

1ST SESSION H. R. 1158 

[Report No. 116–89] 

A BILL 

To authorize cyber incident response teams at the 

purposes. Department of Homeland Security, and for other 

MAY 30, 2019 

Committed to the Committee of the Whole House on the 

State of the Union and ordered to be printed 


pamtmann on DSKBFK8HB2PROD with BILLS