116TH CONGRESS 

1ST SESSION H. R. 1158 

AN ACT 

To authorize cyber incident response teams at the 

Department of Homeland Security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

•HR 1158 EH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘DHS Cyber Incident 

3 Response Teams Act of 2019’’. 

4 SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER IN5 CIDENT RESPONSE TEAMS. 

6 (a) IN GENERAL.—Section 2209 of the Homeland 

7 Security Act of 2002 (6 U.S.C. 148) is amended— 

8 (1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 

9 including cybersecurity specialists’’ after ‘‘entities’’; 

10 (2) by redesignating subsections (f) through 

11 (m) as subsections (g) through (n), respectively; 

12 (3) by inserting after subsection (e) the fol13 lowing new subsection (f): 

14 ‘‘(f) CYBER INCIDENT RESPONSE TEAMS.— 

15 ‘‘(1) IN GENERAL.—The Center shall maintain 

16 cyber hunt and incident response teams for the pur17 pose of providing, as appropriate and upon request, 

18 assistance, including the following: 

19 ‘‘(A) Assistance to asset owners and opera20 tors in restoring services following a cyber inci21 dent. 

22 ‘‘(B) The identification of cybersecurity 

23 risk and unauthorized cyber activity. 

24 ‘‘(C) Mitigation strategies to prevent, 

25 deter, and protect against cybersecurity risks. 
3 

•HR 1158 EH

1 ‘‘(D) Recommendations to asset owners 

2 and operators for improving overall network 

3 and control systems security to lower cybersecu4 rity risks, and other recommendations, as ap5 propriate. 

6 ‘‘(E) Such other capabilities as the Under 

7 Secretary appointed under section 103(a)(1)(H) 

8 determines appropriate. 

9 ‘‘(2) CYBERSECURITY SPECIALISTS.—The Sec10 retary may include cybersecurity specialists from the 

11 private sector on cyber hunt and incident response 

12 teams. 

13 ‘‘(3) ASSOCIATED METRICS.—The Center shall 

14 continually assess and evaluate the cyber incident re15 sponse teams and their operations using robust 

16 metrics. 

17 ‘‘(4) SUBMITTAL OF INFORMATION TO CON18 GRESS.—Upon the conclusion of each of the first 4 

19 fiscal years ending after the date of the enactment 

20 of this subsection, the Center shall submit to the 

21 Committee on Homeland Security of the House of 

22 Representatives and the Homeland Security and 

23 Governmental Affairs Committee of the Senate, in24 formation on the metrics used for evaluation and as25 sessment of the cyber incident response teams and 
4 

•HR 1158 EH

1 operations pursuant to paragraph (3), including the 

2 resources and staffing of such cyber incident re3 sponse teams. Such information shall include each of 

4 the following for the period covered by the report: 

5 ‘‘(A) The total number of incident re6 sponse requests received. 

7 ‘‘(B) The number of incident response 

8 tickets opened. 

9 ‘‘(C) All interagency staffing of incident 

10 response teams. 

11 ‘‘(D) The interagency collaborations estab12 lished to support incident response teams.’’; and 

13 (4) in subsection (g), as redesignated by para14 graph (2)— 

15 (A) in paragraph (1), by inserting ‘‘, or 

16 any team or activity of the Center,’’ after ‘‘Cen17 ter’’; and 

18 (B) in paragraph (2), by inserting ‘‘, or 

19 any team or activity of the Center,’’ after ‘‘Cen20 ter’’. 

21 (b) NO ADDITIONAL FUNDS AUTHORIZED.—No ad22 ditional funds are authorized to be appropriated to carry 

23 out the requirements of this Act and the amendments 
5 

•HR 1158 EH

1 made by this Act. Such requirements shall be carried out 

2 using amounts otherwise authorized to be appropriated. 

Passed the House of Representatives June 10, 2019. 

Attest: 

Clerk. 
116TH CONGRESS 

1ST SESSION H. R. 1158 

AN ACT 

To authorize cyber incident response teams at the 

purposes. Department of Homeland Security, and for other