I 

118TH CONGRESS 

1ST SESSION H. R. 5439 

To amend the Homeland Security Act of 2002 to require the Secretary 

of Homeland Security to establish a national risk management process, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

SEPTEMBER 13, 2023 

Mr. GALLAGHER (for himself and Ms. SPANBERGER) introduced the following 

bill; which was referred to the Committee on Homeland Security 

A BILL 

To amend the Homeland Security Act of 2002 to require 

the Secretary of Homeland Security to establish a national risk management process, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘National Risk Manage5 ment Act of 2023’’. 

6 SEC. 2. NATIONAL RISK MANAGEMENT PROCESS. 

7 (a) IN GENERAL.—Subtitle A of title XXII of the 

8 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

9 is amended by adding at the end the following new section: 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•HR 5439 IH

1 ‘‘SEC. 2220F. NATIONAL RISK MANAGEMENT PROCESS. 

2 ‘‘(a) NATIONAL CRITICAL FUNCTIONS DEFINED.—In 

3 this section, the term ‘national critical functions’ means 

4 the functions of government and the private sector so vital 

5 to the United States that their disruption, corruption, or 

6 dysfunction would have a debilitating effect on security, 

7 national economic security, national public health or safe8 ty, or any combination thereof. 

9 ‘‘(b) NATIONAL RISK MANAGEMENT PROCESS.— 

10 ‘‘(1) RISK IDENTIFICATION AND ASSESS11 MENT.— 

12 ‘‘(A) IN GENERAL.—The Secretary, acting 

13 through the Director, shall establish a recurring 

14 process to identify and assess risks to critical 

15 infrastructure, considering both cybersecurity 

16 threats and physical threats, the associated 

17 likelihoods of such threats, vulnerabilities within 

18 systems rendering such systems susceptible to 

19 such threats, and consequences of such threats 

20 to critical functions. 

21 ‘‘(B) CONSULTATION.—In establishing the 

22 process required under subparagraph (A), the 

23 Secretary shall consult the following: 

24 ‘‘(i) Sector Risk Management Agen25 cies. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•HR 5439 IH

1 ‘‘(ii) Critical infrastructure owners 

2 and operators. 

3 ‘‘(iii) The Assistant to the President 

4 for National Security Affairs. 

5 ‘‘(iv) The Assistant to the President 

6 for Homeland Security. 

7 ‘‘(v) The National Cyber Director. 

8 ‘‘(C) PROCESS ELEMENTS.—The process 

9 established under subparagraph (A) shall in10 clude elements to— 

11 ‘‘(i) collect relevant information, col12 lected pursuant to section 2218, from Sec13 tor Risk Management Agencies relating to 

14 the threats, vulnerabilities, and con15 sequences related to the particular sectors 

16 of those Sector Risk Management Agen17 cies; 

18 ‘‘(ii) allow critical infrastructure own19 ers and operators to submit relevant infor20 mation to the Secretary for consideration; 

21 and 

22 ‘‘(iii) outline how the Secretary will 

23 solicit input from other Federal depart24 ments and agencies. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•HR 5439 IH

1 ‘‘(D) PUBLICATION.—Not later than 180 

2 days after the date of the enactment of this sec3 tion, the Secretary shall publish in the Federal 

4 Register procedures for the process established 

5 under subparagraph (A). 

6 ‘‘(E) REPORTS.—The Secretary shall sub7 mit to the President, the Committee on Home8 land Security and Governmental Affairs of the 

9 Senate, and the Committee on Homeland Secu10 rity of the House of Representatives a report on 

11 the risks from cybersecurity threats and phys12 ical threats identified by the process established 

13 under subparagraph (A)— 

14 ‘‘(i) not later than one year after the 

15 date of the enactment of this section; and 

16 ‘‘(ii) not later than one year after the 

17 date on which the Secretary submits a 

18 periodic evaluation described in section 

19 9002(b)(2) of title XC of division H of the 

20 William M. (Mac) Thornberry National 

21 Defense Authorization Act for Fiscal Year 

22 2021 (6 U.S.C. 652a(b)(2)). 

23 ‘‘(2) NATIONAL CRITICAL INFRASTRUCTURE RE24 SILIENCE STRATEGY.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•HR 5439 IH

1 ‘‘(A) IN GENERAL.—Not later than one 

2 year after the date on which the Secretary sub3 mits each report required under paragraph (1), 

4 the President shall transmit to the majority and 

5 minority leaders of the Senate, the Speaker and 

6 minority leader of the House of Representa7 tives, the Committee on Homeland Security and 

8 Governmental Affairs of the Senate, and the 

9 Committee on Homeland Security of the House 

10 of Representatives a national critical infrastruc11 ture resilience strategy to address the risks 

12 identified by the Secretary. 

13 ‘‘(B) ELEMENTS.—Each strategy under 

14 subparagraph (A) shall— 

15 ‘‘(i) prioritize areas of risk to critical 

16 infrastructure that would compromise or 

17 disrupt national critical functions impact18 ing national security, economic security, or 

19 public health and safety; 

20 ‘‘(ii) assess the implementation of the 

21 previous national critical infrastructure re22 silience strategy, as applicable; 

23 ‘‘(iii) identify and outline current and 

24 proposed national-level actions, programs, 

25 and efforts, including resource requireVerDate Sep 11 2014 23:24 Sep 14, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H5439.IH H5439

kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•HR 5439 IH

1 ments, to be taken to address the risks 

2 identified; 

3 ‘‘(iv) identify the Federal departments 

4 or agencies responsible for leading each na5 tional-level action, program, or effort, and 

6 the relevant critical infrastructure sectors 

7 for each; and 

8 ‘‘(v) request any additional authorities 

9 necessary to successfully execute the strat10 egy. 

11 ‘‘(C) FORM.—Each strategy under sub12 paragraph (A) shall be unclassified but may 

13 contain a classified annex. 

14 ‘‘(3) CONGRESSIONAL BRIEFING.—Not later 

15 than one year after the date on which the President 

16 transmits the first strategy required under para17 graph (2)(A) and each year thereafter, the Sec18 retary, in coordination with Sector Risk Manage19 ment Agencies, shall brief the Committee on Home20 land Security and Governmental Affairs of the Sen21 ate and the Committee on Homeland Security of the 

22 House of Representatives on— 

23 ‘‘(A) the national risk management process 

24 activities undertaken pursuant to the strategy 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•HR 5439 IH

1 transmitted in accordance with paragraph 

2 (2)(A); and 

3 ‘‘(B) the amounts and timeline for funding 

4 that the Secretary has determined would be 

5 necessary to address risks of cybersecurity 

6 threats and physical threats and successfully 

7 execute the full range of activities proposed by 

8 such strategy.’’. 

9 (b) CLERICAL AMENDMENT.—The table of contents 

10 in section 1(b) of the Homeland Security Act of 2002 is 

11 amended by inserting after the item relating to section 

12 2220E the following new item: 

‘‘Sec. 2220F. National risk management process.’’. 

Æ 


kjohnson on DSK7ZCZBW3PROD with $$_JOB