II 

Calendar No. 59 

118TH CONGRESS 

1ST SESSION S. 824 

[Report No. 118–20] 

To require the Secretary of Homeland Security to establish a national risk 

management cycle, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 15, 2023 

Ms. HASSAN (for herself and Mr. ROMNEY) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

MAY 9, 2023 

Reported by Mr. PETERS, with amendments 

[Omit the part struck through and insert the part printed in italic] 

A BILL 

To require the Secretary of Homeland Security to establish 

a national risk management cycle, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘National Risk Manage5 ment Act of 2023’’. 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 824 RS

1 SEC. 2. NATIONAL RISK MANAGEMENT CYCLE. 

2 (a) IN GENERAL.—Subtitle A of title XXII of the 

3 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

4 is amended by adding at the end the following: 

5 ‘‘SEC. 2220F. NATIONAL RISK MANAGEMENT CYCLE. 

6 ‘‘(a) NATIONAL CRITICAL FUNCTIONS DEFINED.—In 

7 this section, the term ‘national critical functions’ means 

8 the functions of government and the private sector so vital 

9 to the United States that their disruption, corruption, or 

10 dysfunction would have a debilitating effect on security, 

11 national economic security, national public health or safe12 ty, or any combination thereof. 

13 ‘‘(b) NATIONAL RISK MANAGEMENT CYCLE.— 

14 ‘‘(1) RISK IDENTIFICATION AND ASSESS15 MENT.— 

16 ‘‘(A) IN GENERAL.—The Secretary, acting 

17 through the Director, shall establish a recurring 

18 process by which to identify and assess risks to 

19 critical infrastructure, considering both cyber 

20 and physical threats and the associated 

21 likelihoods, vulnerabilities, and consequences. 

22 ‘‘(B) CONSULTATION.—In establishing the 

23 process required under subparagraph (A), the 

24 Secretary shall consult— 

25 ‘‘(i) Sector Risk Management Agen26 cies; 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 824 RS

1 ‘‘(ii) critical infrastructure owners and 

2 operators; 

3 ‘‘(iii) the Assistant to the President 

4 for National Security Affairs; 

5 ‘‘(iv) the Assistant to the President 

6 for Homeland Security; and 

7 ‘‘(v) the National Cyber Director. 

8 ‘‘(C) PROCESS ELEMENTS.—The process 

9 established under subparagraph (A) shall in10 clude elements to— 

11 ‘‘(i) collect relevant information, col12 lected pursuant to section 2218, from Sec13 tor Risk Management Agencies relating to 

14 the threats, vulnerabilities, and con15 sequences related to the particular sectors 

16 of those Sector Risk Management Agen17 cies; 

18 ‘‘(ii) allow critical infrastructure own19 ers and operators to submit relevant infor20 mation to the Secretary for consideration; 

21 and 

22 ‘‘(iii) outline how the Secretary will 

23 solicit input from other Federal depart24 ments and agencies. 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 824 RS

1 ‘‘(D) PUBLICATION.—Not later than 180 

2 days after the date of enactment of this section, 

3 the Secretary shall publish in the Federal Reg4 ister procedures for the process established 

5 under subparagraph (A), subject to any 

6 redactions the Secretary determines are nec7 essary to protect classified or other sensitive in8 formation. 

9 ‘‘(E) REPORT.—The Secretary shall sub10 mit to the President, the Committee on Home11 land Security and Governmental Affairs of the 

12 Senate, and the Committee on Homeland Secu13 rity of the House of Representatives a report on 

14 the risks identified by the process established 

15 under subparagraph (A)— 

16 ‘‘(i) not later than 1 year after the 

17 date of enactment of this section; and 

18 ‘‘(ii) not later than 1 year after the 

19 date on which the Secretary submits a 

20 periodic evaluation described in section 

21 9002(b)(2) of title XC of division H of the 

22 William M. (Mac) Thornberry National 

23 Defense Authorization Act for Fiscal Year 

24 2021 (6 U.S.C. 652a(b)(2)). 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 824 RS

1 ‘‘(2) NATIONAL CRITICAL INFRASTRUCTURE RE2 SILIENCE STRATEGY.— 

3 ‘‘(A) IN GENERAL.—Not later than 1 year 

4 after the date on which the Secretary delivers 

5 each report required under paragraph (1), the 

6 President shall deliver to majority and minority 

7 leaders of the Senate, the Speaker and minority 

8 leader of the House of Representatives, the 

9 Committee on Homeland Security and Govern10 mental Affairs of the Senate, and the Com11 mittee on Homeland Security of the House of 

12 Representatives a national critical infrastruc13 ture resilience strategy designed to address the 

14 risks identified by the Secretary. 

15 ‘‘(B) ELEMENTS.—Each strategy delivered 

16 under subparagraph (A) shall— 

17 ‘‘(i) prioritize areas of risk to critical 

18 infrastructure that would compromise or 

19 disrupt national critical functions impact20 ing national security, economic security, or 

21 public health and safety; 

22 ‘‘(ii) assess the implementation of the 

23 previous national critical infrastructure re24 silience strategy, as applicable; 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 824 RS

1 ‘‘(iii) identify and outline current and 

2 proposed national-level actions, programs, 

3 and efforts, including resource require4 ments, to be taken to address the risks 

5 identified; 

6 ‘‘(iv) identify the Federal departments 

7 or agencies responsible for leading each na8 tional-level action, program, or effort and 

9 the relevant critical infrastructure sectors 

10 for each; and 

11 ‘‘(v) request any additional authorities 

12 necessary to successfully execute the strat13 egy. 

14 ‘‘(C) FORM.—Each strategy delivered 

15 under subparagraph (A) shall be unclassified, 

16 but may contain a classified annex. 

17 ‘‘(3) CONGRESSIONAL BRIEFING.—Not later 

18 than 1 year after the date on which the President 

19 delivers the first strategy required under paragraph 

20 (2)(A), and each year thereafter, the Secretary, in 

21 coordination with Sector Risk Management Agen22 cies, shall brief the Committee on Homeland Secu23 rity and Governmental Affairs of the Senate and the 

24 Committee on Homeland Security of the House of 

25 Representatives on— 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 824 RS

1 ‘‘(A) the national risk management cycle 

2 activities undertaken pursuant to the strategy 

3 delivered under subparagraph (A) paragraph 

4 (2)(A); and 

5 ‘‘(B) the amounts and timeline for funding 

6 that the Secretary has determined would be 

7 necessary to address risks and successfully exe8 cute the full range of activities proposed by the 

9 strategy delivered subparagraph (A) under 

10 paragraph (2)(A).’’. 

11 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

12 The table of contents in section 1(b) of the Homeland Se13 curity Act of 2002 (Public Law 107–296; 116 Stat. 2135) 

14 is amended by inserting after the item relating to section 

15 2220E the following: 

‘‘Sec. 2220F. National risk management cycle.’’. 


pbinns on DSKJLVW7X2PROD with $$_JOB
Calendar No. 59 

118TH CONGRESS 

1ST SESSION S. 824 

[Report No. 118–20] 

A BILL 

To require the Secretary of Homeland Security to 

for other purposes. establish a national risk management cycle, and 

MAY 9, 2023 

Reported with amendments 


pbinns on DSKJLVW7X2PROD with $$_JOB