I 
118TH CONGRESS 
1ST SESSION H. R. 5439 
To amend the Homeland Security Act of 2002 to require the Secretary 
of Homeland Security to establish a national risk management process, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 13, 2023 
Mr. GALLAGHER (for himself and Ms. SPANBERGER) introduced the following 
bill; which was referred to the Committee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to require 
the Secretary of Homeland Security to establish a na-
tional risk management process, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘National Risk Manage-
ment Act of 2023’’. 
SEC. 2. NATIONAL RISK MANAGEMENT PROCESS. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
is amended by adding at the end the following new section: 
VerDate Sep 11 2014 
23:24 Sep 14, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5439.IH
H5439
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘SEC. 2220F. NATIONAL RISK MANAGEMENT PROCESS. 
‘‘(a) NATIONAL CRITICAL FUNCTIONS DEFINED.—In 
this section, the term ‘national critical functions’ means 
the functions of government and the private sector so vital 
to the United States that their disruption, corruption, or 
dysfunction would have a debilitating effect on security, 
national economic security, national public health or safe-
ty, or any combination thereof. 
‘‘(b) NATIONAL RISK MANAGEMENT PROCESS.— 
‘‘(1) 
RISK
IDENTIFICATION
AND
ASSESS-
MENT.— 
‘‘(A) IN GENERAL.—The Secretary, acting 
through the Director, shall establish a recurring 
process to identify and assess risks to critical 
infrastructure, considering both cybersecurity 
threats and physical threats, the associated 
likelihoods of such threats, vulnerabilities within 
systems rendering such systems susceptible to 
such threats, and consequences of such threats 
to critical functions. 
‘‘(B) CONSULTATION.—In establishing the 
process required under subparagraph (A), the 
Secretary shall consult the following: 
‘‘(i) Sector Risk Management Agen-
cies. 
VerDate Sep 11 2014 
23:24 Sep 14, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5439.IH
H5439
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(ii) Critical infrastructure owners 
and operators. 
‘‘(iii) The Assistant to the President 
for National Security Affairs. 
‘‘(iv) The Assistant to the President 
for Homeland Security. 
‘‘(v) The National Cyber Director. 
‘‘(C) PROCESS
ELEMENTS.—The process 
established under subparagraph (A) shall in-
clude elements to— 
‘‘(i) collect relevant information, col-
lected pursuant to section 2218, from Sec-
tor Risk Management Agencies relating to 
the 
threats, 
vulnerabilities, 
and 
con-
sequences related to the particular sectors 
of those Sector Risk Management Agen-
cies; 
‘‘(ii) allow critical infrastructure own-
ers and operators to submit relevant infor-
mation to the Secretary for consideration; 
and 
‘‘(iii) outline how the Secretary will 
solicit input from other Federal depart-
ments and agencies. 
VerDate Sep 11 2014 
23:24 Sep 14, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5439.IH
H5439
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(D) PUBLICATION.—Not later than 180 
days after the date of the enactment of this sec-
tion, the Secretary shall publish in the Federal 
Register procedures for the process established 
under subparagraph (A). 
‘‘(E) REPORTS.—The Secretary shall sub-
mit to the President, the Committee on Home-
land Security and Governmental Affairs of the 
Senate, and the Committee on Homeland Secu-
rity of the House of Representatives a report on 
the risks from cybersecurity threats and phys-
ical threats identified by the process established 
under subparagraph (A)— 
‘‘(i) not later than one year after the 
date of the enactment of this section; and 
‘‘(ii) not later than one year after the 
date on which the Secretary submits a 
periodic evaluation described in section 
9002(b)(2) of title XC of division H of the 
William M. (Mac) Thornberry National 
Defense Authorization Act for Fiscal Year 
2021 (6 U.S.C. 652a(b)(2)). 
‘‘(2) NATIONAL CRITICAL INFRASTRUCTURE RE-
SILIENCE STRATEGY.— 
VerDate Sep 11 2014 
23:24 Sep 14, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5439.IH
H5439
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(A) IN
GENERAL.—Not later than one 
year after the date on which the Secretary sub-
mits each report required under paragraph (1), 
the President shall transmit to the majority and 
minority leaders of the Senate, the Speaker and 
minority leader of the House of Representa-
tives, the Committee on Homeland Security and 
Governmental Affairs of the Senate, and the 
Committee on Homeland Security of the House 
of Representatives a national critical infrastruc-
ture resilience strategy to address the risks 
identified by the Secretary. 
‘‘(B) ELEMENTS.—Each strategy under 
subparagraph (A) shall— 
‘‘(i) prioritize areas of risk to critical 
infrastructure that would compromise or 
disrupt national critical functions impact-
ing national security, economic security, or 
public health and safety; 
‘‘(ii) assess the implementation of the 
previous national critical infrastructure re-
silience strategy, as applicable; 
‘‘(iii) identify and outline current and 
proposed national-level actions, programs, 
and efforts, including resource require-
VerDate Sep 11 2014 
23:24 Sep 14, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5439.IH
H5439
kjohnson on DSK7ZCZBW3PROD with $$_JOB
ments, to be taken to address the risks 
identified; 
‘‘(iv) identify the Federal departments 
or agencies responsible for leading each na-
tional-level action, program, or effort, and 
the relevant critical infrastructure sectors 
for each; and 
‘‘(v) request any additional authorities 
necessary to successfully execute the strat-
egy. 
‘‘(C) FORM.—Each strategy under sub-
paragraph (A) shall be unclassified but may 
contain a classified annex. 
‘‘(3) CONGRESSIONAL
BRIEFING.—Not later 
than one year after the date on which the President 
transmits the first strategy required under para-
graph (2)(A) and each year thereafter, the Sec-
retary, in coordination with Sector Risk Manage-
ment Agencies, shall brief the Committee on Home-
land Security and Governmental Affairs of the Sen-
ate and the Committee on Homeland Security of the 
House of Representatives on— 
‘‘(A) the national risk management process 
activities undertaken pursuant to the strategy 
VerDate Sep 11 2014 
23:24 Sep 14, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5439.IH
H5439
kjohnson on DSK7ZCZBW3PROD with $$_JOB