DHS Industrial Control Systems Capabilities Enhancement Act of 2021

IIB 117TH CONGRESS 1ST SESSION H. R. 1833 IN THE SENATE OF THE UNITED STATES JULY 21, 2021 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To amend the Homeland Security Act of 2002 to provide for the responsibility of the Cybersecurity and Infrastruc- ture Security Agency to maintain capabilities to identify threats to industrial control systems, and for other pur- poses. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 01:27 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H1833.RFS H1833 pbinns on DSKJLVW7X2PROD with BILLS 2 HR 1833 RFS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘DHS Industrial Con- 2 trol Systems Capabilities Enhancement Act of 2021’’. 3 SEC. 2. CAPABILITIES OF THE CYBERSECURITY AND INFRA- 4 STRUCTURE SECURITY AGENCY TO IDENTIFY 5 THREATS TO INDUSTRIAL CONTROL SYS- 6 TEMS. 7 (a) IN GENERAL.—Section 2209 of the Homeland 8 Security Act of 2002 (6 U.S.C. 659) is amended— 9 (1) in subsection (e)(1)— 10 (A) in subparagraph (G), by striking 11 ‘‘and’’ after the semicolon; 12 (B) in subparagraph (H), by inserting 13 ‘‘and’’ after the semicolon; and 14 (C) by adding at the end the following new 15 subparagraph: 16 ‘‘(I) activities of the Center address the se- 17 curity of both information technology and oper- 18 ational technology, including industrial control 19 systems;’’; and 20 (2) by adding at the end the following new sub- 21 section: 22 ‘‘(p) INDUSTRIAL CONTROL SYSTEMS.—The Director 23 shall maintain capabilities to identify and address threats 24 and vulnerabilities to products and technologies intended 25 for use in the automated control of critical infrastructure 26 VerDate Sep 11 2014 01:27 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H1833.RFS H1833 pbinns on DSKJLVW7X2PROD with BILLS 3 HR 1833 RFS processes. In carrying out this subsection, the Director 1 shall— 2 ‘‘(1) lead Federal Government efforts, in con- 3 sultation with Sector Risk Management Agencies, as 4 appropriate, to identify and mitigate cybersecurity 5 threats to industrial control systems, including su- 6 pervisory control and data acquisition systems; 7 ‘‘(2) maintain threat hunting and incident re- 8 sponse capabilities to respond to industrial control 9 system cybersecurity risks and incidents; 10 ‘‘(3) provide cybersecurity technical assistance 11 to industry end-users, product manufacturers, Sector 12 Risk Management Agencies, other Federal agencies, 13 and other industrial control system stakeholders to 14 identify, evaluate, assess, and mitigate 15 vulnerabilities; 16 ‘‘(4) collect, coordinate, and provide vulner- 17 ability information to the industrial control systems 18 community by, as appropriate, working closely with 19 security researchers, industry end-users, product 20 manufacturers, Sector Risk Management Agencies, 21 other Federal agencies, and other industrial control 22 systems stakeholders; and 23 ‘‘(5) conduct such other efforts and assistance 24 as the Secretary determines appropriate.’’. 25 VerDate Sep 11 2014 01:27 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H1833.RFS H1833 pbinns on DSKJLVW7X2PROD with BILLS 4 HR 1833 RFS (b) REPORT TO CONGRESS.—Not later than 180 days 1 after the date of the enactment of this Act and every six 2 months thereafter during the subsequent 4-year period, 3 the Director of the Cybersecurity and Infrastructure Secu- 4 rity Agency of the Department of Homeland Security shall 5 provide to the Committee on Homeland Security of the 6 House of Representatives and the Committee on Home- 7 land Security and Governmental Affairs of the Senate a 8 briefing on the industrial control systems capabilities of 9 the Agency under section 2209 of the Homeland Security 10 Act of 2002 (6 U.S.C. 659), as amended by subsection 11 (a). 12 (c) GAO REVIEW.—Not later than 2 years after the 13 date of the enactment of this Act, the Comptroller General 14 of the United States shall review implementation of the 15 requirements of subsections (e)(1)(I) and (p) of section 16 2209 of the Homeland Security Act of 2002 (6 U.S.C. 17 659), as amended by subsection (a), and submit to the 18 Committee on Homeland Security in the House of Rep- 19 resentatives and the Committee on Homeland Security 20 and Government Affairs of the Senate a report containing 21 findings and recommendations relating to such implemen- 22 tation. Such report shall include information on the fol- 23 lowing: 24 VerDate Sep 11 2014 01:27 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H1833.RFS H1833 pbinns on DSKJLVW7X2PROD with BILLS 5 HR 1833 RFS (1) Any interagency coordination challenges to 1 the ability of the Director of the Cybersecurity and 2 Infrastructure Agency of the Department of Home- 3 land Security to lead Federal efforts to identify and 4 mitigate cybersecurity threats to industrial control 5 systems pursuant to subsection (p)(1) of such sec- 6 tion. 7 (2) The degree to which the Agency has ade- 8 quate capacity, expertise, and resources to carry out 9 threat hunting and incident response capabilities to 10 mitigate cybersecurity threats to industrial control 11 systems pursuant to subsection (p)(2) of such sec- 12 tion, as well as additional resources that would be 13 needed to close any operational gaps in such capa- 14 bilities. 15 (3) The extent to which industrial control sys- 16 tem stakeholders sought cybersecurity technical as- 17 sistance from the Agency pursuant to subsection 18 (p)(3) of such section, and the utility and effective- 19 ness of such technical assistance. 20 (4) The degree to which the Agency works with 21 security researchers and other industrial control sys- 22 tems stakeholders, pursuant to subsection (p)(4) of 23 VerDate Sep 11 2014 01:27 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H1833.RFS H1833 pbinns on DSKJLVW7X2PROD with BILLS 6 HR 1833 RFS such section, to provide vulnerability information to 1 the industrial control systems community. 2 Passed the House of Representatives July 20, 2021. Attest: CHERYL L. JOHNSON, Clerk. VerDate Sep 11 2014 01:27 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H1833.RFS H1833 pbinns on DSKJLVW7X2PROD with BILLS