Securing Systemically Important Critical Infrastructure Act

To authorize the Director of the Cybersecurity and Infrastructure Security Agency to designate certain elements of critical infrastructure as systemically important, and for other purposes. 1. Short title This Act may be cited as the Securing Systemically Important Critical Infrastructure Act 2. Designation of systemically important critical infrastructure (a) Title XXII technical and clerical amendments (1) Technical amendments (A) Homeland Security Act of 2002 Subtitle A of title XXII of the Homeland Security Act of 2002 ( 6 U.S.C. 651 et seq. (i) in section 2202 ( 6 U.S.C. 652 (I) in paragraph (11), by striking and (II) in the first paragraph (12) (relating to appointment of a Cybersecurity State Coordinator) by striking as described in section 2215; and as described in section 2217; (III) by redesignating the second paragraph (12) (relating to the .gov internet domain) as paragraph (13); and (IV) by redesignating the third paragraph (12) (relating to carrying out such other duties and responsibilities) as paragraph (14); (ii) in the first section 2215 ( 6 U.S.C. 665 2215. Duties and authorities relating to .gov internet domain ; (iii) in the second section 2215 ( 6 U.S.C. 665b 2216. Joint cyber planning office ; (iv) in the third section 2215 ( 6 U.S.C. 665c 2217. Cybersecurity State Coordinator ; (v) in the fourth section 2215 ( 6 U.S.C. 665d 2218. Sector Risk Management Agencies ; (vi) in section 2216 ( 6 U.S.C. 665e 2219. Cybersecurity Advisory Committee ; and (vii) in section 2217 ( 6 U.S.C. 665f 2220. Cybersecurity Education and Training Programs . (B) Consolidated Appropriations Act, 2021 Paragraph (1) of section 904(b) of division U of the Consolidated Appropriations Act, 2021 ( Public Law 116–260 of 2002 Homeland Security Act (2) Clerical amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 is amended by striking the items relating to sections 2214 through 2217 and inserting the following new items: Sec. 2214. National Asset Database. Sec. 2215. Duties and authorities relating to .gov internet domain. Sec. 2216. Joint cyber planning office. Sec. 2217. Cybersecurity State Coordinator. Sec. 2218. Sector Risk Management Agencies. Sec. 2219. Cybersecurity Advisory Committee. Sec. 2220. Cybersecurity Education and Training Programs. Sec. 2220A. Designation of systemically important critical infrastructure. . (b) Designation of systemically important critical infrastructure Subtitle A of title XXII of the Homeland Security Act of 2002 ( 6 U.S.C. 651 et seq. 2220A. Designation of systemically important critical infrastructure (a) In general The Director of the Cybersecurity and Infrastructure Security Agency shall designate an element of critical infrastructure as systemically important critical infrastructure if— (1) the Director makes a preliminary determination pursuant to subsection (d)(1), using the methodology established pursuant to subsection (b), that such element satisfies the criteria established pursuant to subsection (c); and (2) such preliminary determination becomes a final determination pursuant to subsection (d)(2). (b) Methodology The Director, in consultation with the heads of Sector Risk Management Agencies and covered stakeholders, shall— (1) establish a methodology for determining whether an element of critical infrastructure satisfies the criteria established for systemically important critical infrastructure pursuant to subsection (c); and (2) update such methodology, as necessary. (c) Criteria (1) In general The Director, in consultation with the heads of Sector Risk Management Agencies and covered stakeholders, shall develop objective criteria to determine whether an element of critical infrastructure should be designated as systemically important. (2) Considerations In developing the criteria required under paragraph (1), the Director shall consider the following: (A) The likelihood that a disruption to, or compromise of, such element of critical infrastructure would result in a debilitating effect on national security, economic security, public health or safety, or any combination thereof. (B) The extent to which damage, disruption, or unauthorized access to such element or collectively to the category of critical infrastructure to which such element belongs— (i) would disrupt the reliable operation of a category of critical infrastructure; and (ii) would impede provisioning of a national critical function. (C) The extent to which increasing the risk management coordination between the Federal Government and the owner or operator of the element would enhance the cybersecurity resilience of the United States. (3) Updates The Director, in consultation with the heads of Sector Risk Management Agencies and covered stakeholders, shall update the criteria established pursuant to paragraph (1), as necessary. (d) Determinations (1) Preliminary determination In the case of an element of critical infrastructure that the Director determines satisfies the criteria established under subsection (c), the Director shall— (A) use the methodology under subsection (b) to make a preliminary determination with respect to whether such element is systemically important; (B) notify the owner or operator of the element of such determination; and (C) provide such owner or operator with an opportunity to provide additional information for consideration in the final determination under paragraph (2). (2) Final determination On the date that is 30 days after the date on which the Director provides notice under paragraph (1)(B) with respect to a preliminary determination, such preliminary determination shall become final unless the Director determines, on the basis of additional information, that the element subject to the preliminary determination does not satisfy the criteria under subsection (c). (3) Periodic review Periodically, the Director shall review a final designation made pursuant to paragraph (2) with respect to an element using the same procedures outlined under such paragraph. (4) Protection of information Information obtained by the Director pursuant to paragraph (1)(C) shall be protected under section 2224 or classified, as determined appropriate by the Director. (e) List of systemically important critical infrastructure (1) In general Not later than 1 year after the date of the enactment of this section, the Director, in coordination with the heads of Sector Risk Management Agencies, shall develop a comprehensive list that includes any element of critical infrastructure designated as systemically important under this section. (2) Update of list and notification to owners and operators Not later than 7 days after the date on which the Director makes a final determination pursuant to paragraph (2) or (3) of subsection (d), the Director shall— (A) update the list required under paragraph (1); and (B) notify the appropriate owner or operator of the element of critical infrastructure of the addition, modification, or removal of such element from such list. (3) Congressional notification Not later than 30 days after the list is updated pursuant to paragraph (2), the Director shall submit to the appropriate congressional committees such updated list. (4) Limitation on dissemination of list The Director shall limit the dissemination of the list required under paragraph (1) to individuals who need access to such list to carry out official duties or responsibilities. (f) Prioritization of Agency resources (1) In general The Director shall— (A) seek to enter into enhanced risk management coordination with the owners and operators of elements of critical infrastructure designated as systemically important under this section; and (B) in allocating Agency resources to such owners and operators, prioritize owners and operators who coordinate with the Director pursuant to subparagraph (A). (2) Prioritized representation in the office for joint cyber planning The head of the office for joint cyber planning established pursuant to section 2216, in carrying out the responsibilities of such office with respect to relevant cyber defense planning, joint cyber operations, cybersecurity exercises, and information-sharing practices, shall, to the extent practicable, prioritize the involvement of owners and operators of elements of critical infrastructure designated as systemically important under this section. (3) Continuous monitoring services The Director shall, to the extent practicable, encourage the participation of the owners and operators of elements of critical infrastructure designated as systemically important pursuant to this section in voluntary programs to provide technical assistance in the form of continuous monitoring and detection of cybersecurity risks. (g) Reports (1) Initial report Not later than 180 days after the date of the enactment of this section, the Director, in consultation with the heads of Sector Risk Management Agencies and covered stakeholders, shall submit to the appropriate congressional committees a report that includes the following: (A) A description of the capabilities of the Agency that exist immediately before the date of the enactment of this section with respect to identifying critical infrastructure. (B) Information relating to the criteria and methodology established pursuant to subsections (b) and (c) to identify an element of critical infrastructure as systemically important pursuant to this section. (C) Information relating to— (i) the capabilities of the Agency to identify systems, assets, and facilities as systemically important pursuant to this section; and (ii) any updates relating to the capabilities referred to in clause (i). (D) Information relating to— (i) the interactions between the Agency, the heads of Sector Risk Management Agencies, and covered stakeholders with respect to carrying out this section, including processes used for incorporation of industry feedback and any associated challenges; (ii) critical infrastructure identification programs within the Department and how such programs are being incorporated into the process to identify such infrastructure, including— (I) section 9 of Executive Order 13636; (II) the National Asset Database established under section 2214; and (III) section 4 of Executive Order 14028; (iii) any identified gaps in authorities or any additional resources required to carry out this section, including necessary legislation; (iv) any resources the Agency is authorized to provide to the owners and operators of an element of critical infrastructure designated as systemically important pursuant to this section; and (v) opportunities for enhanced risk management coordination between the Federal Government and the owners and operators of an element of critical infrastructure designated as systemically important pursuant to this section. (2) Subsequent reports Not later than 2 years after the date on which the initial report is submitted pursuant to paragraph (1), and once every 2 years thereafter for 10 years, the Director, in consultation with the heads of Sector Risk Management Agencies and covered stakeholders, shall submit to the appropriate congressional committees a report that includes the updated information required under subparagraphs (B) through (D) of paragraph (1). (3) Form Each of the reports required under paragraphs (1) and (2) shall be submitted in unclassified form, but may contain a classified annex. (h) Restriction Subchapter I of chapter 35 (i) Covered stakeholders described In this section, the term covered stakeholders (1) representatives from the Critical Infrastructure Partnership Advisory Council, established pursuant to section 871; (2) representatives from the Cybersecurity Advisory Committee established under section 2219; (3) individuals representing critical infrastructure industries, the elements of which are subject to, or likely to be subject to, a preliminary determination under subsection (d)(1); (4) representatives from trade organizations whose memberships include a concentration of owners and operators of critical infrastructure industries, the elements of which are subject to, or likely to be subject to, a preliminary determination under subsection (d)(1); and (5) any other individual determined appropriate by the Director. (j) Definitions In this section: (1) Appropriate congressional committees The term appropriate congressional committees (A) the Committee on Homeland Security of the House of Representatives; and (B) the Committee on Homeland Security and Governmental Affairs of the Senate. (2) National critical function The term national critical function . (c) Assessment of risk management coordination (1) In general Not later than 120 days after the date of the enactment of this Act, the Director, in consultation with the heads of Sector Risk Management Agencies and covered stakeholders, shall conduct an assessment of potential processes for, and benefits of, enhanced risk management coordination between the Federal Government and the owners and operators of elements of critical infrastructure designated as systemically important pursuant to section 2220A of the Homeland Security Act of 2002, as added by subsection (b) of this Act. (2) Consideration The assessment required under paragraph (1) shall include a consideration of— (A) opportunities for enhanced intelligence support and information-sharing; (B) prioritized Federal technical assistance; (C) any other process for, or benefit of, enhanced risk management coordination determined appropriate by the Director; and (D) any additional resources or authorization required to conduct enhanced risk management coordination between the Federal Government and owners and operators of elements of critical infrastructure designated as systemically important pursuant to section 2220A of the Homeland Security Act of 2002, as added by subsection (b) of this Act, including the prevention of duplicative requirements for regulated sectors and entities. (3) Covered stakeholders described The term covered stakeholders 3. Prioritization of clearances for systemically important critical infrastructure Section 2212 of the Homeland Security Act of 2002 ( 6 U.S.C. 662 In carrying out this section, the Secretary shall prioritize the applications of owners and operators of elements of critical infrastructure designated as systemically important pursuant to section 2220A.

Summary: Securing Systemically Important Critical Infrastructure Act This bill sets out a process to designate elements of critical infrastructure as systemically important. Critical infrastructure refers to the machinery, facilities, and information that enable vital functions of governance, public health, and the economy. Specifically, the Cybersecurity and Infrastructure Security Agency (CISA) must establish a methodology based on objective criteria to designate critical infrastructure as systemically important. In developing the criteria, CISA must consider, among other factors, the scale of the potential effects of a disruption to the infrastructure on domestic security, the economy, health, or safety. Using the methodology, CISA must make a preliminary designation and then provide an opportunity for the infrastructure's owner or operator to share additional information. A preliminary designation becomes final after 30 days unless, on the basis of additional information, CISA determines the infrastructure does not meet required criteria. The bill also requires CISA to maintain a list of systemically important critical infrastructure, prioritize systemically important critical infrastructure in its programs and activities, report on various matters related to the designation process, and assess processes for and benefits of enhanced risk management coordination between the federal government and the owners and operators of systemically important critical infrastructure. Additionally, the Department of Homeland Security must prioritize the security clearance applications of owners and operators of systemically important critical infrastructure.