II 

Calendar No. 631 

117TH CONGRESS 

2D SESSION S. 2439 

[Report No. 117–247] 

To amend the Homeland Security Act of 2002 to provide for the responsibility 

of the Cybersecurity and Infrastructure Security Agency to maintain 

capabilities to identify threats to industrial control systems, and for 

other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 22, 2021 

Mr. PETERS (for himself, Mr. PORTMAN, Mr. RUBIO, Mr. WARNER, and Ms. 

ROSEN) introduced the following bill; which was read twice and referred 

to the Committee on Homeland Security and Governmental Affairs 

DECEMBER 13, 2022 

Reported by Mr. PETERS, with an amendment 

[Omit the part struck through and insert the part printed in italic] 

A BILL 

To amend the Homeland Security Act of 2002 to provide 

for the responsibility of the Cybersecurity and Infrastructure Security Agency to maintain capabilities to identify 

threats to industrial control systems, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 2439 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘DHS Industrial Con3 trol Systems Capabilities Enhancement Act of 2021’’. 

4 SEC. 2. CAPABILITIES OF THE CYBERSECURITY AND INFRA5 STRUCTURE SECURITY AGENCY TO IDENTIFY 

6 THREATS TO INDUSTRIAL CONTROL SYS7 TEMS. 

8 (a) IN GENERAL.—Section 2209 of the Homeland 

9 Security Act of 2002 (6 U.S.C. 659) is amended— 

10 (1) in subsection (e)(1)— 

11 (A) in subparagraph (G), by striking 

12 ‘‘and;’’ after the semicolon; 

13 (B) in subparagraph (H), by inserting 

14 ‘‘and’’ after the semicolon; and 

15 (C) by adding at the end the following new 

16 subparagraph: 

17 ‘‘(I) activities of the Center address the se18 curity of both information technology and oper19 ational technology, including industrial control 

20 systems;’’; and 

21 (2) by adding at the end the following new sub22 section: 

23 ‘‘(p) INDUSTRIAL CONTROL SYSTEMS.—The Director 

24 shall maintain capabilities to identify and address threats 

25 and vulnerabilities to products and technologies intended 

26 for use in the automated control of critical infrastructure 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 2439 RS

1 processes. In carrying out this subsection, the Director 

2 shall— 

3 ‘‘(1) lead Federal Government efforts, in con4 sultation with Sector Risk Management Agencies, as 

5 appropriate, to identify and mitigate cybersecurity 

6 threats to industrial control systems, including su7 pervisory control and data acquisition systems; 

8 ‘‘(2) maintain threat hunting and incident re9 sponse capabilities to respond to industrial control 

10 system cybersecurity risks and incidents; 

11 ‘‘(3) provide cybersecurity technical assistance 

12 to industry end-users, product manufacturers, Sector 

13 Risk Management Agencies, other Federal agencies, 

14 and other industrial control system stakeholders to 

15 identify, evaluate, assess, and mitigate 

16 vulnerabilities; 

17 ‘‘(4) collect, coordinate, and provide vulner18 ability information to the industrial control systems 

19 community by, as appropriate, working closely with 

20 security researchers, industry end-users, product 

21 manufacturers, Sector Risk Management Agencies, 

22 other Federal agencies, and other industrial control 

23 systems stakeholders; and 

24 ‘‘(5) conduct such other efforts and assistance 

25 as the Secretary determines appropriate.’’. 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 2439 RS

1 (b) REPORT TO CONGRESS.—Not later than 180 days 

2 after the date of the enactment of this Act and every 6 

3 months thereafter during the subsequent 4-year period, 

4 the Director of the Cybersecurity and Infrastructure Secu5 rity Agency of the Department of Homeland Security shall 

6 provide to the Committee on Homeland Security and Gov7 ernmental Affairs of the Senate and the Committee on 

8 Homeland Security of the House of Representatives a 

9 briefing on the industrial control systems capabilities of 

10 the Agency under section 2209 of the Homeland Security 

11 Act of 2002 (6 U.S.C. 659), as amended by subsection 

12 (a). 

13 (c) GAO REVIEW.—Not later than two years after 

14 the date of the enactment of this Act, the Comptroller 

15 General of the United States shall review implementation 

16 of the requirements of subsections (e)(1)(I) and (p) of sec17 tion 2209 of the Homeland Security Act of 2002 (6 U.S.C. 

18 659), as amended by subsection (a), and submit to the 

19 Committee on Homeland Security and Government Gov20 ernmental Affairs of the Senate and the Committee on 

21 Homeland Security of the House of Representatives a re22 port containing findings and recommendations relating to 

23 such implementation. Such report shall include informa24 tion on the following: 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 2439 RS

1 (1) Any interagency coordination challenges to 

2 the ability of the Director of the Cybersecurity and 

3 Infrastructure Agency of the Department of Home4 land Security to lead Federal efforts to identify and 

5 mitigate cybersecurity threats to industrial control 

6 systems pursuant to subsection (p)(1) of such sec7 tion 2209. 

8 (2) The degree to which the Agency has ade9 quate capacity, expertise, and resources to carry out 

10 threat hunting and incident response capabilities to 

11 mitigate cybersecurity threats to industrial control 

12 systems pursuant to subsection (p)(2) of such sec13 tion 2209, as well as additional resources that would 

14 be needed to close any operational gaps in such ca15 pabilities. 

16 (3) The extent to which industrial control sys17 tem stakeholders sought cybersecurity technical as18 sistance from the Agency pursuant to subsection 

19 (p)(3) of such section 2209, and the utility and ef20 fectiveness of such technical assistance. 

21 (4) The degree to which the Agency works with 

22 security researchers and other industrial control sys23 tems stakeholders, pursuant to subsection (p)(4) of 

24 such section 2209, to provide vulnerability informa25 tion to the industrial control systems community. 


kjohnson on DSK79L0C42PROD with BILLS
Calendar No. 631 

117TH CONGRESS 

2D SESSION S. 2439 

[Report No. 117–247] 

A BILL 

To amend the Homeland Security Act of 2002 to 

trol systems, and for other purposes. capabilities to identify threats to industrial conand Infrastructure Security Agency to maintain provide for the responsibility of the Cybersecurity 

DECEMBER 13, 2022 

Reported with an amendment 


kjohnson on DSK79L0C42PROD with BILLS