DHS Industrial Control Systems Capabilities Enhancement Act of 2018

Bill: 115-hr-5733
Sponsor: full_name: Rep. Bacon, Don [R-NE-2]
Introduced: 2018-05-09
Policy area: Emergency Management
Subjects: Computer security and identity theft

Congressional oversight

Government studies and investigations

Homeland security

Infrastructure development
Latest action: action_date: 2018-06-26
text: Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Summaries:
action_date: 2018-05-09
action_desc: Introduced in House
text: <p><b>DHS Industrial Control Systems Capabilities Enhancement Act of 2018</b></p> <p>This bill amends the Homeland Security Act of 2002 to expand the responsibilities of the National Cybersecurity and Communications Integration Center to ensure that the center's activities address the security of both information and operational technology, including industrial control systems. Additionally, the center must maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes by: (1) leading efforts to mitigate cybersecurity threats to industrial control systems, (2) maintaining cross-sector incident response capabilities to respond to cybersecurity incidents, and (3) providing cybersecurity technical assistance to stakeholders.</p>

action_date: 2018-06-22
action_desc: Reported to House with amendment(s)
text: <p><b>DHS Industrial Control Systems Capabilities Enhancement Act of 2018</b></p> <p>This bill amends the Homeland Security Act of 2002 to expand the responsibilities of the National Cybersecurity and Communications Integration Center to ensure that the center's activities address the security of both information and operational technology, including industrial control systems. </p> <p>Additionally, the center must maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes by: (1) leading efforts to mitigate cybersecurity threats to industrial control systems; (2) maintaining cross-sector incident response capabilities to respond to cybersecurity incidents; (3) providing cybersecurity technical assistance to stakeholders; and (4) collecting, coordinating, and providing vulnerability information to the industrial control systems community.</p> <p>The center shall provide to the homeland security committees a briefing on its industrial control systems capabilities at specified intervals.</p>

action_date: 2018-06-25
action_desc: Passed House amended
text: <p><b>DHS Industrial Control Systems Capabilities Enhancement Act of 2018</b></p> <p>(Sec. 2) This bill amends the Homeland Security Act of 2002 to expand the responsibilities of the National Cybersecurity and Communications Integration Center to ensure that the center's activities address the security of both information and operational technology, including industrial control systems. </p> <p>Additionally, the center must maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes by: (1) leading efforts to mitigate cybersecurity threats to industrial control systems; (2) maintaining cross-sector incident response capabilities to respond to cybersecurity incidents; (3) providing cybersecurity technical assistance to stakeholders; and (4) collecting, coordinating, and providing vulnerability information to the industrial control systems community.</p> <p>The center shall provide to the homeland security committees a briefing on its industrial control systems capabilities at specified intervals.</p>

tv_txt: I 115th CONGRESS 2d Session H. R. 5733 IN THE HOUSE OF REPRESENTATIVES May 9, 2018 Mr. Bacon (for himself, Mr. McCaul , and Mr. Ratcliffe ) introduced the following bill; which was referred to the Committee on Homeland Security A BILL To amend the Homeland Security Act of 2002 to provide for the responsibility of the National Cybersecurity and Communications Integration Center to maintain capabilities to identify threats to industrial control systems, and for other purposes.

1. Short title This Act may be cited as the DHS Industrial Control Systems Capabilities Enhancement Act of 2018 . 2. Capabilities of National Cybersecurity and Communications Integration Center to identify threats to industrial control systems (a) In general Section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ) is amended— (1) in subsection (e)(1)— (A) in subparagraph (G), by striking and after the semicolon; (B) in subparagraph (H), by inserting and after the semicolon; and (C) by adding at the end the following new subparagraph: (I) activities of the Center address the security of both information technology and operational technology, including industrial control systems; ; (2) by redesignating subsections (f) through (m) as subsections (g) through (n), respectively; and (3) by inserting after subsection (d) the following new subsection: (f) Industrial control systems The Center shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes. In carrying out this subsection, the Center shall— (1) lead, in coordination with relevant sector specific agencies, Federal Government efforts to identify and mitigate cybersecurity threats to industrial control systems, including supervisory control and data acquisition systems; (2) maintain cross-sector incident response capabilities to respond to industrial control system cybersecurity incidents; (3) provide cybersecurity technical assistance to industry end-users, product manufacturers, and other industrial control system stakeholders to identify and mitigate vulnerabilities; and (4) conduct such other efforts and assistance as the Secretary determines appropriate. . (b) Report to Congress Not later than 180 days after the date of the enactment of this Act, and every 6 months thereafter during the subsequent four-year period, the National Cybersecurity and Communications Integration Center shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a briefing on the industrial control systems capabilities of the Center under subsection (f) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ), as added by subsection (a).

tv_txt: I 115th CONGRESS 2d Session H. R. 5733 IN THE HOUSE OF REPRESENTATIVES AN ACT To amend the Homeland Security Act of 2002 to provide for the responsibility of the National Cybersecurity and Communications Integration Center to maintain capabilities to identify threats to industrial control systems, and for other purposes.

1. Short title This Act may be cited as the DHS Industrial Control Systems Capabilities Enhancement Act of 2018 . 2. Capabilities of National Cybersecurity and Communications Integration Center to identify threats to industrial control systems (a) In general Section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ) is amended— (1) in subsection (e)(1)— (A) in subparagraph (G), by striking and after the semicolon; (B) in subparagraph (H), by inserting and after the semicolon; and (C) by adding at the end the following new subparagraph: (I) activities of the Center address the security of both information technology and operational technology, including industrial control systems; ; (2) by redesignating subsections (f) through (m) as subsections (g) through (n), respectively; and (3) by inserting after subsection (d) the following new subsection: (f) Industrial control systems The Center shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes. In carrying out this subsection, the Center shall— (1) lead, in coordination with relevant sector specific agencies, Federal Government efforts to identify and mitigate cybersecurity threats to industrial control systems, including supervisory control and data acquisition systems; (2) maintain cross-sector incident response capabilities to respond to industrial control system cybersecurity incidents; (3) provide cybersecurity technical assistance to industry end-users, product manufacturers, and other industrial control system stakeholders to identify and mitigate vulnerabilities; (4) collect, coordinate, and provide vulnerability information to the industrial control systems community by, as appropriate, working closely with security researchers, industry end-users, product manufacturers, and other industrial control systems stakeholders; and (5) conduct such other efforts and assistance as the Secretary determines appropriate. . (b) Report to Congress Not later than 180 days after the date of the enactment of this Act, and every 6 months thereafter during the subsequent 4-year period, the National Cybersecurity and Communications Integration Center shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a briefing on the industrial control systems capabilities of the Center under subsection (f) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ), as added by subsection (a).

Passed the House of Representatives June 25, 2018. Karen L. Haas, Clerk.

tv_txt: IIB 115th CONGRESS 2d Session H. R. 5733 IN THE SENATE OF THE UNITED STATES June 26, 2018 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To amend the Homeland Security Act of 2002 to provide for the responsibility of the National Cybersecurity and Communications Integration Center to maintain capabilities to identify threats to industrial control systems, and for other purposes.

1. Short title This Act may be cited as the DHS Industrial Control Systems Capabilities Enhancement Act of 2018 . 2. Capabilities of National Cybersecurity and Communications Integration Center to identify threats to industrial control systems (a) In general Section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ) is amended— (1) in subsection (e)(1)— (A) in subparagraph (G), by striking and after the semicolon; (B) in subparagraph (H), by inserting and after the semicolon; and (C) by adding at the end the following new subparagraph: (I) activities of the Center address the security of both information technology and operational technology, including industrial control systems; ; (2) by redesignating subsections (f) through (m) as subsections (g) through (n), respectively; and (3) by inserting after subsection (d) the following new subsection: (f) Industrial control systems The Center shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes. In carrying out this subsection, the Center shall— (1) lead, in coordination with relevant sector specific agencies, Federal Government efforts to identify and mitigate cybersecurity threats to industrial control systems, including supervisory control and data acquisition systems; (2) maintain cross-sector incident response capabilities to respond to industrial control system cybersecurity incidents; (3) provide cybersecurity technical assistance to industry end-users, product manufacturers, and other industrial control system stakeholders to identify and mitigate vulnerabilities; (4) collect, coordinate, and provide vulnerability information to the industrial control systems community by, as appropriate, working closely with security researchers, industry end-users, product manufacturers, and other industrial control systems stakeholders; and (5) conduct such other efforts and assistance as the Secretary determines appropriate. . (b) Report to Congress Not later than 180 days after the date of the enactment of this Act, and every 6 months thereafter during the subsequent 4-year period, the National Cybersecurity and Communications Integration Center shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a briefing on the industrial control systems capabilities of the Center under subsection (f) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ), as added by subsection (a).

Passed the House of Representatives June 25, 2018. Karen L. Haas, Clerk.

tv_txt: IB Union Calendar No. 603 115th CONGRESS 2d Session H. R. 5733 [Report No. 115–777] IN THE HOUSE OF REPRESENTATIVES May 9, 2018 Mr. Bacon (for himself, Mr. McCaul , and Mr. Ratcliffe ) introduced the following bill; which was referred to the Committee on Homeland Security June 22, 2018 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed Strike out all after the enacting clause and insert the part printed in italic For text of introduced bill, see copy of bill as introduced on May 9, 2018 A BILL To amend the Homeland Security Act of 2002 to provide for the responsibility of the National Cybersecurity and Communications Integration Center to maintain capabilities to identify threats to industrial control systems, and for other purposes.

1. Short title This Act may be cited as the DHS Industrial Control Systems Capabilities Enhancement Act of 2018 . 2. Capabilities of National Cybersecurity and Communications Integration Center to identify threats to industrial control systems (a) In general Section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ) is amended— (1) in subsection (e)(1)— (A) in subparagraph (G), by striking and after the semicolon; (B) in subparagraph (H), by inserting and after the semicolon; and (C) by adding at the end the following new subparagraph: (I) activities of the Center address the security of both information technology and operational technology, including industrial control systems; ; (2) by redesignating subsections (f) through (m) as subsections (g) through (n), respectively; and (3) by inserting after subsection (e) the following new subsection: (f) Industrial control systems The Center shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes. In carrying out this subsection, the Center shall— (1) lead, in coordination with relevant sector specific agencies, Federal Government efforts to identify and mitigate cybersecurity threats to industrial control systems, including supervisory control and data acquisition systems; (2) maintain cross-sector incident response capabilities to respond to industrial control system cybersecurity incidents; (3) provide cybersecurity technical assistance to industry end-users, product manufacturers, and other industrial control system stakeholders to identify and mitigate vulnerabilities; (4) collect, coordinate, and provide vulnerability information to the industrial control systems community by, as appropriate, working closely with security researchers, industry end-users, product manufacturers, and other industrial control systems stakeholders; and (5) conduct such other efforts and assistance as the Secretary determines appropriate. . (b) Report to Congress Not later than 180 days after the date of the enactment of this Act, and every 6 months thereafter during the subsequent four-year period, the National Cybersecurity and Communications Integration Center shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a briefing on the industrial control systems capabilities of the Center under subsection (f) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ), as added by subsection (a).

June 22, 2018 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed