IB 

Union Calendar No. 463 

115TH CONGRESS 

2D SESSION H. R. 5074 

[Report No. 115–607] 

To authorize cyber incident response teams at the Department of Homeland 

Security, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 20, 2018 

Mr. MCCAUL (for himself, Mr. RATCLIFFE, Mr. DONOVAN, Mr. GALLAGHER, 

Mr. FITZPATRICK, and Mr. BACON) introduced the following bill; which 

was referred to the Committee on Homeland Security 

MARCH 19, 2018 

Additional sponsors: Mr. KATKO and Mr. HIGGINS of Louisiana 

MARCH 19, 2018 

Committed to the Committee of the Whole House on the State of the Union 

and ordered to be printed 


sradovich on DSK3GMQ082PROD with BILLS
2 

•HR 5074 RH

A BILL 

To authorize cyber incident response teams at the 

Department of Homeland Security, and for other purposes. 


sradovich on DSK3GMQ082PROD with BILLS
3 

•HR 5074 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘DHS Cyber Incident 

5 Response Teams Act of 2018’’. 

6 SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER IN7 CIDENT RESPONSE TEAMS. 

8 (a) IN GENERAL.—Section 227 of the Homeland Se9 curity Act of 2002 (6 U.S.C. 148) is amended— 

10 (1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 

11 including cybersecurity specialists’’ after ‘‘entities’’; 

12 (2) by redesignating subsections (f) through 

13 (m) as subsections (g) through (n), respectively; and 

14 (3) by inserting after subsection (d) the fol15 lowing new subsection (f): 

16 ‘‘(f) CYBER INCIDENT RESPONSE TEAMS.— 

17 ‘‘(1) IN GENERAL.—The Center shall maintain 

18 cyber hunt and incident response teams for the pur19 pose of providing, as appropriate and upon request, 

20 assistance, including the following: 

21 ‘‘(A) Assistance to asset owners and opera22 tors in restoring services following a cyber inci23 dent. 

24 ‘‘(B) The identification of cybersecurity 

25 risk and unauthorized cyber activity. 


sradovich on DSK3GMQ082PROD with BILLS
4 

•HR 5074 RH

1 ‘‘(C) Mitigation strategies to prevent, 

2 deter, and protect against cybersecurity risks. 

3 ‘‘(D) Recommendations to asset owners 

4 and operators for improving overall network 

5 and control systems security to lower cybersecu6 rity risks, and other recommendations, as ap7 propriate. 

8 ‘‘(E) Such other capabilities as the Under 

9 Secretary appointed under section 103(a)(1)(H) 

10 determines appropriate. 

11 ‘‘(2) CYBERSECURITY SPECIALISTS.—The Sec12 retary may include cybersecurity specialists from the 

13 private sector on cyber hunt and incident response 

14 teams. 

15 ‘‘(3) ASSOCIATED METRICS.—The Center shall 

16 continually assess and evaluate the cyber incident re17 sponse teams and their operations using robust 

18 metrics. 

19 ‘‘(4) SUBMITTAL OF INFORMATION TO CON20 GRESS.—Upon the conclusion of each of the first 

21 four fiscal years ending after the date of the enact22 ment of this subsection, the Center shall submit to 

23 the Committee on Homeland Security of the House 

24 of Representatives and the Homeland Security and 

25 Governmental Affairs Committee of the Senate, inVerDate Sep 11 2014 23:06 Mar 19, 2018 Jkt 079200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H5074.RH H5074

sradovich on DSK3GMQ082PROD with BILLS
5 

•HR 5074 RH

1 formation on the metrics used for evaluation and as2 sessment of the cyber incident response teams and 

3 operations pursuant to paragraph (3), including the 

4 resources and staffing of such cyber incident re5 sponse teams. Such information shall include each of 

6 the following for the period covered by the report: 

7 ‘‘(A) The total number of incident re8 sponse requests received. 

9 ‘‘(B) The number of incident response 

10 tickets opened. 

11 ‘‘(C) All interagency staffing of incident 

12 response teams. 

13 ‘‘(D) The interagency collaborations estab14 lished to support incident response teams.’’; and 

15 (4) in subsection (g), as redesignated by para16 graph (2)— 

17 (A) in paragraph (1), by inserting ‘‘, or 

18 any team or activity of the Center,’’ after ‘‘Cen19 ter’’; and 

20 (B) in paragraph (2), by inserting ‘‘, or 

21 any team or activity of the Center,’’ after ‘‘Cen22 ter’’. 

23 (b) NO ADDITIONAL FUNDS AUTHORIZED.—No ad24 ditional funds are authorized to be appropriated to carry 

25 out the requirements of this Act and the amendments 


sradovich on DSK3GMQ082PROD with BILLS
6 

•HR 5074 RH

1 made by this Act. Such requirements shall be carried out 

2 using amounts otherwise authorized to be appropriated. 


sradovich on DSK3GMQ082PROD with BILLS

sradovich on DSK3GMQ082PROD with BILLS
Union Calendar No. 463 

115TH CONGRESS 

2D SESSION H. R. 5074 

[Report No. 115–607] 

A BILL 

To authorize cyber incident response teams at the 

purposes. Department of Homeland Security, and for other 

MARCH 19, 2018 

Committed to the Committee of the Whole House on the 

State of the Union and ordered to be printed 


sradovich on DSK3GMQ082PROD with BILLS