§652a Sector Risk Management Agencies

Summary

The Secretary of Homeland Security must review how the government decides which systems and services are "critical infrastructure" and must report findings and changes. Within 180 days after January 1, 2021, the Secretary, working with the agencies that manage each sector, must study the existing protection framework, say what methods and data were used, and recommend changes to the list of sectors or to any subsectors and to which federal agencies manage them. At least once every five years, the Secretary must do the same kind of review and suggest updates to the President. The President has 180 days after getting a recommendation to accept or reject it, and must report to Congress and congressional leaders explaining the decision and the analysis behind it. Any official list or change of critical infrastructure sectors must be published in the Federal Register. The Comptroller General (GAO) must send a report about how well the sector-managing agencies are doing two years after January 1, 2021 and then every four years for 12 years. Definitions used here: Appropriate congressional committees — the House Homeland Security and House Armed Services Committees, and the Senate Homeland Security and Governmental Affairs and Senate Armed Services Committees. Critical infrastructure — the term defined in 42 U.S.C. 5195c(e). Department — the Department of Homeland Security. Director — the head of the Cybersecurity and Infrastructure Security Agency (CISA). Secretary — the Secretary of Homeland Security. Sector Risk Management Agency — the agency defined in section 650 of this title.