What This Bill Does
This bill requires the Secretary of Homeland Security to create a repeating process to identify and assess risks to critical infrastructure (the systems America depends on, like power grids and water systems). It also requires the President to develop strategies to address those identified risks and report findings to Congress.
Who It Affects
The Secretary of Homeland Security, Sector Risk Management Agencies (government agencies that oversee specific industries), critical infrastructure owners and operators (private companies that run essential services), the President, Congress, and the White House national security staff.
Key Provisions
• The Secretary must establish a recurring process to identify and assess risks to critical infrastructure, considering both cyber threats (digital attacks) and physical threats along with their likelihood and potential damage (Sec. 2220F(b)(1)(A)).
• The Secretary must consult with Sector Risk Management Agencies, critical infrastructure owners and operators, and White House national security advisors when creating this process (Sec. 2220F(b)(1)(B)).
• The Secretary must publish procedures for this risk identification process in the Federal Register (the official government publication), with the ability to redact sensitive or classified information (Sec. 2220F(b)(1)(D)).
• The Secretary must submit a report on identified risks to the President and relevant Congressional committees (Sec. 2220F(b)(1)(E)).
• The President must deliver a national critical infrastructure resilience strategy to Congress addressing the risks the Secretary identified (Sec. 2220F(b)(2)(A)).
What Changes
If this bill becomes law, the federal government will create a formal, ongoing system to evaluate threats to America's essential infrastructure and develop coordinated strategies to protect it. Congress will receive regular reports and briefings on these risks and the government's plans to address them.
Important Definitions
"National critical functions" means government and private sector functions so vital that their disruption, corruption, or failure would seriously harm national security, economic security, public health, or safety (Sec. 2220F(a)).
II
Calendar No. 59
118TH CONGRESS
1ST SESSION
S. 824
[Report No. 118–20]
To require the Secretary of Homeland Security to establish a national risk
management cycle, and for other purposes.
IN THE SENATE OF THE UNITED STATES
MARCH 15, 2023
Ms. HASSAN (for herself and Mr. ROMNEY) introduced the following bill;
which was read twice and referred to the Committee on Homeland Secu-
rity and Governmental Affairs
MAY 9, 2023
Reported by Mr. PETERS, with amendments
[Omit the part struck through and insert the part printed in italic]
A BILL
To require the Secretary of Homeland Security to establish
a national risk management cycle, and for other purposes.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘National Risk Manage-
4
ment Act of 2023’’.
5
VerDate Sep 11 2014
23:45 May 09, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\S824.RS
S824
pbinns on DSKJLVW7X2PROD with $$_JOB
2
•S 824 RS
SEC. 2. NATIONAL RISK MANAGEMENT CYCLE.
1
(a) IN GENERAL.—Subtitle A of title XXII of the
2
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.)
3
is amended by adding at the end the following:
4
‘‘SEC. 2220F. NATIONAL RISK MANAGEMENT CYCLE.
5
‘‘(a) NATIONAL CRITICAL FUNCTIONS DEFINED.—In
6
this section, the term ‘national critical functions’ means
7
the functions of government and the private sector so vital
8
to the United States that their disruption, corruption, or
9
dysfunction would have a debilitating effect on security,
10
national economic security, national public health or safe-
11
ty, or any combination thereof.
12
‘‘(b) NATIONAL RISK MANAGEMENT CYCLE.—
13
‘‘(1)
RISK
IDENTIFICATION
AND
ASSESS-
14
MENT.—
15
‘‘(A) IN GENERAL.—The Secretary, acting
16
through the Director, shall establish a recurring
17
process by which to identify and assess risks to
18
critical infrastructure, considering both cyber
19
and
physical
threats
and
the
associated
20
likelihoods, vulnerabilities, and consequences.
21
‘‘(B) CONSULTATION.—In establishing the
22
process required under subparagraph (A), the
23
Secretary shall consult—
24
‘‘(i) Sector Risk Management Agen-
25
cies;
26
VerDate Sep 11 2014
23:45 May 09, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\S824.RS
S824
pbinns on DSKJLVW7X2PROD with $$_JOB
3
•S 824 RS
‘‘(ii) critical infrastructure owners and
1
operators;
2
‘‘(iii) the Assistant to the President
3
for National Security Affairs;
4
‘‘(iv) the Assistant to the President
5
for Homeland Security; and
6
‘‘(v) the National Cyber Director.
7
‘‘(C) PROCESS
ELEMENTS.—The process
8
established under subparagraph (A) shall in-
9
clude elements to—
10
‘‘(i) collect relevant information, col-
11
lected pursuant to section 2218, from Sec-
12
tor Risk Management Agencies relating to
13
the
threats,
vulnerabilities,
and
con-
14
sequences related to the particular sectors
15
of those Sector Risk Management Agen-
16
cies;
17
‘‘(ii) allow critical infrastructure own-
18
ers and operators to submit relevant infor-
19
mation to the Secretary for consideration;
20
and
21
‘‘(iii) outline how the Secretary will
22
solicit input from other Federal depart-
23
ments and agencies.
24
VerDate Sep 11 2014
23:45 May 09, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\S824.RS
S824
pbinns on DSKJLVW7X2PROD with $$_JOB
4
•S 824 RS
‘‘(D) PUBLICATION.—Not later than 180
1
days after the date of enactment of this section,
2
the Secretary shall publish in the Federal Reg-
3
ister procedures for the process established
4
under subparagraph (A), subject to any
5
redactions the Secretary determines are nec-
6
essary to protect classified or other sensitive in-
7
formation.
8
‘‘(E) REPORT.—The Secretary shall sub-
9
mit to the President, the Committee on Home-
10
land Security and Governmental Affairs of the
11
Senate, and the Committee on Homeland Secu-
12
rity of the House of Representatives a report on
13
the risks identified by the process established
14
under subparagraph (A)—
15
‘‘(i) not later than 1 year after the
16
date of enactment of this section; and
17
‘‘(ii) not later than 1 year after the
18
date on which the Secretary submits a
19
periodic evaluation described in section
20
9002(b)(2) of title XC of division H of the
21
William M. (Mac) Thornberry National
22
Defense Authorization Act for Fiscal Year
23
2021 (6 U.S.C. 652a(b)(2)).
24
VerDate Sep 11 2014
23:45 May 09, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\S824.RS
S824
pbinns on DSKJLVW7X2PROD with $$_JOB
5
•S 824 RS
‘‘(2) NATIONAL CRITICAL INFRASTRUCTURE RE-
1
SILIENCE STRATEGY.—
2
‘‘(A) IN GENERAL.—Not later than 1 year
3
after the date on which the Secretary delivers
4
each report required under paragraph (1), the
5
President shall deliver to majority and minority
6
leaders of the Senate, the Speaker and minority
7
leader of the House of Representatives, the
8
Committee on Homeland Security and Govern-
9
mental Affairs of the Senate, and the Com-
10
mittee on Homeland Security of the House of
11
Representatives a national critical infrastruc-
12
ture resilience strategy designed to address the
13
risks identified by the Secretary.
14
‘‘(B) ELEMENTS.—Each strategy delivered
15
under subparagraph (A) shall—
16
‘‘(i) prioritize areas of risk to critical
17
infrastructure that would compromise or
18
disrupt national critical functions impact-
19
ing national security, economic security, or
20
public health and safety;
21
‘‘(ii) assess the implementation of the
22
previous national critical infrastructure re-
23
silience strategy, as applicable;
24
VerDate Sep 11 2014
23:45 May 09, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\S824.RS
S824
pbinns on DSKJLVW7X2PROD with $$_JOB
6
•S 824 RS
‘‘(iii) identify and outline current and
1
proposed national-level actions, programs,
2
and efforts, including resource require-
3
ments, to be taken to address the risks
4
identified;
5
‘‘(iv) identify the Federal departments
6
or agencies responsible for leading each na-
7
tional-level action, program, or effort and
8
the relevant critical infrastructure sectors
9
for each; and
10
‘‘(v) request any additional authorities
11
necessary to successfully execute the strat-
12
egy.
13
‘‘(C)
FORM.—Each
strategy
delivered
14
under subparagraph (A) shall be unclassified,
15
but may contain a classified annex.
16
‘‘(3) CONGRESSIONAL
BRIEFING.—Not later
17
than 1 year after the date on which the President
18
delivers the first strategy required under paragraph
19
(2)(A), and each year thereafter, the Secretary, in
20
coordination with Sector Risk Management Agen-
21
cies, shall brief the Committee on Homeland Secu-
22
rity and Governmental Affairs of the Senate and the
23
Committee on Homeland Security of the House of
24
Representatives on—
25
VerDate Sep 11 2014
23:45 May 09, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\S824.RS
S824
pbinns on DSKJLVW7X2PROD with $$_JOB
7
•S 824 RS
‘‘(A) the national risk management cycle
1
activities undertaken pursuant to the strategy
2
delivered under subparagraph (A) paragraph
3
(2)(A); and
4
‘‘(B) the amounts and timeline for funding
5
that the Secretary has determined would be
6
necessary to address risks and successfully exe-
7
cute the full range of activities proposed by the
8
strategy delivered subparagraph
(A)
under
9
paragraph (2)(A).’’.
10
(b) TECHNICAL AND CONFORMING AMENDMENT.—
11
The table of contents in section 1(b) of the Homeland Se-
12
curity Act of 2002 (Public Law 107–296; 116 Stat. 2135)
13
is amended by inserting after the item relating to section
14
2220E the following:
15
‘‘Sec. 2220F. National risk management cycle.’’.
VerDate Sep 11 2014
23:45 May 09, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6211
E:\BILLS\S824.RS
S824
pbinns on DSKJLVW7X2PROD with $$_JOB
Calendar No. 59
118TH CONGRESS
1ST SESSION
S. 824
[Report No. 118–20]
A BILL
To require the Secretary of Homeland Security to
establish a national risk management cycle, and
for other purposes.
MAY 9, 2023
Reported with amendments
VerDate Sep 11 2014
23:45 May 09, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\S824.RS
S824
pbinns on DSKJLVW7X2PROD with $$_JOB