‘‘(i) would disrupt the reliable oper-
ation of a category of critical infrastruc-
ture; and 
‘‘(ii) would impede provisioning of a 
national critical function. 
‘‘(C) The extent to which increasing the 
risk management coordination between the Fed-
eral Government and the owner or operator of 
the element would enhance the cybersecurity re-
silience of the United States. 
‘‘(3) UPDATES.—The Director, in consultation 
with the heads of Sector Risk Management Agencies 
and covered stakeholders, shall update the criteria 
established pursuant to paragraph (1), as necessary. 
‘‘(d) DETERMINATIONS.— 
‘‘(1) PRELIMINARY
DETERMINATION.—In the 
case of an element of critical infrastructure that the 
Director determines satisfies the criteria established 
under subsection (c), the Director shall— 
‘‘(A) use the methodology under subsection 
(b) to make a preliminary determination with 
respect to whether such element is systemically 
important; 
‘‘(B) notify the owner or operator of the 
element of such determination; and 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
‘‘(C) provide such owner or operator with 
an opportunity to provide additional informa-
tion for consideration in the final determination 
under paragraph (2). 
‘‘(2) FINAL
DETERMINATION.—On the date 
that is 30 days after the date on which the Director 
provides notice under paragraph (1)(B) with respect 
to a preliminary determination, such preliminary de-
termination shall become final unless the Director 
determines, on the basis of additional information, 
that the element subject to the preliminary deter-
mination does not satisfy the criteria under sub-
section (c). 
‘‘(3) PERIODIC REVIEW.—Periodically, the Di-
rector shall review a final designation made pursu-
ant to paragraph (2) with respect to an element 
using the same procedures outlined under such para-
graph. 
‘‘(4) PROTECTION OF INFORMATION.—Informa-
tion obtained by the Director pursuant to paragraph 
(1)(C) shall be protected under section 2224 or clas-
sified, as determined appropriate by the Director. 
‘‘(e) LIST OF SYSTEMICALLY IMPORTANT CRITICAL 
INFRASTRUCTURE.— 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) IN GENERAL.—Not later than 1 year after 
the date of the enactment of this section, the Direc-
tor, in coordination with the heads of Sector Risk 
Management Agencies, shall develop a comprehen-
sive list that includes any element of critical infra-
structure designated as systemically important under 
this section. 
‘‘(2) UPDATE OF LIST AND NOTIFICATION TO 
OWNERS AND OPERATORS.—Not later than 7 days 
after the date on which the Director makes a final 
determination pursuant to paragraph (2) or (3) of 
subsection (d), the Director shall— 
‘‘(A) update the list required under para-
graph (1); and 
‘‘(B) notify the appropriate owner or oper-
ator of the element of critical infrastructure of 
the addition, modification, or removal of such 
element from such list. 
‘‘(3) 
CONGRESSIONAL
NOTIFICATION.—Not 
later than 30 days after the list is updated pursuant 
to paragraph (2), the Director shall submit to the 
appropriate congressional committees such updated 
list. 
‘‘(4) 
LIMITATION
ON
DISSEMINATION
OF 
LIST.—The Director shall limit the dissemination of 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
the list required under paragraph (1) to individuals 
who need access to such list to carry out official du-
ties or responsibilities. 
‘‘(f) PRIORITIZATION OF AGENCY RESOURCES.— 
‘‘(1) IN GENERAL.—The Director shall— 
‘‘(A) seek to enter into enhanced risk man-
agement coordination with the owners and oper-
ators of elements of critical infrastructure des-
ignated as systemically important under this 
section; and 
‘‘(B) in allocating Agency resources to 
such owners and operators, prioritize owners 
and operators who coordinate with the Director 
pursuant to subparagraph (A). 
‘‘(2) PRIORITIZED
REPRESENTATION
IN
THE 
OFFICE FOR JOINT CYBER PLANNING.—The head of 
the office for joint cyber planning established pursu-
ant to section 2216, in carrying out the responsibil-
ities of such office with respect to relevant cyber de-
fense planning, joint cyber operations, cybersecurity 
exercises, and information-sharing practices, shall, 
to the extent practicable, prioritize the involvement 
of owners and operators of elements of critical infra-
structure designated as systemically important under 
this section. 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) CONTINUOUS
MONITORING
SERVICES.— 
The Director shall, to the extent practicable, encour-
age the participation of the owners and operators of 
elements of critical infrastructure designated as sys-
temically important pursuant to this section in vol-
untary programs to provide technical assistance in 
the form of continuous monitoring and detection of 
cybersecurity risks. 
‘‘(g) REPORTS.— 
‘‘(1) INITIAL
REPORT.—Not later than 180 
days after the date of the enactment of this section, 
the Director, in consultation with the heads of Sec-
tor Risk Management Agencies and covered stake-
holders, shall submit to the appropriate congres-
sional committees a report that includes the fol-
lowing: 
‘‘(A) A description of the capabilities of 
the Agency that exist immediately before the 
date of the enactment of this section with re-
spect to identifying critical infrastructure. 
‘‘(B) Information relating to the criteria 
and methodology established pursuant to sub-
sections (b) and (c) to identify an element of 
critical infrastructure as systemically important 
pursuant to this section. 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
‘‘(C) Information relating to— 
‘‘(i) the capabilities of the Agency to 
identify systems, assets, and facilities as 
systemically important pursuant to this 
section; and 
‘‘(ii) any updates relating to the capa-
bilities referred to in clause (i). 
‘‘(D) Information relating to— 
‘‘(i) the interactions between the 
Agency, the heads of Sector Risk Manage-
ment Agencies, and covered stakeholders 
with respect to carrying out this section, 
including processes used for incorporation 
of industry feedback and any associated 
challenges; 
‘‘(ii) critical infrastructure identifica-
tion programs within the Department and 
how such programs are being incorporated 
into the process to identify such infrastruc-
ture, including— 
‘‘(I) section 9 of Executive Order 
13636; 
‘‘(II) the National Asset Data-
base established under section 2214; 
and 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
‘‘(III) section 4 of Executive 
Order 14028; 
‘‘(iii) any identified gaps in authori-
ties or any additional resources required to 
carry out this section, including necessary 
legislation; 
‘‘(iv) any resources the Agency is au-
thorized to provide to the owners and oper-
ators of an element of critical infrastruc-
ture designated as systemically important 
pursuant to this section; and 
‘‘(v) opportunities for enhanced risk 
management coordination between the 
Federal Government and the owners and 
operators of an element of critical infra-
structure designated as systemically impor-
tant pursuant to this section. 
‘‘(2) SUBSEQUENT REPORTS.—Not later than 2 
years after the date on which the initial report is 
submitted pursuant to paragraph (1), and once 
every 2 years thereafter for 10 years, the Director, 
in consultation with the heads of Sector Risk Man-
agement Agencies and covered stakeholders, shall 
submit to the appropriate congressional committees 
a report that includes the updated information re-
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
quired under subparagraphs (B) through (D) of 
paragraph (1). 
‘‘(3) FORM.—Each of the reports required 
under paragraphs (1) and (2) shall be submitted in 
unclassified form, but may contain a classified 
annex. 
‘‘(h) RESTRICTION.—Subchapter I of chapter 35 of 
title 44, United States Code, shall not apply to any action 
by the Director to implement this section. 
‘‘(i) COVERED STAKEHOLDERS DESCRIBED.—In this 
section, the term ‘covered stakeholders’ means individuals 
identified by the Director. Such individuals shall include— 
‘‘(1) representatives from the Critical Infra-
structure Partnership Advisory Council, established 
pursuant to section 871; 
‘‘(2) representatives from the Cybersecurity Ad-
visory Committee established under section 2219; 
‘‘(3) individuals representing critical infrastruc-
ture industries, the elements of which are subject to, 
or likely to be subject to, a preliminary determina-
tion under subsection (d)(1); 
‘‘(4) representatives from trade organizations 
whose memberships include a concentration of own-
ers and operators of critical infrastructure indus-
tries, the elements of which are subject to, or likely 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
to be subject to, a preliminary determination under 
subsection (d)(1); and 
‘‘(5) any other individual determined appro-
priate by the Director. 
‘‘(j) DEFINITIONS.—In this section: 
‘‘(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘appropriate congressional com-
mittees’ means— 
‘‘(A) the Committee on Homeland Security 
of the House of Representatives; and 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate. 
‘‘(2) NATIONAL
CRITICAL
FUNCTION.—The 
term ‘national critical function’ means a function of 
the Federal Government or a United States private 
sector entity, as determined by the Director, that the 
disruption, corruption, or dysfunction of such func-
tion would have a debilitating effect on security, na-
tional economic security, national public health or 
safety, or any combination thereof.’’. 
(c) ASSESSMENT OF RISK MANAGEMENT COORDINA-
TION.— 
(1) IN
GENERAL.—Not later than 120 days 
after the date of the enactment of this Act, the Di-
rector, in consultation with the heads of Sector Risk 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
Management Agencies and covered stakeholders, 
shall conduct an assessment of potential processes 
for, and benefits of, enhanced risk management co-
ordination between the Federal Government and the 
owners and operators of elements of critical infra-
structure designated as systemically important pur-
suant to section 2220A of the Homeland Security 
Act of 2002, as added by subsection (b) of this Act. 
(2) CONSIDERATION.—The assessment required 
under paragraph (1) shall include a consideration 
of— 
(A) opportunities for enhanced intelligence 
support and information-sharing; 
(B) prioritized Federal technical assist-
ance; 
(C) any other process for, or benefit of, en-
hanced risk management coordination deter-
mined appropriate by the Director; and 
(D) any additional resources or authoriza-
tion required to conduct enhanced risk manage-
ment coordination between the Federal Govern-
ment and owners and operators of elements of 
critical infrastructure designated as systemically 
important pursuant to section 2220A of the 
Homeland Security Act of 2002, as added by 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS
subsection (b) of this Act, including the preven-
tion of duplicative requirements for regulated 
sectors and entities. 
(3) COVERED
STAKEHOLDERS
DESCRIBED.— 
The term ‘‘covered stakeholders’’ has the meaning 
given such term in section 2220A(i) of the Home-
land Security Act of 2002, as added by subsection 
(b) of this Act. 
SEC. 3. PRIORITIZATION OF CLEARANCES FOR SYSTEM-
ICALLY IMPORTANT CRITICAL INFRASTRUC-
TURE. 
Section 2212 of the Homeland Security Act of 2002 
(6 U.S.C. 662) is amended by adding at the end the fol-
lowing new sentence: ‘‘In carrying out this section, the 
Secretary shall prioritize the applications of owners and 
operators of elements of critical infrastructure designated 
as systemically important pursuant to section 2220A.’’. 
Æ 
VerDate Sep 11 2014 
03:24 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6301
E:\BILLS\H5491.IH
H5491
kjohnson on DSK79L0C42PROD with BILLS