In the Senate of the United States, 

September 24, 2019. 

Resolved, That the bill from the House of Representatives (H.R. 1158) entitled ‘‘An Act to authorize cyber incident response teams at the Department of Homeland Security, and for other purposes.’’, do pass with the following 

AMENDMENT: 

Strike all after the enacting clause and insert the 

following: 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘DHS Cyber Hunt and 

3 Incident Response Teams Act of 2019’’. 

4 SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER 

5 HUNT AND INCIDENT RESPONSE TEAMS. 

6 (a) IN GENERAL.—Section 2209 of the Homeland Se7 curity Act of 2002 (6 U.S.C. 659) is amended— 

8 (1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 

9 including cybersecurity specialists’’ after ‘‘entities’’; 
2 

† HR 1158 EAS 

1 (2) by redesignating subsections (f) through (m) 

2 as subsections (g) through (n), respectively; 

3 (3) by inserting after subsection (e) the following: 

4 ‘‘(f) CYBER HUNT AND INCIDENT RESPONSE TEAMS.— 

5 ‘‘(1) IN GENERAL.—The Center shall maintain 

6 cyber hunt and incident response teams for the pur7 pose of leading Federal asset response activities and 

8 providing timely technical assistance to Federal and 

9 non-Federal entities, including across all critical in10 frastructure sectors, regarding actual or potential se11 curity incidents, as appropriate and upon request, in12 cluding— 

13 ‘‘(A) assistance to asset owners and opera14 tors in restoring services following a cyber inci15 dent; 

16 ‘‘(B) identification and analysis of cyberse17 curity risk and unauthorized cyber activity; 

18 ‘‘(C) mitigation strategies to prevent, deter, 

19 and protect against cybersecurity risks; 

20 ‘‘(D) recommendations to asset owners and 

21 operators for improving overall network and con22 trol systems security to lower cybersecurity risks, 

23 and other recommendations, as appropriate; and 

24 ‘‘(E) such other capabilities as the Sec25 retary determines appropriate. 
3 

† HR 1158 EAS 

1 ‘‘(2) ASSOCIATED METRICS.—The Center shall— 

2 ‘‘(A) define the goals and desired outcomes 

3 for each cyber hunt and incident response team; 

4 and 

5 ‘‘(B) develop metrics— 

6 ‘‘(i) to measure the effectiveness and ef7 ficiency of each cyber hunt and incident re8 sponse team in achieving the goals and de9 sired outcomes defined under subparagraph 

10 (A); and 

11 ‘‘(ii) that— 

12 ‘‘(I) are quantifiable and action13 able; and 

14 ‘‘(II) the Center shall use to im15 prove the effectiveness and account16 ability of, and service delivery by, 

17 cyber hunt and incident response 

18 teams. 

19 ‘‘(3) CYBERSECURITY SPECIALISTS.—After notice 

20 to, and with the approval of, the entity requesting ac21 tion by or technical assistance from the Center, the 

22 Secretary may include cybersecurity specialists from 

23 the private sector on a cyber hunt and incident re24 sponse team.’’; and 

25 (4) in subsection (g), as so redesignated— 
4 

† HR 1158 EAS 

1 (A) in paragraph (1), by inserting ‘‘, or 

2 any team or activity of the Center,’’ after ‘‘Cen3 ter’’; and 

4 (B) in paragraph (2), by inserting ‘‘, or 

5 any team or activity of the Center,’’ after ‘‘Cen6 ter’’. 

7 (b) REPORT.— 

8 (1) DEFINITIONS.—In this subsection— 

9 (A) the term ‘‘Center’’ means the national 

10 cybersecurity and communications integration 

11 center established under section 2209(b) of the 

12 Homeland Security Act of 2002 (6 U.S.C. 

13 659(b)); 

14 (B) the term ‘‘cyber hunt and incident re15 sponse team’’ means a cyber hunt and incident 

16 response team maintained under section 2209(f) 

17 of the Homeland Security Act of 2002 (6 U.S.C. 

18 659(f)), as added by this Act; and 

19 (C) the term ‘‘incident’’ has the meaning 

20 given the term in section 2209(a) of the Home21 land Security Act of 2002 (6 U.S.C. 659(a)). 

22 (2) REPORT.—At the conclusion of each of the 

23 first 4 fiscal years after the date of enactment of the 

24 DHS Cyber Hunt and Incident Response Teams Act 

25 of 2019, the Center shall submit to the Committee on 
5 

† HR 1158 EAS 

1 Homeland Security and Governmental Affairs of the 

2 Senate and the Committee on Homeland Security of 

3 the House of Representatives a report that includes— 

4 (A) information relating to the metrics used 

5 for evaluation and assessment of the cyber hunt 

6 and incident response teams and operations 

7 under section 2209(f)(2) of the Homeland Secu8 rity Act of 2002 (6 U.S.C. 659(f)(2)), as added 

9 by this Act, including the resources and staffing 

10 of those cyber hunt and incident response teams; 

11 and 

12 (B) for the period covered by the report— 

13 (i) the total number of incident re14 sponse requests received; 

15 (ii) the number of incident response 

16 tickets opened; and 

17 (iii) a statement of— 

18 (I) all interagency staffing of 

19 cyber hunt and incident response 

20 teams; and 

21 (II) the interagency collaborations 

22 established to support cyber hunt and 

23 incident response teams. 

24 (c) NO ADDITIONAL FUNDS AUTHORIZED.—No addi25 tional funds are authorized to be appropriated to carry out 
6 

† HR 1158 EAS 

1 the requirements of this Act and the amendments made by 

2 this Act. Such requirements shall be carried out using 

3 amounts otherwise authorized to be appropriated. 

Attest: 

Secretary. 

116TH CONGRESS 

1ST SESSION H.R. 1158 

AMENDMENT