Title: DHS Cyber Incident Response Teams Act of 2018
Policy area: Science, Technology, Communications

Summary:
DHS Cyber Incident Response Teams Act of 2018
This bill amends the Homeland Security Act of 2002 to require the Department of Homeland Security's (DHS's) national cybersecurity and communications integration center to maintain cyber hunt and incident response teams to provide, upon request, assistance including: (1) assisting asset owners and operators in restoring services following a cyber incident; (2) identifying cybersecurity risk and unauthorized cyber activity; and (3) mitigation strategies to prevent, deter, and protect against cybersecurity risks.
DHS may include private sector cybersecurity specialists on such teams, and must continually assess and evaluate the teams and their operations and report specified metrics to Congress.
No additional funds are authorized to carry out this bill.

[Congressional Bills 115th Congress]
[From the U.S. Government Publishing Office]
[S. 3309 Introduced in Senate (IS)]

<DOC>






115th CONGRESS
  2d Session
                                S. 3309

    To authorize cyber incident response teams at the Department of 
               Homeland Security, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             July 31, 2018

Ms. Hassan (for herself and Mr. Portman) introduced the following bill; 
which was read twice and referred to the Committee on Homeland Security 
                        and Governmental Affairs

_______________________________________________________________________

                                 A BILL


 
    To authorize cyber incident response teams at the Department of 
               Homeland Security, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``DHS Cyber Incident Response Teams 
Act of 2018''.

SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER INCIDENT RESPONSE TEAMS.

    (a) In General.--Section 227 of the Homeland Security Act of 2002 
(6 U.S.C. 148) is amended--
            (1) in subsection (d)(1)(B)(iv), by inserting ``, including 
        cybersecurity specialists'' after ``entities'';
            (2) by redesignating subsections (f) through (m) as 
        subsections (g) through (n), respectively;
            (3) by inserting after subsection (e) the following:
    ``(f) Cyber Incident Response Teams.--
            ``(1) In general.--The Center shall maintain cyber hunt and 
        incident response teams for the purpose of providing, as 
        appropriate and upon request, assistance, including--
                    ``(A) assistance to asset owners and operators in 
                restoring services following a cyber incident;
                    ``(B) identification of cybersecurity risk and 
                unauthorized cyber activity;
                    ``(C) mitigation strategies to prevent, deter, and 
                protect against cybersecurity risks;
                    ``(D) recommendations to asset owners and operators 
                for improving overall network and control systems 
                security to lower cybersecurity risks, and other 
                recommendations, as appropriate; and
                    ``(E) such other capabilities as the Under 
                Secretary appointed under section 103(a)(1)(H) 
                determines appropriate.
            ``(2) Cybersecurity specialists.--The Secretary may include 
        cybersecurity specialists from the private sector on cyber hunt 
        and incident response teams.
            ``(3) Associated metrics.--The Center shall continually 
        assess and evaluate the cyber incident response teams and the 
        operations of those cyber incident response teams using robust 
        metrics.
            ``(4) Report.--At the conclusion of each of the first 4 
        fiscal years after the date of the enactment of this 
        subsection, the Center shall submit to the Committee on 
        Homeland Security and Governmental Affairs of the Senate and 
        the Committee on Homeland Security of the House of 
        Representatives a report that includes--
                    ``(A) information relating to the metrics used for 
                evaluation and assessment of the cyber incident 
                response teams and operations under paragraph (3), 
                including the resources and staffing of those cyber 
                incident response teams; and
                    ``(B) for the period covered by the report--
                            ``(i) the total number of incident response 
                        requests received;
                            ``(ii) the number of incident response 
                        tickets opened; and
                            ``(iii) a statement of--
                                    ``(I) all interagency staffing of 
                                incident response teams; and
                                    ``(II) the interagency 
                                collaborations established to support 
                                incident response teams.''; and
            (4) in subsection (g), as so redesignated--
                    (A) in paragraph (1), by inserting ``, or any team 
                or activity of the Center,'' after ``Center''; and
                    (B) in paragraph (2), by inserting ``, or any team 
                or activity of the Center,'' after ``Center''.
    (b) No Additional Funds Authorized.--No additional funds are 
authorized to be appropriated to carry out the requirements of this Act 
and the amendments made by this Act. Such requirements shall be carried 
out using amounts otherwise authorized to be appropriated.
                                 <all>