Title: DHS Industrial Control Systems Capabilities Enhancement Act of 2021
Policy area: Science, Technology, Communications

Summary:
DHS Industrial Control Systems Capabilities Enhancement Act of 2021
This bill requires the Cybersecurity and Infrastructure Security Agency (CISA) to maintain certain capabilities to identify and address threats to industrial control systems.
Specifically, the bill requires CISA's National Cybersecurity and Communications Integration Center to ensure that its activities address the security of both information and operational technology, including industrial control systems.
Additionally, CISA must maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes by (1) leading efforts to identify and mitigate cybersecurity threats to industrial control systems; (2) maintaining threat hunting and incident response capabilities to respond to cybersecurity risks and incidents; (3) providing cybersecurity technical assistance to stakeholders; and (4) collecting, coordinating, and providing vulnerability information to the industrial control systems community.
CISA shall provide to the homeland security committees a briefing on its industrial control systems capabilities at specified intervals.

[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[H.R. 1833 Introduced in House (IH)]

<DOC>






117th CONGRESS
  1st Session
                                H. R. 1833

     To amend the Homeland Security Act of 2002 to provide for the 
responsibility of the Cybersecurity and Infrastructure Security Agency 
  to maintain capabilities to identify threats to industrial control 
                    systems, and for other purposes.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                             March 11, 2021

Mr. Katko (for himself, Mr. Thompson of Mississippi, Mr. Garbarino, Ms. 
Clarke of New York, Mr. Bacon, Mr. Gimenez, Mrs. Cammack, Mr. Langevin, 
 and Mr. Rutherford) introduced the following bill; which was referred 
                 to the Committee on Homeland Security

_______________________________________________________________________

                                 A BILL


 
     To amend the Homeland Security Act of 2002 to provide for the 
responsibility of the Cybersecurity and Infrastructure Security Agency 
  to maintain capabilities to identify threats to industrial control 
                    systems, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``DHS Industrial Control Systems 
Capabilities Enhancement Act of 2021''.

SEC. 2. CAPABILITIES OF THE CYBERSECURITY AND INFRASTRUCTURE SECURITY 
              AGENCY TO IDENTIFY THREATS TO INDUSTRIAL CONTROL SYSTEMS.

    (a) In General.--Section 2209 of the Homeland Security Act of 2002 
(6 U.S.C. 659) is amended--
            (1) in subsection (e)(1)--
                    (A) in subparagraph (G), by striking ``and'' after 
                the semicolon;
                    (B) in subparagraph (H), by inserting ``and'' after 
                the semicolon; and
                    (C) by adding at the end the following new 
                subparagraph:
                    ``(I) activities of the Center address the security 
                of both information technology and operational 
                technology, including industrial control systems;''; 
                and
            (2) by adding at the end the following new subsection:
    ``(p) Industrial Control Systems.--The Director shall maintain 
capabilities to identify and address threats and vulnerabilities to 
products and technologies intended for use in the automated control of 
critical infrastructure processes. In carrying out this subsection, the 
Director shall--
            ``(1) lead Federal Government efforts to identify and 
        mitigate cybersecurity threats to industrial control systems, 
        including supervisory control and data acquisition systems;
            ``(2) maintain threat hunting and incident response 
        capabilities to respond to industrial control system 
        cybersecurity risks and incidents;
            ``(3) provide cybersecurity technical assistance to 
        industry end-users, product manufacturers, other Federal 
        agencies, and other industrial control system stakeholders to 
        identify, evaluate, assess, and mitigate vulnerabilities;
            ``(4) collect, coordinate, and provide vulnerability 
        information to the industrial control systems community by, as 
        appropriate, working closely with security researchers, 
        industry end-users, product manufacturers, other Federal 
        agencies, and other industrial control systems stakeholders; 
        and
            ``(5) conduct such other efforts and assistance as the 
        Secretary determines appropriate.''.
    (b) Report to Congress.--Not later than 180 days after the date of 
the enactment of this Act and every six months thereafter during the 
subsequent 4-year period, the Director of the Cybersecurity and 
Infrastructure Security Agency of the Department of Homeland Security 
shall provide to the Committee on Homeland Security of the House of 
Representatives and the Committee on Homeland Security and Governmental 
Affairs of the Senate a briefing on the industrial control systems 
capabilities of the Agency under section 2209 of the Homeland Security 
Act of 2002 (6 U.S.C. 659), as amended by subsection (a).
                                 <all>