II 

118TH CONGRESS 

1ST SESSION S. 824 

To require the Secretary of Homeland Security to establish a national risk 

management cycle, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 15, 2023 

Ms. HASSAN (for herself and Mr. ROMNEY) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To require the Secretary of Homeland Security to establish 

a national risk management cycle, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘National Risk Manage5 ment Act of 2023’’. 

6 SEC. 2. NATIONAL RISK MANAGEMENT CYCLE. 

7 (a) IN GENERAL.—Subtitle A of title XXII of the 

8 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

9 is amended by adding at the end the following: 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 824 IS

1 ‘‘SEC. 2220F. NATIONAL RISK MANAGEMENT CYCLE. 

2 ‘‘(a) NATIONAL CRITICAL FUNCTIONS DEFINED.—In 

3 this section, the term ‘national critical functions’ means 

4 the functions of government and the private sector so vital 

5 to the United States that their disruption, corruption, or 

6 dysfunction would have a debilitating effect on security, 

7 national economic security, national public health or safe8 ty, or any combination thereof. 

9 ‘‘(b) NATIONAL RISK MANAGEMENT CYCLE.— 

10 ‘‘(1) RISK IDENTIFICATION AND ASSESS11 MENT.— 

12 ‘‘(A) IN GENERAL.—The Secretary, acting 

13 through the Director, shall establish a recurring 

14 process by which to identify and assess risks to 

15 critical infrastructure, considering both cyber 

16 and physical threats and the associated 

17 likelihoods, vulnerabilities, and consequences. 

18 ‘‘(B) CONSULTATION.—In establishing the 

19 process required under subparagraph (A), the 

20 Secretary shall consult— 

21 ‘‘(i) Sector Risk Management Agen22 cies; 

23 ‘‘(ii) critical infrastructure owners and 

24 operators; 

25 ‘‘(iii) the Assistant to the President 

26 for National Security Affairs; 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 824 IS

1 ‘‘(iv) the Assistant to the President 

2 for Homeland Security; and 

3 ‘‘(v) the National Cyber Director. 

4 ‘‘(C) PROCESS ELEMENTS.—The process 

5 established under subparagraph (A) shall in6 clude elements to— 

7 ‘‘(i) collect relevant information, col8 lected pursuant to section 2218, from Sec9 tor Risk Management Agencies relating to 

10 the threats, vulnerabilities, and con11 sequences related to the particular sectors 

12 of those Sector Risk Management Agen13 cies; 

14 ‘‘(ii) allow critical infrastructure own15 ers and operators to submit relevant infor16 mation to the Secretary for consideration; 

17 and 

18 ‘‘(iii) outline how the Secretary will 

19 solicit input from other Federal depart20 ments and agencies. 

21 ‘‘(D) PUBLICATION.—Not later than 180 

22 days after the date of enactment of this section, 

23 the Secretary shall publish in the Federal Reg24 ister procedures for the process established 

25 under subparagraph (A), subject to any 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 824 IS

1 redactions the Secretary determines are nec2 essary to protect classified or other sensitive in3 formation. 

4 ‘‘(E) REPORT.—The Secretary shall sub5 mit to the President, the Committee on Home6 land Security and Governmental Affairs of the 

7 Senate, and the Committee on Homeland Secu8 rity of the House of Representatives a report on 

9 the risks identified by the process established 

10 under subparagraph (A)— 

11 ‘‘(i) not later than 1 year after the 

12 date of enactment of this section; and 

13 ‘‘(ii) not later than 1 year after the 

14 date on which the Secretary submits a 

15 periodic evaluation described in section 

16 9002(b)(2) of title XC of division H of the 

17 William M. (Mac) Thornberry National 

18 Defense Authorization Act for Fiscal Year 

19 2021 (6 U.S.C. 652a(b)(2)). 

20 ‘‘(2) NATIONAL CRITICAL INFRASTRUCTURE RE21 SILIENCE STRATEGY.— 

22 ‘‘(A) IN GENERAL.—Not later than 1 year 

23 after the date on which the Secretary delivers 

24 each report required under paragraph (1), the 

25 President shall deliver to majority and minority 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 824 IS

1 leaders of the Senate, the Speaker and minority 

2 leader of the House of Representatives, the 

3 Committee on Homeland Security and Govern4 mental Affairs of the Senate, and the Com5 mittee on Homeland Security of the House of 

6 Representatives a national critical infrastruc7 ture resilience strategy designed to address the 

8 risks identified by the Secretary. 

9 ‘‘(B) ELEMENTS.—Each strategy delivered 

10 under subparagraph (A) shall— 

11 ‘‘(i) prioritize areas of risk to critical 

12 infrastructure that would compromise or 

13 disrupt national critical functions impact14 ing national security, economic security, or 

15 public health and safety; 

16 ‘‘(ii) assess the implementation of the 

17 previous national critical infrastructure re18 silience strategy, as applicable; 

19 ‘‘(iii) identify and outline current and 

20 proposed national-level actions, programs, 

21 and efforts, including resource require22 ments, to be taken to address the risks 

23 identified; 

24 ‘‘(iv) identify the Federal departments 

25 or agencies responsible for leading each naVerDate Sep 11 2014 22:11 Mar 22, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S824.IS S824

pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 824 IS

1 tional-level action, program, or effort and 

2 the relevant critical infrastructure sectors 

3 for each; and 

4 ‘‘(v) request any additional authorities 

5 necessary to successfully execute the strat6 egy. 

7 ‘‘(C) FORM.—Each strategy delivered 

8 under subparagraph (A) shall be unclassified, 

9 but may contain a classified annex. 

10 ‘‘(3) CONGRESSIONAL BRIEFING.—Not later 

11 than 1 year after the date on which the President 

12 delivers the first strategy required under paragraph 

13 (2)(A), and each year thereafter, the Secretary, in 

14 coordination with Sector Risk Management Agen15 cies, shall brief the Committee on Homeland Secu16 rity and Governmental Affairs of the Senate and the 

17 Committee on Homeland Security of the House of 

18 Representatives on— 

19 ‘‘(A) the national risk management cycle 

20 activities undertaken pursuant to the strategy 

21 delivered under subparagraph (A); and 

22 ‘‘(B) the amounts and timeline for funding 

23 that the Secretary has determined would be 

24 necessary to address risks and successfully exeVerDate Sep 11 2014 22:11 Mar 22, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S824.IS S824

pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 824 IS

1 cute the full range of activities proposed by the 

2 strategy delivered subparagraph (A).’’. 

3 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

4 The table of contents in section 1(b) of the Homeland Se5 curity Act of 2002 (Public Law 107–296; 116 Stat. 2135) 

6 is amended by inserting after the item relating to section 

7 2220E the following: 

‘‘Sec. 2220F. National risk management cycle.’’. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB