Assessment of critical infrastructure owned by the Department of Defense dependent on foreign materials or components

(a) Prioritized list of high-risk systems Not later than 270 days after the date of the enactment of this Act, the Secretary of Defense shall— (1) develop and maintain a classified and prioritized list of high-risk critical infrastructure owned by the Department of Defense that rely on materials or components the origin of which is a foreign country of concern; and (2) conduct a risk assessment of the materials or components included in the list under paragraph (1). (b) Critical infrastructure vulnerability analysis and assessment The risk assessment under subsection (a) shall include— (1) an evaluation of the dependence of high-risk critical infrastructure owned by the Department of Defense that on materials or components the origin of which is a foreign country of concern; (2) an evaluation of vulnerability to supply chain disruption during a national emergency to high-risk critical infrastructure owned by the Department of Defense, including industrial control systems; (3) an assessment of the resilience and capacity of high-risk critical infrastructure owned by the Department of Defense to support mission-critical operations and readiness during a national emergency; (4) an identification of the location of design, manufacturing, and packaging facilities for materials or components described in subsection (a)(1); and (5) an assessment of the manufacturing capacity of the United States to replace materials or components described in subsection (a)(1), including— (A) gaps in domestic manufacturing capabilities, including nonexistent, extinct, threatened, and single point-of-failure capabilities; (B) supply chains with single points of failure and limited resiliency; and (C) economic factors, including global competition, threaten the viability of domestic manufacturers. (c) Briefing required Not later than 120 days after date of completion of the risk assessment required by subsection (a), and biennially thereafter, the Secretary of Defense shall provide to the congressional defense committees a classified briefing that includes— (1) findings on the traceability and provenance of materials or components described in subsection (a)(1); (2) strategies to strengthen the resilience and readiness of critical infrastructure owned by the Department of Defense; and (3) recommendations for critical infrastructure supply chain resilience and manufacturing activities, including— (A) modifications to procurement policies to reduce reliance on high-risk supply chains; and (B) other matters the Secretary deems appropriate. (d) Definitions In this section: (1) The term critical infrastructure means any system or asset so vital to the United States that the degradation or destruction of such system or asset would have a debilitating impact on national security, including economic security and public health or safety. (2) The term foreign country of concern means the People’s Republic of China, the Democratic People’s Republic of Korea, the Russian Federation, the Islamic Republic of Iran, or any other country determined to be a country of concern by the Secretary of State.