In the Senate of the United States, 
September 24, 2019. 
Resolved, That the bill from the House of Representa-
tives (H.R. 1158) entitled ‘‘An Act to authorize cyber inci-
dent response teams at the Department of Homeland Secu-
rity, and for other purposes.’’, do pass with the following 
AMENDMENT: 
Strike all after the enacting clause and insert the 
following: 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘DHS Cyber Hunt and 
Incident Response Teams Act of 2019’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER 
HUNT AND INCIDENT RESPONSE TEAMS. 
(a) IN GENERAL.—Section 2209 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 659) is amended— 
(1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 
including cybersecurity specialists’’ after ‘‘entities’’;
† HR 1158 EAS 
(2) by redesignating subsections (f) through (m) 
as subsections (g) through (n), respectively; 
(3) by inserting after subsection (e) the following: 
‘‘(f) CYBER HUNT AND INCIDENT RESPONSE TEAMS.— 
‘‘(1) IN GENERAL.—The Center shall maintain 
cyber hunt and incident response teams for the pur-
pose of leading Federal asset response activities and 
providing timely technical assistance to Federal and 
non-Federal entities, including across all critical in-
frastructure sectors, regarding actual or potential se-
curity incidents, as appropriate and upon request, in-
cluding— 
‘‘(A) assistance to asset owners and opera-
tors in restoring services following a cyber inci-
dent; 
‘‘(B) identification and analysis of cyberse-
curity risk and unauthorized cyber activity; 
‘‘(C) mitigation strategies to prevent, deter, 
and protect against cybersecurity risks; 
‘‘(D) recommendations to asset owners and 
operators for improving overall network and con-
trol systems security to lower cybersecurity risks, 
and other recommendations, as appropriate; and 
‘‘(E) such other capabilities as the Sec-
retary determines appropriate.
† HR 1158 EAS 
‘‘(2) ASSOCIATED METRICS.—The Center shall— 
‘‘(A) define the goals and desired outcomes 
for each cyber hunt and incident response team; 
and 
‘‘(B) develop metrics— 
‘‘(i) to measure the effectiveness and ef-
ficiency of each cyber hunt and incident re-
sponse team in achieving the goals and de-
sired outcomes defined under subparagraph 
(A); and 
‘‘(ii) that— 
‘‘(I) are quantifiable and action-
able; and 
‘‘(II) the Center shall use to im-
prove the effectiveness and account-
ability of, and service delivery by, 
cyber hunt and incident response 
teams. 
‘‘(3) CYBERSECURITY SPECIALISTS.—After notice 
to, and with the approval of, the entity requesting ac-
tion by or technical assistance from the Center, the 
Secretary may include cybersecurity specialists from 
the private sector on a cyber hunt and incident re-
sponse team.’’; and 
(4) in subsection (g), as so redesignated—
† HR 1158 EAS 
(A) in paragraph (1), by inserting ‘‘, or 
any team or activity of the Center,’’ after ‘‘Cen-
ter’’; and 
(B) in paragraph (2), by inserting ‘‘, or 
any team or activity of the Center,’’ after ‘‘Cen-
ter’’. 
(b) REPORT.— 
(1) DEFINITIONS.—In this subsection— 
(A) the term ‘‘Center’’ means the national 
cybersecurity and communications integration 
center established under section 2209(b) of the 
Homeland Security Act of 2002 (6 U.S.C. 
659(b)); 
(B) the term ‘‘cyber hunt and incident re-
sponse team’’ means a cyber hunt and incident 
response team maintained under section 2209(f) 
of the Homeland Security Act of 2002 (6 U.S.C. 
659(f)), as added by this Act; and 
(C) the term ‘‘incident’’ has the meaning 
given the term in section 2209(a) of the Home-
land Security Act of 2002 (6 U.S.C. 659(a)). 
(2) REPORT.—At the conclusion of each of the 
first 4 fiscal years after the date of enactment of the 
DHS Cyber Hunt and Incident Response Teams Act 
of 2019, the Center shall submit to the Committee on
† HR 1158 EAS 
Homeland Security and Governmental Affairs of the 
Senate and the Committee on Homeland Security of 
the House of Representatives a report that includes— 
(A) information relating to the metrics used 
for evaluation and assessment of the cyber hunt 
and incident response teams and operations 
under section 2209(f)(2) of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 659(f)(2)), as added 
by this Act, including the resources and staffing 
of those cyber hunt and incident response teams; 
and 
(B) for the period covered by the report— 
(i) the total number of incident re-
sponse requests received; 
(ii) the number of incident response 
tickets opened; and 
(iii) a statement of— 
(I) all interagency staffing of 
cyber hunt and incident response 
teams; and 
(II) the interagency collaborations 
established to support cyber hunt and 
incident response teams. 
(c) NO ADDITIONAL FUNDS AUTHORIZED.—No addi-
tional funds are authorized to be appropriated to carry out