,i #aagth ,,congress #ast ,session ,h4 ,r4 #edia ,,in ,,the ,,house ,,of ,,representatives ,october #e1 #bjba,mr4 ,katko 7for himself1 ,ms4 ,spanberger1 and ,mr4 ,garbarino7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security ,a ,,bill ,to authorize the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to designate certain elements of critical infrastructure as systemically important1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,securing ,systemically ,important ,critical ,infrastructure ,act4 #b4 ,designation of systemically important critical infrastructure 7a7 ,title ,,xxii technical and clerical amendments 7#a7 ,technical amendments 7,a7 ,homeland ,security ,act of #bjjb ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended-- 7i7 in section #bbjb 7#f ,u4,s4,c4 #feb7-- 7,i7 in paragraph 7#aa71 by striking and after the semicolon2 7,,ii7 in the first paragraph 7#ab7 7relating to appointment of a ,cybersecurity ,state ,coordinator7 by striking as described in section #bbae2 and and inserting as described in section #bbag22 7,,iii7 by redesignating the second paragraph 7#ab7 7relating to the 4gov internet domain7 as paragraph 7#ac72 and 7,,iv7 by redesignating the third paragraph 7#ab7 7relating to carrying out such other duties and responsibilities7 as paragraph 7#ad72 7ii7 in the first section #bbae 7#f ,u4,s4,c4 #ffe2 relating to the duties and authorities relating to 4gov internet domain71 by amending the section enumerator and heading to read as follows3 #bbae4 ,duties and authorities relating to 4gov internet domain 2 7iii7 in the second section #bbae 7#f ,u4,s4,c4 #ffe;b2 relating to the joint cyber planning office71 by amending the section enumerator and heading to read as follows3 #bbaf4 ,joint cyber planning office 2 7iv7 in the third section #bbae 7#f ,u4,s4,c4 #ffe;c2 relating to the ,cybersecurity ,state ,coordinator71 by amending the section enumerator and heading to read as follows3 #bbag4 ,cybersecurity ,state ,coordinator 2 7v7 in the fourth section #bbae 7#f ,u4,s4,c4 #ffe;d2 relating to ,sector ,risk ,management ,agencies71 by amending the section enumerator and heading to read as follows3 #bbah4 ,sector ,risk ,management ,agencies 2 7vi7 in section #bbaf 7#f ,u4,s4,c4 #ffe;e2 relating to the ,cybersecurity ,advisory ,committee71 by amending the section enumerator and heading to read as follows3 #bbai4 ,cybersecurity ,advisory ,committee 2 and 7vii7 in section #bbag 7#f ,u4,s4,c4 #ffe;f2 relating to ,cybersecurity ,education and ,training ,programs71 by amending the section enumerator and heading to read as follows3 #bbbj4 ,cybersecurity ,education and ,training ,programs 4 7,b7 ,consolidated ,appropriations ,act1 #bjba ,paragraph 7#a7 of section #ijd7;b7 of division ,u of the ,consolidated ,appropriations ,act1 #bjba 7,public ,law #aaf-bfj7 is amended1 in the matter preceding subparagraph 7,a71 by inserting of #bjjb after ,homeland ,security ,act4 7#b7 ,clerical amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb is amended by striking the items relating to sections #bbad through #bbag and inserting the following new items3 ,sec4 #bbad4 ,national ,asset ,database4 ,sec4 #bbae4 ,duties and authorities relating to 4gov internet domain4 ,sec4 #bbaf4 ,joint cyber planning office4 ,sec4 #bbag4 ,cybersecurity ,state ,coordinator4 ,sec4 #bbah4 ,sector ,risk ,management ,agencies4 ,sec4 #bbai4 ,cybersecurity ,advisory ,committee4 ,sec4 #bbbj4 ,cybersecurity ,education and ,training ,programs4 ,sec4 #bbbj;,a4 ,designation of systemically important critical infrastructure4 4 7b7 ,designation of systemically important critical infrastructure ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following new section3 #bbbj;,a4 ,designation of systemically important critical infrastructure 7a7 ,in general ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall designate an element of critical infrastructure as systemically important critical infrastructure if-- 7#a7 the ,director makes a preliminary determination pursuant to subsection 7d77#a71 using the methodology established pursuant to subsection 7b71 that such element satisfies the criteria established pursuant to subsection 7c72 and 7#b7 such preliminary determination becomes a final determination pursuant to subsection 7d77#b74 7b7 ,methodology ,the ,director1 in consultation with the heads of ,sector ,risk ,management ,agencies and covered stakeholders1 shall-- 7#a7 establish a methodology for determining whether an element of critical infrastructure satisfies the criteria established for systemically important critical infrastructure pursuant to subsection 7c72 and 7#b7 update such methodology1 as necessary4 7c7 ,criteria 7#a7 ,in general ,the ,director1 in consultation with the heads of ,sector ,risk ,management ,agencies and covered stakeholders1 shall develop objective criteria to determine whether an element of critical infrastructure should be designated as systemically important4 7#b7 ,considerations ,in developing the criteria required under paragraph 7#a71 the ,director shall consider the following3 7,a7 ,the likelihood that a disruption to1 or compromise of1 such element of critical infrastructure would result in a debilitating effect on national security1 economic security1 public health or safety1 or any combination thereof4 7,b7 ,the extent to which damage1 disruption1 or unauthorized access to such element or collectively to the category of critical infrastructure to which such element belongs-- 7i7 would disrupt the reliable operation of a category of critical infrastructure2 and 7ii7 would impede provisioning of a national critical function4 7,c7 ,the extent to which increasing the risk management coordination between the ,federal ,government and the owner or operator of the element would enhance the cybersecurity resilience of the ,united ,states4 7#c7 ,updates ,the ,director1 in consultation with the heads of ,sector ,risk ,management ,agencies and covered stakeholders1 shall update the criteria established pursuant to paragraph 7#a71 as necessary4 7d7 ,determinations 7#a7 ,preliminary determination ,in the case of an element of critical infrastructure that the ,director determines satisfies the criteria established under subsection 7c71 the ,director shall-- 7,a7 use the methodology under subsection 7b7 to make a preliminary determination with respect to whether such element is systemically important2 7,b7 notify the owner or operator of the element of such determination2 and 7,c7 provide such owner or operator with an opportunity to provide additional information for consideration in the final determination under paragraph 7#b74 7#b7 ,final determination ,on the date that is #cj days after the date on which the ,director provides notice under paragraph 7#a77;,b7 with respect to a preliminary determination1 such preliminary determination shall become final unless the ,director determines1 on the basis of additional information1 that the element subject to the preliminary determination does not satisfy the criteria under subsection 7c74 7#c7 ,periodic review ,periodically1 the ,director shall review a final designation made pursuant to paragraph 7#b7 with respect to an element using the same procedures outlined under such paragraph4 7#d7 ,protection of information ,information obtained by the ,director pursuant to paragraph 7#a77;,c7 shall be protected under section #bbbd or classified1 as determined appropriate by the ,director4 7e7 ,list of systemically important critical infrastructure 7#a7 ,in general ,not later than #a year after the date of the enactment of this section1 the ,director1 in coordination with the heads of ,sector ,risk ,management ,agencies1 shall develop a comprehensive list that includes any element of critical infrastructure designated as systemically important under this section4 7#b7 ,update of list and notification to owners and operators ,not later than #g days after the date on which the ,director makes a final determination pursuant to paragraph 7#b7 or 7#c7 of subsection 7d71 the ,director shall-- 7,a7 update the list required under paragraph 7#a72 and 7,b7 notify the appropriate owner or operator of the element of critical infrastructure of the addition1 modification1 or removal of such element from such list4 7#c7 ,congressional notification ,not later than #cj days after the list is updated pursuant to paragraph 7#b71 the ,director shall submit to the appropriate congressional committees such updated list4 7#d7 ,limitation on dissemination of list ,the ,director shall limit the dissemination of the list required under paragraph 7#a7 to individuals who need access to such list to carry out official duties or responsibilities4 7f7 ,prioritization of ,agency resources 7#a7 ,in general ,the ,director shall-- 7,a7 seek to enter into enhanced risk management coordination with the owners and operators of elements of critical infrastructure designated as systemically important under this section2 and 7,b7 in allocating ,agency resources to such owners and operators1 prioritize owners and operators who coordinate with the ,director pursuant to subparagraph 7,a74 7#b7 ,prioritized representation in the office for joint cyber planning ,the head of the office for joint cyber planning established pursuant to section #bbaf1 in carrying out the responsibilities of such office with respect to relevant cyber defense planning1 joint cyber operations1 cybersecurity exercises1 and information-sharing practices1 shall1 to the extent practicable1 prioritize the involvement of owners and operators of elements of critical infrastructure designated as systemically important under this section4 7#c7 ,continuous monitoring services ,the ,director shall1 to the extent practicable1 encourage the participation of the owners and operators of elements of critical infrastructure designated as systemically important pursuant to this section in voluntary programs to provide technical assistance in the form of continuous monitoring and detection of cybersecurity risks4 7g7 ,reports 7#a7 ,initial report ,not later than #ahj days after the date of the enactment of this section1 the ,director1 in consultation with the heads of ,sector ,risk ,management ,agencies and covered stakeholders1 shall submit to the appropriate congressional committees a report that includes the following3 7,a7 ,a description of the capabilities of the ,agency that exist immediately before the date of the enactment of this section with respect to identifying critical infrastructure4 7,b7 ,information relating to the criteria and methodology established pursuant to subsections 7b7 and 7c7 to identify an element of critical infrastructure as systemically important pursuant to this section4 7,c7 ,information relating to-- 7i7 the capabilities of the ,agency to identify systems1 assets1 and facilities as systemically important pursuant to this section2 and 7ii7 any updates relating to the capabilities referred to in clause 7i74 7,d7 ,information relating to-- 7i7 the interactions between the ,agency1 the heads of ,sector ,risk ,management ,agencies1 and covered stakeholders with respect to carrying out this section1 including processes used for incorporation of industry feedback and any associated challenges2 7ii7 critical infrastructure identification programs within the ,department and how such programs are being incorporated into the process to identify such infrastructure1 including-- 7,i7 section #i of ,executive ,order #acfcf2 7,,ii7 the ,national ,asset ,database established under section #bbad2 and 7,,iii7 section #d of ,executive ,order #adjbh2 7iii7 any identified gaps in authorities or any additional resources required to carry out this section1 including necessary legislation2 7iv7 any resources the ,agency is authorized to provide to the owners and operators of an element of critical infrastructure designated as systemically important pursuant to this section2 and 7v7 opportunities for enhanced risk management coordination between the ,federal ,government and the owners and operators of an element of critical infrastructure designated as systemically important pursuant to this section4 7#b7 ,subsequent reports ,not later than #b years after the date on which the initial report is submitted pursuant to paragraph 7#a71 and once every #b years thereafter for #aj years1 the ,director1 in consultation with the heads of ,sector ,risk ,management ,agencies and covered stakeholders1 shall submit to the appropriate congressional committees a report that includes the updated information required under subparagraphs 7,b7 through 7,d7 of paragraph 7#a74 7#c7 ,form ,each of the reports required under paragraphs 7#a7 and 7#b7 shall be submitted in unclassified form1 but may contain a classified annex4 7h7 ,restriction ,subchapter ,i of chapter #ce of title #dd1 ,united ,states ,code1 shall not apply to any action by the ,director to implement this section4 7i7 ,covered stakeholders described ,in this section1 the term covered stakeholders means individuals identified by the ,director4 ,such individuals shall include-- 7#a7 representatives from the ,critical ,infrastructure ,partnership ,advisory ,council1 established pursuant to section #hga2 7#b7 representatives from the ,cybersecurity ,advisory ,committee established under section #bbai2 7#c7 individuals representing critical infrastructure industries1 the elements of which are subject to1 or likely to be subject to1 a preliminary determination under subsection 7d77#a72 7#d7 representatives from trade organizations whose memberships include a concentration of owners and operators of critical infrastructure industries1 the elements of which are subject to1 or likely to be subject to1 a preliminary determination under subsection 7d77#a72 and 7#e7 any other individual determined appropriate by the ,director4 7j7 ,definitions ,in this section3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security of the ,house of ,representatives2 and 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate4 7#b7 ,national critical function ,the term national critical function means a function of the ,federal ,government or a ,united ,states private sector entity1 as determined by the ,director1 that the disruption1 corruption1 or dysfunction of such function would have a debilitating effect on security1 national economic security1 national public health or safety1 or any combination thereof4 4 7c7 ,assessment of risk management coordination 7#a7 ,in general ,not later than #abj days after the date of the enactment of this ,act1 the ,director1 in consultation with the heads of ,sector ,risk ,management ,agencies and covered stakeholders1 shall conduct an assessment of potential processes for1 and benefits of1 enhanced risk management coordination between the ,federal ,government and the owners and operators of elements of critical infrastructure designated as systemically important pursuant to section #bbbj;,a of the ,homeland ,security ,act of #bjjb1 as added by subsection 7b7 of this ,act4 7#b7 ,consideration ,the assessment required under paragraph 7#a7 shall include a consideration of-- 7,a7 opportunities for enhanced intelligence support and information-sharing2 7,b7 prioritized ,federal technical assistance2 7,c7 any other process for1 or benefit of1 enhanced risk management coordination determined appropriate by the ,director2 and 7,d7 any additional resources or authorization required to conduct enhanced risk management coordination between the ,federal ,government and owners and operators of elements of critical infrastructure designated as systemically important pursuant to section #bbbj;,a of the ,homeland ,security ,act of #bjjb1 as added by subsection 7b7 of this ,act1 including the prevention of duplicative requirements for regulated sectors and entities4 7#c7 ,covered stakeholders described ,the term covered stakeholders has the meaning given such term in section #bbbj;,a7i7 of the ,homeland ,security ,act of #bjjb1 as added by subsection 7b7 of this ,act4 #c4 ,prioritization of clearances for systemically important critical infrastructure ,section #bbab of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffb7 is amended by adding at the end the following new sentence3 ,in carrying out this section1 the ,secretary shall prioritize the applications of owners and operators of elements of critical infrastructure designated as systemically important pursuant to section #bbbj;,a44