I 

118TH CONGRESS 

2D SESSION H. R. 8775 

To require an assessment on manual operations for critical infrastructure, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 18, 2024 

Mr. CRENSHAW (for himself and Mr. MAGAZINER) introduced the following 

bill; which was referred to the Committee on Homeland Security, and in 

addition to the Committee on Transportation and Infrastructure, for a 

period to be subsequently determined by the Speaker, in each case for 

consideration of such provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To require an assessment on manual operations for critical 

infrastructure, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Contingency Plan for 

5 Critical Infrastructure Act’’. 

6 SEC. 2. ASSESSMENT ON MANUAL OPERATIONS FOR CRIT7 ICAL INFRASTRUCTURE. 

8 (a) ASSESSMENT.— 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•HR 8775 IH

1 (1) IN GENERAL.—Not later than 180 days 

2 after the date of the enactment of this Act, the Di3 rector of the Cybersecurity and Infrastructure Secu4 rity Agency (CISA) of the Department of Homeland 

5 Security, in coordination with the Administrator of 

6 the Federal Emergency Management Agency 

7 (FEMA) and each sector risk management agency, 

8 shall provide to Congress a joint sector-by-sector as9 sessment on the ability of critical infrastructure 

10 owners and operators to operate critical systems in 

11 a manual operating mode during cyber incidents. 

12 (2) ELEMENTS.—The assessment under para13 graph (1) shall include the following: 

14 (A) An assessment of how the National 

15 Cyber Incident Response Plan (last published 

16 December 2016), accounts for the risk to crit17 ical infrastructure from not being able to rap18 idly transition into manually operating mode. 

19 (B) An assessment of CISA’s capabilities 

20 and responsibilities to not only remediate and 

21 respond to the digital aspects of cyber inci22 dents, but to assist owners and operators of 

23 critical infrastructure to continue to operate key 

24 systems. 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•HR 8775 IH

1 (C) An assessment of how FEMA’s Na2 tional Response Framework, including various 

3 Emergency Support Functions (ESFs) and 

4 Catastrophic Incident Response Teams (CIRT), 

5 are prepared to support owners and operators 

6 of critical infrastructure in events that require 

7 shifting to manual operating mode. 

8 (D) An assessment of the potential costs 

9 and challenges associated with requiring sectors 

10 to be able to shift to manual operating mode in 

11 the event of a cyber incident. 

12 (E) Policy recommendations to ensure con13 tinued operations of critical infrastructure in 

14 the event of a widespread cyber incident im15 pacting critical infrastructure. 

16 (b) UPDATED PLANNING CONSIDERATIONS FOR

17 CYBER INCIDENTS.— 

18 (1) IN GENERAL.—Not later than 180 days 

19 after the date of the enactment of this Act, the Ad20 ministrator of the Federal Emergency Management 

21 Agency, in coordination with the Director of the Cy22 bersecurity and Critical Infrastructure Agency, shall 

23 update their Planning Considerations for Cyber Inci24 dents (last published November 2023). 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•HR 8775 IH

1 (2) ELEMENTS.—The updates required pursu2 ant to paragraph (1) shall include the following: 

3 (A) Best practices and guidelines for the 

4 essential personnel of critical infrastructure 

5 owners and operators to perform mission crit6 ical functions and continue to operate critical 

7 infrastructure in a manual operating mode dur8 ing a cyber incident that disables business en9 terprise, process control, or communications 

10 systems. 

11 (B) Steps that critical infrastructure own12 ers and operators should take to respond to 

13 various levels of degradation to their systems to 

14 maintain operations. 

15 (C) Identifying Federal, State, and local 

16 resources available to assist owners and opera17 tors of critical infrastructure in the event that 

18 a switch to manual operating mode is nec19 essary. 

20 (D) Specific guidelines on how to respond 

21 to and remediate the impact of cyber incidents 

22 on industrial control devices. 

23 (c) DEFINITIONS.—In this section: 

24 (1) CRITICAL INFRASTRUCTURE.—The term 

25 ‘‘critical infrastructure’’ has the meaning given such 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•HR 8775 IH

1 term in section 1016(e) of Public Law 107–56 (42 

2 U.S.C. 5195c(e)). 

3 (2) MANUAL OPERATING MODE.—The term 

4 ‘‘manual operating mode’’ means a mode of oper5 ation with respect to critical infrastructure that is 

6 disconnected from the internet and with respect to 

7 which internal communication systems are degraded 

8 as a result of a cyber incident, but continues to 

9 allow such critical infrastructure to function to pro10 vide services to the public. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS