DHS Industrial Control Systems Capabilities Enhancement Act of 2021

Bill: 117-hr-1833
Sponsor: full_name: Rep. Katko, John [R-NY-24]
Introduced: 2021-03-11
Policy area: Science, Technology, Communications
Subjects: Computer security and identity theft

Congressional oversight

Government studies and investigations

Homeland security

Industrial facilities

Infrastructure development

Manufacturing
Latest action: action_date: 2021-07-21
text: Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Summaries:
action_date: 2021-03-11
action_desc: Introduced in House
text: <p><b>DHS Industrial Control Systems Capabilities Enhancement Act of 2021</b></p> <p>This bill requires the Cybersecurity and Infrastructure Security Agency (CISA) to maintain certain capabilities to identify and address threats to industrial control systems. </p> <p>Specifically, the bill requires CISA's National Cybersecurity and Communications Integration Center to ensure that its activities address the security of both information and operational technology, including industrial control systems. </p> <p>Additionally, CISA must maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes by (1) leading efforts to identify and mitigate cybersecurity threats to industrial control systems; (2) maintaining threat hunting and incident response capabilities to respond to cybersecurity risks and incidents; (3) providing cybersecurity technical assistance to stakeholders; and (4) collecting, coordinating, and providing vulnerability information to the industrial control systems community.</p> <p> CISA shall provide to the homeland security committees a briefing on its industrial control systems capabilities at specified intervals.</p>

action_date: 2021-07-20
action_desc: Passed House
text: <p><b>DHS Industrial Control Systems Capabilities Enhancement Act of 2021</b></p> <p>This bill requires the Cybersecurity and Infrastructure Security Agency (CISA) to maintain certain capabilities to identify and address threats to industrial control systems. </p> <p>Specifically, the bill requires CISA's National Cybersecurity and Communications Integration Center to ensure that its activities address the security of both information and operational technology, including industrial control systems. </p> <p>Additionally, CISA must maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes by (1) leading efforts to identify and mitigate cybersecurity threats to industrial control systems; (2) maintaining threat hunting and incident response capabilities to respond to cybersecurity risks and incidents; (3) providing cybersecurity technical assistance to stakeholders; and (4) collecting, coordinating, and providing vulnerability information to the industrial control systems community.</p> <p>CISA shall provide to the homeland security committees a briefing on its industrial control systems capabilities at specified intervals.</p> <p>The Government Accountability Office must review and report on implementation of the bill's requirements.</p>

tv_txt: I 117th CONGRESS 1st Session H. R. 1833 IN THE HOUSE OF REPRESENTATIVES March 11, 2021 Mr. Katko (for himself, Mr. Thompson of Mississippi , Mr. Garbarino , Ms. Clarke of New York , Mr. Bacon , Mr. Gimenez , Mrs. Cammack , Mr. Langevin , and Mr. Rutherford ) introduced the following bill; which was referred to the Committee on Homeland Security A BILL To amend the Homeland Security Act of 2002 to provide for the responsibility of the Cybersecurity and Infrastructure Security Agency to maintain capabilities to identify threats to industrial control systems, and for other purposes.

1. Short title This Act may be cited as the DHS Industrial Control Systems Capabilities Enhancement Act of 2021 . 2. Capabilities of the Cybersecurity and Infrastructure Security Agency to identify threats to industrial control systems (a) In general Section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ) is amended— (1) in subsection (e)(1)— (A) in subparagraph (G), by striking and after the semicolon; (B) in subparagraph (H), by inserting and after the semicolon; and (C) by adding at the end the following new subparagraph: (I) activities of the Center address the security of both information technology and operational technology, including industrial control systems; ; and (2) by adding at the end the following new subsection: (p) Industrial control systems The Director shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes. In carrying out this subsection, the Director shall— (1) lead Federal Government efforts to identify and mitigate cybersecurity threats to industrial control systems, including supervisory control and data acquisition systems; (2) maintain threat hunting and incident response capabilities to respond to industrial control system cybersecurity risks and incidents; (3) provide cybersecurity technical assistance to industry end-users, product manufacturers, other Federal agencies, and other industrial control system stakeholders to identify, evaluate, assess, and mitigate vulnerabilities; (4) collect, coordinate, and provide vulnerability information to the industrial control systems community by, as appropriate, working closely with security researchers, industry end-users, product manufacturers, other Federal agencies, and other industrial control systems stakeholders; and (5) conduct such other efforts and assistance as the Secretary determines appropriate. . (b) Report to Congress Not later than 180 days after the date of the enactment of this Act and every six months thereafter during the subsequent 4-year period, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a briefing on the industrial control systems capabilities of the Agency under section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ), as amended by subsection (a).

tv_txt: 117th CONGRESS 1st Session H. R. 1833 IN THE HOUSE OF REPRESENTATIVES AN ACT To amend the Homeland Security Act of 2002 to provide for the responsibility of the Cybersecurity and Infrastructure Security Agency to maintain capabilities to identify threats to industrial control systems, and for other purposes.

1. Short title This Act may be cited as the DHS Industrial Control Systems Capabilities Enhancement Act of 2021 . 2. Capabilities of the Cybersecurity and Infrastructure Security Agency to identify threats to industrial control systems (a) In general Section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ) is amended— (1) in subsection (e)(1)— (A) in subparagraph (G), by striking and after the semicolon; (B) in subparagraph (H), by inserting and after the semicolon; and (C) by adding at the end the following new subparagraph: (I) activities of the Center address the security of both information technology and operational technology, including industrial control systems; ; and (2) by adding at the end the following new subsection: (p) Industrial control systems The Director shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes. In carrying out this subsection, the Director shall— (1) lead Federal Government efforts, in consultation with Sector Risk Management Agencies, as appropriate, to identify and mitigate cybersecurity threats to industrial control systems, including supervisory control and data acquisition systems; (2) maintain threat hunting and incident response capabilities to respond to industrial control system cybersecurity risks and incidents; (3) provide cybersecurity technical assistance to industry end-users, product manufacturers, Sector Risk Management Agencies, other Federal agencies, and other industrial control system stakeholders to identify, evaluate, assess, and mitigate vulnerabilities; (4) collect, coordinate, and provide vulnerability information to the industrial control systems community by, as appropriate, working closely with security researchers, industry end-users, product manufacturers, Sector Risk Management Agencies, other Federal agencies, and other industrial control systems stakeholders; and (5) conduct such other efforts and assistance as the Secretary determines appropriate. . (b) Report to Congress Not later than 180 days after the date of the enactment of this Act and every six months thereafter during the subsequent 4-year period, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a briefing on the industrial control systems capabilities of the Agency under section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ), as amended by subsection (a). (c) GAO review Not later than 2 years after the date of the enactment of this Act, the Comptroller General of the United States shall review implementation of the requirements of subsections (e)(1)(I) and (p) of section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ), as amended by subsection (a), and submit to the Committee on Homeland Security in the House of Representatives and the Committee on Homeland Security and Government Affairs of the Senate a report containing findings and recommendations relating to such implementation. Such report shall include information on the following: (1) Any interagency coordination challenges to the ability of the Director of the Cybersecurity and Infrastructure Agency of the Department of Homeland Security to lead Federal efforts to identify and mitigate cybersecurity threats to industrial control systems pursuant to subsection (p)(1) of such section. (2) The degree to which the Agency has adequate capacity, expertise, and resources to carry out threat hunting and incident response capabilities to mitigate cybersecurity threats to industrial control systems pursuant to subsection (p)(2) of such section, as well as additional resources that would be needed to close any operational gaps in such capabilities. (3) The extent to which industrial control system stakeholders sought cybersecurity technical assistance from the Agency pursuant to subsection (p)(3) of such section, and the utility and effectiveness of such technical assistance. (4) The degree to which the Agency works with security researchers and other industrial control systems stakeholders, pursuant to subsection (p)(4) of such section, to provide vulnerability information to the industrial control systems community.

Passed the House of Representatives July 20, 2021. Cheryl L. Johnson, Clerk.

tv_txt: IIB 117th CONGRESS 1st Session H. R. 1833 IN THE SENATE OF THE UNITED STATES July 21, 2021 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To amend the Homeland Security Act of 2002 to provide for the responsibility of the Cybersecurity and Infrastructure Security Agency to maintain capabilities to identify threats to industrial control systems, and for other purposes.

1. Short title This Act may be cited as the DHS Industrial Control Systems Capabilities Enhancement Act of 2021 . 2. Capabilities of the Cybersecurity and Infrastructure Security Agency to identify threats to industrial control systems (a) In general Section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ) is amended— (1) in subsection (e)(1)— (A) in subparagraph (G), by striking and after the semicolon; (B) in subparagraph (H), by inserting and after the semicolon; and (C) by adding at the end the following new subparagraph: (I) activities of the Center address the security of both information technology and operational technology, including industrial control systems; ; and (2) by adding at the end the following new subsection: (p) Industrial control systems The Director shall maintain capabilities to identify and address threats and vulnerabilities to products and technologies intended for use in the automated control of critical infrastructure processes. In carrying out this subsection, the Director shall— (1) lead Federal Government efforts, in consultation with Sector Risk Management Agencies, as appropriate, to identify and mitigate cybersecurity threats to industrial control systems, including supervisory control and data acquisition systems; (2) maintain threat hunting and incident response capabilities to respond to industrial control system cybersecurity risks and incidents; (3) provide cybersecurity technical assistance to industry end-users, product manufacturers, Sector Risk Management Agencies, other Federal agencies, and other industrial control system stakeholders to identify, evaluate, assess, and mitigate vulnerabilities; (4) collect, coordinate, and provide vulnerability information to the industrial control systems community by, as appropriate, working closely with security researchers, industry end-users, product manufacturers, Sector Risk Management Agencies, other Federal agencies, and other industrial control systems stakeholders; and (5) conduct such other efforts and assistance as the Secretary determines appropriate. . (b) Report to Congress Not later than 180 days after the date of the enactment of this Act and every six months thereafter during the subsequent 4-year period, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a briefing on the industrial control systems capabilities of the Agency under section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ), as amended by subsection (a). (c) GAO review Not later than 2 years after the date of the enactment of this Act, the Comptroller General of the United States shall review implementation of the requirements of subsections (e)(1)(I) and (p) of section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ), as amended by subsection (a), and submit to the Committee on Homeland Security in the House of Representatives and the Committee on Homeland Security and Government Affairs of the Senate a report containing findings and recommendations relating to such implementation. Such report shall include information on the following: (1) Any interagency coordination challenges to the ability of the Director of the Cybersecurity and Infrastructure Agency of the Department of Homeland Security to lead Federal efforts to identify and mitigate cybersecurity threats to industrial control systems pursuant to subsection (p)(1) of such section. (2) The degree to which the Agency has adequate capacity, expertise, and resources to carry out threat hunting and incident response capabilities to mitigate cybersecurity threats to industrial control systems pursuant to subsection (p)(2) of such section, as well as additional resources that would be needed to close any operational gaps in such capabilities. (3) The extent to which industrial control system stakeholders sought cybersecurity technical assistance from the Agency pursuant to subsection (p)(3) of such section, and the utility and effectiveness of such technical assistance. (4) The degree to which the Agency works with security researchers and other industrial control systems stakeholders, pursuant to subsection (p)(4) of such section, to provide vulnerability information to the industrial control systems community.

Passed the House of Representatives July 20, 2021. Cheryl L. Johnson, Clerk