National Risk Management Act of 2021

II Calendar No. 652 117TH CONGRESS 2D SESSION S. 1350 [Report No. 117–261] To require the Secretary of Homeland Security to establish a national risk management cycle, and for other purposes. IN THE SENATE OF THE UNITED STATES APRIL 22, 2021 Ms. HASSAN (for herself and Mr. SASSE) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs DECEMBER 15, 2022 Reported by Mr. PETERS, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To require the Secretary of Homeland Security to establish a national risk management cycle, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘National Risk Manage- 4 ment Act of 2021’’. 5 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6401 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 2 •S 1350 RS SEC. 2. NATIONAL RISK MANAGEMENT CYCLE. 1 (a) IN GENERAL.—Subtitle A of title XXII of the 2 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.), 3 is amended by adding at the end the following: 4 ‘‘SEC. 2218. NATIONAL RISK MANAGEMENT CYCLE. 5 ‘‘(a) DEFINITIONS.—In this section: 6 ‘‘(1) CRITICAL INFRASTRUCTURE.—The term 7 ‘critical infrastructure’ has the meaning given the 8 term in section 1016(e) of the Critical Infrastruc- 9 tures Protection Act of 2001 (42 U.S.C. 5195c(e)). 10 ‘‘(2) NATIONAL CRITICAL FUNCTIONS.—The 11 term ‘national critical functions’ means the functions 12 of government and the private sector so vital to the 13 United States that their disruption, corruption, or 14 dysfunction would have a debilitating effect on secu- 15 rity, national economic security, national public 16 health or safety, or any combination thereof. 17 ‘‘(b) NATIONAL RISK MANAGEMENT CYCLE.— 18 ‘‘(1) RISK IDENTIFICATION AND ASSESS- 19 MENT.— 20 ‘‘(A) IN GENERAL.—The Secretary, acting 21 through the Director, shall establish a process 22 by which to identify, assess, and prioritize risks 23 to critical infrastructure, considering both cyber 24 and physical threats, vulnerabilities, and con- 25 sequences. 26 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 3 •S 1350 RS ‘‘(B) CONSULTATION.—In establishing the 1 process required under subparagraph (A), the 2 Secretary shall consult with Sector Risk Man- 3 agement Agencies, critical infrastructure owners 4 and operators, and the National Cyber Direc- 5 tor. 6 ‘‘(C) PUBLICATION.—Not later than 180 7 days after the date of enactment of this section, 8 the Secretary shall publish in the Federal Reg- 9 ister procedures for the process established 10 under subparagraph (A). 11 ‘‘(D) REPORT.—The Secretary shall sub- 12 mit to the President, the Committee on Home- 13 land Security and Governmental Affairs of the 14 Senate, and the Committee on Homeland Secu- 15 rity of the House of Representatives a report on 16 the risks identified by the process established 17 under subparagraph (A)— 18 ‘‘(i) not later than 1 year after the 19 date of enactment of this section; and 20 ‘‘(ii) not later than 1 year after the 21 date on which the Secretary submits a 22 periodic evaluation described in section 23 9002(b)(2) of title XC of division H of the 24 William M. (Mac) Thornberry National 25 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 4 •S 1350 RS Defense Authorization Act for Fiscal Year 1 2021 (Public Law 116–283). 2 ‘‘(2) NATIONAL CRITICAL INFRASTRUCTURE RE- 3 SILIENCE STRATEGY.— 4 ‘‘(A) IN GENERAL.—Not later than 1 year 5 after the date on which the Secretary delivers 6 each report required under paragraph (1), the 7 President shall deliver to majority and minority 8 leaders of the Senate, the Speaker and minority 9 leader of the House of Representatives, the 10 Committee on Homeland Security and Govern- 11 mental Affairs of the Senate, and the Com- 12 mittee on Homeland Security of the House of 13 Representatives a national critical infrastruc- 14 ture resilience strategy designed to address the 15 risks identified by the Secretary. 16 ‘‘(B) ELEMENTS.—In each strategy deliv- 17 ered under subparagraph (A), the President 18 shall— 19 ‘‘(i) identify, assess, and prioritize 20 areas of risk to critical infrastructure that 21 would compromise, disrupt, or impede their 22 ability to support the national critical func- 23 tions of national security, economic secu- 24 rity, or public health and safety; 25 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 5 •S 1350 RS ‘‘(ii) assess the implementation of the 1 previous national critical infrastructure re- 2 silience strategy, as applicable; 3 ‘‘(iii) identify and outline current and 4 proposed national-level actions, programs, 5 and efforts to be taken to address the risks 6 identified; 7 ‘‘(iv) identify the Federal departments 8 or agencies responsible for leading each na- 9 tional-level action, program, or effort and 10 the relevant critical infrastructure sectors 11 for each; 12 ‘‘(v) outline the budget plan required 13 to provide sufficient resources to success- 14 fully execute the full range of activities 15 proposed or described by the strategy; and 16 ‘‘(vi) request any additional authori- 17 ties or resources necessary to successfully 18 execute the strategy. 19 ‘‘(C) FORM.—Each strategy delivered 20 under subparagraph (A) shall be unclassified, 21 but may contain a classified annex. 22 ‘‘(3) CONGRESSIONAL BRIEFING.—Not later 23 than 1 year after the date on which the President 24 delivers a strategy under this section, and every year 25 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 6 •S 1350 RS thereafter, the Secretary, in coordination with Sector 1 Risk Management Agencies, shall brief the appro- 2 priate committees of Congress on the national risk 3 management cycle activities undertaken pursuant to 4 the strategy.’’. 5 (b) TECHNICAL AND CONFORMING AMENDMENT.— 6 The table of contents in section 1(b) of the Homeland Se- 7 curity Act of 2002 (Public Law 107–296; 116 Stat. 2135) 8 is amended by inserting after the item relating to section 9 2217 the following: 10 ‘‘Sec. 2218. National risk management cycle.’’. SECTION 1. SHORT TITLE. 11 This Act may be cited as the ‘‘National Risk Manage- 12 ment Act of 2021’’. 13 SEC. 2. NATIONAL RISK MANAGEMENT CYCLE. 14 (a) IN GENERAL.—Subtitle A of title XXII of the 15 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) is 16 amended by adding at the end the following: 17 ‘‘SEC. 2218. NATIONAL RISK MANAGEMENT CYCLE. 18 ‘‘(a) NATIONAL CRITICAL FUNCTIONS DEFINED.—In 19 this section, the term ‘national critical functions’ means the 20 functions of government and the private sector so vital to 21 the United States that their disruption, corruption, or dys- 22 function would have a debilitating effect on security, na- 23 tional economic security, national public health or safety, 24 or any combination thereof. 25 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6203 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 7 •S 1350 RS ‘‘(b) NATIONAL RISK MANAGEMENT CYCLE.— 1 ‘‘(1) RISK IDENTIFICATION AND ASSESSMENT.— 2 ‘‘(A) IN GENERAL.—The Secretary, acting 3 through the Director, shall establish a recurring 4 process by which to identify, assess, and 5 prioritize risks to critical infrastructure, consid- 6 ering both cyber and physical threats, the associ- 7 ated likelihoods, vulnerabilities, and con- 8 sequences, and the resources necessary to address 9 them. 10 ‘‘(B) CONSULTATION.—In establishing the 11 process required under subparagraph (A), the 12 Secretary shall consult with, and request and 13 collect information to support analysis from, 14 Sector Risk Management Agencies, critical infra- 15 structure owners and operators, the Assistant to 16 the President for National Security Affairs, the 17 Assistant to the President for Homeland Secu- 18 rity, and the National Cyber Director. 19 ‘‘(C) PUBLICATION.—Not later than 180 20 days after the date of enactment of this section, 21 the Secretary shall publish in the Federal Reg- 22 ister procedures for the process established under 23 subparagraph (A), subject to any redactions the 24 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 8 •S 1350 RS Secretary determines are necessary to protect 1 classified or other sensitive information. 2 ‘‘(D) REPORT.—The Secretary shall submit 3 to the President, the Committee on Homeland 4 Security and Governmental Affairs of the Sen- 5 ate, and the Committee on Homeland Security of 6 the House of Representatives a report on the 7 risks identified by the process established under 8 subparagraph (A)— 9 ‘‘(i) not later than 1 year after the 10 date of enactment of this section; and 11 ‘‘(ii) not later than 1 year after the 12 date on which the Secretary submits a peri- 13 odic evaluation described in section 14 9002(b)(2) of title XC of division H of the 15 William M. (Mac) Thornberry National De- 16 fense Authorization Act for Fiscal Year 17 2021 (Public Law 116–283). 18 ‘‘(2) NATIONAL CRITICAL INFRASTRUCTURE RE- 19 SILIENCE STRATEGY.— 20 ‘‘(A) IN GENERAL.—Not later than 1 year 21 after the date on which the Secretary delivers 22 each report required under paragraph (1), the 23 President shall deliver to majority and minority 24 leaders of the Senate, the Speaker and minority 25 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 9 •S 1350 RS leader of the House of Representatives, the Com- 1 mittee on Homeland Security and Governmental 2 Affairs of the Senate, and the Committee on 3 Homeland Security of the House of Representa- 4 tives a national critical infrastructure resilience 5 strategy designed to address the risks identified 6 by the Secretary. 7 ‘‘(B) ELEMENTS.—Each strategy delivered 8 under subparagraph (A) shall— 9 ‘‘(i) identify, assess, and prioritize 10 areas of risk to critical infrastructure that 11 would compromise or disrupt national crit- 12 ical functions impacting national security, 13 economic security, or public health and 14 safety; 15 ‘‘(ii) assess the implementation of the 16 previous national critical infrastructure re- 17 silience strategy, as applicable; 18 ‘‘(iii) identify and outline current and 19 proposed national-level actions, programs, 20 and efforts to be taken to address the risks 21 identified; 22 ‘‘(iv) identify the Federal departments 23 or agencies responsible for leading each na- 24 tional-level action, program, or effort and 25 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 10 •S 1350 RS the relevant critical infrastructure sectors 1 for each; and 2 ‘‘(v) request any additional authorities 3 necessary to successfully execute the strat- 4 egy. 5 ‘‘(C) FORM.—Each strategy delivered under 6 subparagraph (A) shall be unclassified, but may 7 contain a classified annex. 8 ‘‘(3) CONGRESSIONAL BRIEFING.—Not later than 9 1 year after the date on which the President delivers 10 the first strategy required under paragraph (2)(A), 11 and every year thereafter, the Secretary, in coordina- 12 tion with Sector Risk Management Agencies, shall 13 brief the appropriate congressional committees on— 14 ‘‘(A) the national risk management cycle 15 activities undertaken pursuant to the strategy; 16 and 17 ‘‘(B) the amounts and timeline for funding 18 that the Secretary has determined would be nec- 19 essary to address risks and successfully execute 20 the full range of activities proposed by the strat- 21 egy.’’. 22 (b) TECHNICAL AND CONFORMING AMENDMENT.—The 23 table of contents in section 1(b) of the Homeland Security 24 Act of 2002 (Public Law 107–296; 116 Stat. 2135) is 25 VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS 11 •S 1350 RS amended by inserting after the item relating to section 2217 1 the following: 2 ‘‘Sec. 2218. National risk management cycle.’’. VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6213 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS Calendar No. 652 117TH CONGRESS 2D SESSION S. 1350 [Report No. 117–261] A BILL To require the Secretary of Homeland Security to establish a national risk management cycle, and for other purposes. DECEMBER 15, 2022 Reported with an amendment VerDate Sep 11 2014 05:00 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00012 Fmt 6651 Sfmt 6651 E:\BILLS\S1350.RS S1350 kjohnson on DSK79L0C42PROD with BILLS