DHS Cyber Hunt and Incident Response Teams Act of 2019

II Calendar No. 62 116TH CONGRESS 1ST SESSION S. 315 [Report No. 116–27] To authorize cyber hunt and incident response teams at the Department of Homeland Security, and for other purposes. IN THE SENATE OF THE UNITED STATES JANUARY 31, 2019 Ms. HASSAN (for herself, Mr. PORTMAN, and Mr. PETERS) introduced the fol- lowing bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs APRIL 8, 2019 Reported by Mr. JOHNSON, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To authorize cyber hunt and incident response teams at the Department of Homeland Security, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘DHS Cyber Hunt and 4 Incident Response Teams Act of 2019’’. 5 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6401 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS 2 •S 315 RS SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER 1 HUNT AND INCIDENT RESPONSE TEAMS. 2 (a) IN GENERAL.—Section 2209 of the Homeland 3 Security Act of 2002 (6 U.S.C. 659) is amended— 4 (1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 5 including cybersecurity specialists’’ after ‘‘entities’’; 6 (2) by redesignating subsections (f) through 7 (m) as subsections (g) through (n), respectively; 8 (3) by inserting after subsection (e) the fol- 9 lowing: 10 ‘‘(f) CYBER HUNT AND INCIDENT RESPONSE 11 TEAMS.— 12 ‘‘(1) IN GENERAL.—The Center shall maintain 13 cyber hunt and incident response teams for the pur- 14 pose of leading Federal asset response activities and 15 providing timely technical assistance to Federal and 16 non-Federal entities, including across all critical in- 17 frastructure sectors, regarding actual or potential 18 security incidents, as appropriate and upon request, 19 including— 20 ‘‘(A) assistance to asset owners and opera- 21 tors in restoring services following a cyber inci- 22 dent; 23 ‘‘(B) identification and analysis of cyberse- 24 curity risk and unauthorized cyber activity; 25 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS 3 •S 315 RS ‘‘(C) mitigation strategies to prevent, 1 deter, and protect against cybersecurity risks; 2 ‘‘(D) recommendations to asset owners and 3 operators for improving overall network and 4 control systems security to lower cybersecurity 5 risks, and other recommendations, as appro- 6 priate; and 7 ‘‘(E) such other capabilities as the Sec- 8 retary determines appropriate. 9 ‘‘(2) ASSOCIATED METRICS.—The Center shall 10 continually assess and evaluate the cyber hunt and 11 incident response teams and the operations of those 12 cyber hunt and incident response teams using robust 13 metrics. 14 ‘‘(3) REPORT.—At the conclusion of each of the 15 first 4 fiscal years after the date of enactment of the 16 DHS Cyber Hunt and Incident Response Teams Act 17 of 2019, the Center shall submit to the Committee 18 on Homeland Security and Governmental Affairs of 19 the Senate and the Committee on Homeland Secu- 20 rity of the House of Representatives a report that 21 includes— 22 ‘‘(A) information relating to the metrics 23 used for evaluation and assessment of the cyber 24 hunt and incident response teams and oper- 25 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS 4 •S 315 RS ations under paragraph (2), including the re- 1 sources and staffing of those cyber hunt and in- 2 cident response teams; and 3 ‘‘(B) for the period covered by the re- 4 port— 5 ‘‘(i) the total number of incident re- 6 sponse requests received; 7 ‘‘(ii) the number of incident response 8 tickets opened; and 9 ‘‘(iii) a statement of— 10 ‘‘(I) all interagency staffing of 11 cyber hunt and incident response 12 teams; and 13 ‘‘(II) the interagency collabora- 14 tions established to support cyber 15 hunt and incident response teams. 16 ‘‘(4) CYBERSECURITY SPECIALISTS.—After no- 17 tice to, and with the approval of, the entity request- 18 ing action by or technical assistance from the Cen- 19 ter, the Secretary may include cybersecurity special- 20 ists from the private sector on a cyber hunt and in- 21 cident response team.’’; and 22 (4) in subsection (g), as so redesignated— 23 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS 5 •S 315 RS (A) in paragraph (1), by inserting ‘‘, or 1 any team or activity of the Center,’’ after ‘‘Cen- 2 ter’’; and 3 (B) in paragraph (2), by inserting ‘‘, or 4 any team or activity of the Center,’’ after ‘‘Cen- 5 ter’’. 6 (b) NO ADDITIONAL FUNDS AUTHORIZED.—No ad- 7 ditional funds are authorized to be appropriated to carry 8 out the requirements of this Act and the amendments 9 made by this Act. Such requirements shall be carried out 10 using amounts otherwise authorized to be appropriated. 11 SECTION 1. SHORT TITLE. 12 This Act may be cited as the ‘‘DHS Cyber Hunt and 13 Incident Response Teams Act of 2019’’. 14 SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBER 15 HUNT AND INCIDENT RESPONSE TEAMS. 16 (a) IN GENERAL.—Section 2209 of the Homeland Se- 17 curity Act of 2002 (6 U.S.C. 659) is amended— 18 (1) in subsection (d)(1)(B)(iv), by inserting ‘‘, 19 including cybersecurity specialists’’ after ‘‘entities’’; 20 (2) by redesignating subsections (f) through (m) 21 as subsections (g) through (n), respectively; 22 (3) by inserting after subsection (e) the following: 23 ‘‘(f) CYBER HUNT AND INCIDENT RESPONSE TEAMS.— 24 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6203 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS 6 •S 315 RS ‘‘(1) IN GENERAL.—The Center shall maintain 1 cyber hunt and incident response teams for the pur- 2 pose of leading Federal asset response activities and 3 providing timely technical assistance to Federal and 4 non-Federal entities, including across all critical in- 5 frastructure sectors, regarding actual or potential se- 6 curity incidents, as appropriate and upon request, in- 7 cluding— 8 ‘‘(A) assistance to asset owners and opera- 9 tors in restoring services following a cyber inci- 10 dent; 11 ‘‘(B) identification and analysis of cyberse- 12 curity risk and unauthorized cyber activity; 13 ‘‘(C) mitigation strategies to prevent, deter, 14 and protect against cybersecurity risks; 15 ‘‘(D) recommendations to asset owners and 16 operators for improving overall network and con- 17 trol systems security to lower cybersecurity risks, 18 and other recommendations, as appropriate; and 19 ‘‘(E) such other capabilities as the Sec- 20 retary determines appropriate. 21 ‘‘(2) ASSOCIATED METRICS.—The Center shall— 22 ‘‘(A) define the goals and desired outcomes 23 for each cyber hunt and incident response team; 24 and 25 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6203 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS 7 •S 315 RS ‘‘(B) develop metrics— 1 ‘‘(i) to measure the effectiveness and ef- 2 ficiency of each cyber hunt and incident re- 3 sponse team in achieving the goals and de- 4 sired outcomes defined under subparagraph 5 (A); and 6 ‘‘(ii) that— 7 ‘‘(I) are quantifiable and action- 8 able; and 9 ‘‘(II) the Center shall use to im- 10 prove the effectiveness and account- 11 ability of, and service delivery by, 12 cyber hunt and incident response 13 teams. 14 ‘‘(3) CYBERSECURITY SPECIALISTS.—After notice 15 to, and with the approval of, the entity requesting ac- 16 tion by or technical assistance from the Center, the 17 Secretary may include cybersecurity specialists from 18 the private sector on a cyber hunt and incident re- 19 sponse team.’’; and 20 (4) in subsection (g), as so redesignated— 21 (A) in paragraph (1), by inserting ‘‘, or 22 any team or activity of the Center,’’ after ‘‘Cen- 23 ter’’; and 24 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS 8 •S 315 RS (B) in paragraph (2), by inserting ‘‘, or 1 any team or activity of the Center,’’ after ‘‘Cen- 2 ter’’. 3 (b) REPORT.— 4 (1) DEFINITIONS.—In this subsection— 5 (A) the term ‘‘Center’’ means the national 6 cybersecurity and communications integration 7 center established under section 2209(b) of the 8 Homeland Security Act of 2002 (6 U.S.C. 9 659(b)); 10 (B) the term ‘‘cyber hunt and incident re- 11 sponse team’’ means a cyber hunt and incident 12 response team maintained under section 2209(f) 13 of the Homeland Security Act of 2002 (6 U.S.C. 14 659(f)), as added by this Act; and 15 (C) the term ‘‘incident’’ has the meaning 16 given the term in section 2209(a) of the Home- 17 land Security Act of 2002 (6 U.S.C. 659(a)). 18 (2) REPORT.—At the conclusion of each of the 19 first 4 fiscal years after the date of enactment of the 20 DHS Cyber Hunt and Incident Response Teams Act 21 of 2019, the Center shall submit to the Committee on 22 Homeland Security and Governmental Affairs of the 23 Senate and the Committee on Homeland Security of 24 the House of Representatives a report that includes— 25 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS 9 •S 315 RS (A) information relating to the metrics used 1 for evaluation and assessment of the cyber hunt 2 and incident response teams and operations 3 under section 2209(f)(2) of the Homeland Secu- 4 rity Act of 2002 (6 U.S.C. 659(f)(2)), as added 5 by this Act, including the resources and staffing 6 of those cyber hunt and incident response teams; 7 and 8 (B) for the period covered by the report— 9 (i) the total number of incident re- 10 sponse requests received; 11 (ii) the number of incident response 12 tickets opened; and 13 (iii) a statement of— 14 (I) all interagency staffing of 15 cyber hunt and incident response 16 teams; and 17 (II) the interagency collaborations 18 established to support cyber hunt and 19 incident response teams. 20 (c) NO ADDITIONAL FUNDS AUTHORIZED.—No addi- 21 tional funds are authorized to be appropriated to carry out 22 the requirements of this Act and the amendments made by 23 this Act. Such requirements shall be carried out using 24 amounts otherwise authorized to be appropriated. 25 VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS Calendar No. 62 116TH CONGRESS 1ST SESSION S. 315 [Report No. 116–27] A BILL To authorize cyber hunt and incident response teams at the Department of Homeland Security, and for other purposes. APRIL 8, 2019 Reported with an amendment VerDate Sep 11 2014 22:21 Apr 08, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6651 Sfmt 6651 E:\BILLS\S315.RS S315 pamtmann on DSKBFK8HB2PROD with BILLS