IB 
Union Calendar No. 463 
115TH CONGRESS 
2D SESSION 
H. R. 5074 
[Report No. 115–607] 
To authorize cyber incident response teams at the Department of Homeland 
Security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 20, 2018 
Mr. MCCAUL (for himself, Mr. RATCLIFFE, Mr. DONOVAN, Mr. GALLAGHER, 
Mr. FITZPATRICK, and Mr. BACON) introduced the following bill; which 
was referred to the Committee on Homeland Security 
MARCH 19, 2018 
Additional sponsors: Mr. KATKO and Mr. HIGGINS of Louisiana 
MARCH 19, 2018 
Committed to the Committee of the Whole House on the State of the Union 
and ordered to be printed 
VerDate Sep 11 2014 
23:06 Mar 19, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H5074.RH
H5074
sradovich on DSK3GMQ082PROD with BILLS
A BILL 
To authorize cyber incident response teams at the 
Department of Homeland Security, and for other purposes. 
VerDate Sep 11 2014 
23:06 Mar 19, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H5074.RH
H5074
sradovich on DSK3GMQ082PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘DHS Cyber Incident 
Response Teams Act of 2018’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER IN-
CIDENT RESPONSE TEAMS. 
(a) IN GENERAL.—Section 227 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 148) is amended— 
(1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 
including cybersecurity specialists’’ after ‘‘entities’’; 
(2) by redesignating subsections (f) through 
(m) as subsections (g) through (n), respectively; and 
(3) by inserting after subsection (d) the fol-
lowing new subsection (f): 
‘‘(f) CYBER INCIDENT RESPONSE TEAMS.— 
‘‘(1) IN GENERAL.—The Center shall maintain 
cyber hunt and incident response teams for the pur-
pose of providing, as appropriate and upon request, 
assistance, including the following: 
‘‘(A) Assistance to asset owners and opera-
tors in restoring services following a cyber inci-
dent. 
‘‘(B) The identification of cybersecurity 
risk and unauthorized cyber activity. 
VerDate Sep 11 2014 
23:06 Mar 19, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5074.RH
H5074
sradovich on DSK3GMQ082PROD with BILLS
‘‘(C) Mitigation strategies to prevent, 
deter, and protect against cybersecurity risks. 
‘‘(D) Recommendations to asset owners 
and operators for improving overall network 
and control systems security to lower cybersecu-
rity risks, and other recommendations, as ap-
propriate. 
‘‘(E) Such other capabilities as the Under 
Secretary appointed under section 103(a)(1)(H) 
determines appropriate. 
‘‘(2) CYBERSECURITY SPECIALISTS.—The Sec-
retary may include cybersecurity specialists from the 
private sector on cyber hunt and incident response 
teams. 
‘‘(3) ASSOCIATED METRICS.—The Center shall 
continually assess and evaluate the cyber incident re-
sponse teams and their operations using robust 
metrics. 
‘‘(4) SUBMITTAL
OF
INFORMATION
TO
CON-
GRESS.—Upon the conclusion of each of the first 
four fiscal years ending after the date of the enact-
ment of this subsection, the Center shall submit to 
the Committee on Homeland Security of the House 
of Representatives and the Homeland Security and 
Governmental Affairs Committee of the Senate, in-
VerDate Sep 11 2014 
23:06 Mar 19, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5074.RH
H5074
sradovich on DSK3GMQ082PROD with BILLS
formation on the metrics used for evaluation and as-
sessment of the cyber incident response teams and 
operations pursuant to paragraph (3), including the 
resources and staffing of such cyber incident re-
sponse teams. Such information shall include each of 
the following for the period covered by the report: 
‘‘(A) The total number of incident re-
sponse requests received. 
‘‘(B) The number of incident response 
tickets opened. 
‘‘(C) All interagency staffing of incident 
response teams. 
‘‘(D) The interagency collaborations estab-
lished to support incident response teams.’’; and 
(4) in subsection (g), as redesignated by para-
graph (2)— 
(A) in paragraph (1), by inserting ‘‘, or 
any team or activity of the Center,’’ after ‘‘Cen-
ter’’; and 
(B) in paragraph (2), by inserting ‘‘, or 
any team or activity of the Center,’’ after ‘‘Cen-
ter’’. 
(b) NO ADDITIONAL FUNDS AUTHORIZED.—No ad-
ditional funds are authorized to be appropriated to carry 
out the requirements of this Act and the amendments 
VerDate Sep 11 2014 
23:06 Mar 19, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5074.RH
H5074
sradovich on DSK3GMQ082PROD with BILLS
made by this Act. Such requirements shall be carried out 
using amounts otherwise authorized to be appropriated. 
VerDate Sep 11 2014 
23:06 Mar 19, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5074.RH
H5074
sradovich on DSK3GMQ082PROD with BILLS
VerDate Sep 11 2014 
23:06 Mar 19, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5074.RH
H5074
sradovich on DSK3GMQ082PROD with BILLS
Union Calendar No. 463 
115TH CONGRESS 
2D SESSION 
H. R. 5074 
[Report No. 115–607] 
A BILL 
To authorize cyber incident response teams at the 
Department of Homeland Security, and for other 
purposes. 
MARCH 19, 2018 
Committed to the Committee of the Whole House on the 
State of the Union and ordered to be printed 
VerDate Sep 11 2014 
23:06 Mar 19, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\H5074.RH
H5074
sradovich on DSK3GMQ082PROD with BILLS