SEC. 2. IDENTIFICATION OF SECTOR-SPECIFIC CYBERSECU-
RITY RISKS. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by adding at the end the following new section: 
‘‘SEC. 226. IDENTIFICATION OF SECTOR-SPECIFIC CYBER-
SECURITY RISKS. 
‘‘(a) IN GENERAL.—The Secretary shall, on a contin-
uous and sector-by-sector basis, research, identify, and 
evaluate cybersecurity risks to critical infrastructure. In 
carrying out this subsection, the Secretary shall coordi-
nate, as appropriate, with the following: 
‘‘(1) The heads of sector specific agencies. 
‘‘(2) The owners and operators of critical infra-
structure. 
‘‘(3) Any private sector entity engaged in ensur-
ing the security or resilience of critical infrastruc-
ture, as determined appropriate by the Secretary. 
‘‘(b) EVALUATION OF RISKS.—The Secretary, in co-
ordination with the individuals and entities referred to in 
subsection (a), shall evaluate the cybersecurity risks re-
searched and identified under such subsection by taking 
into account each of the following: 
‘‘(1) The actual or assessed threat, including a 
consideration of adversary capabilities and intent, 
VerDate Mar 15 2010 
03:01 Jul 31, 2012
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6221.IH
H6221
tjames on DSK6SPTVN1PROD with BILLS
preparedness, target attractiveness, and deterrence 
capabilities. 
‘‘(2) The extent and likelihood of death, injury, 
or serious adverse effects to human health and safe-
ty caused by a disruption, destruction, or unauthor-
ized use of critical infrastructure. 
‘‘(3) The threat to national security caused by 
the disruption, destruction, or unauthorized use of 
critical infrastructure. 
‘‘(4) The harm to the economy that would re-
sult from the disruption, destruction, or unauthor-
ized use of critical infrastructure. 
‘‘(5) Other risk-based security factors that the 
Secretary determines appropriate to protect public 
health and safety, critical infrastructure, or national 
and economic security, in consultation with the fol-
lowing: 
‘‘(A) The heads of sector specific agencies. 
‘‘(B) Any private sector entity determined 
appropriate by the Secretary. 
‘‘(c) AVAILABILITY OF IDENTIFIED RISKS.—The Sec-
retary shall ensure that information relating to the risks 
researched, identified, and evaluated under this section for 
each sector described in subsection (a) is disseminated, to 
the maximum extent possible, in an unclassified version, 
VerDate Mar 15 2010 
03:01 Jul 31, 2012
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6221.IH
H6221
tjames on DSK6SPTVN1PROD with BILLS
to owners and operators of critical infrastructure within 
each such sector. If the Secretary determines that such 
information, in whole or in part should be classified, the 
Secretary shall share such information, as the Secretary 
determines appropriate, with such owners and operators 
if such owners and operators possess the appropriate secu-
rity clearances. 
‘‘(d) PERIODIC REPORTS TO CONGRESS.—The Sec-
retary shall periodically, but not less often than semiannu-
ally, report to the appropriate congressional committees 
on the cybersecurity risks to critical infrastructure re-
searched, identified, and evaluated pursuant to subsection 
(a). 
‘‘(e) CRITICAL INFRASTRUCTURE DEFINED.—In this 
section, the term ‘critical infrastructure’ has the meaning 
given such term under section 1016(e) of the Uniting and 
Strengthening America by Providing Appropriate Tools 
Required to Intercept and Obstruct Terrorism (USA PA-
TRIOT ACT) Act of 2001 (42 U.S.C. 5195c(e); Public 
Law 107–56).’’. 
(b) CLERICAL AMENDMENT.—Subsection (b) of sec-
tion 1 of the Homeland Security Act of 2002 (6 U.S.C. 
101) is amended by adding after the item relating to sec-
tion 225 the following new item: 
‘‘Sec. 226. Identification of sector-specific cybersecurity risks.’’. 
Æ 
VerDate Mar 15 2010 
21:35 Jul 31, 2012
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H6221.IH
H6221
tjames on DSK6SPTVN1PROD with BILLS