Identifying high-risk covered assets

(a) In general The Secretary, in consultation with the Director and health sector owners and operators, as appropriate, may establish objective criteria for determining whether a covered asset may be designated as a high-risk covered asset, provided that such criteria shall align with the methodology promulgated by the Director for identifying functions relating to critical infrastructure, as defined in section 1016(e) of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c(e)), and associated risk assessments. (b) List of high-Risk covered assets (1) In general The Secretary may develop a list of, and notify, the owners and operators of each covered asset determined to be a high-risk covered asset using the methodology promulgated by the Director pursuant to subsection (a). (2) Biannual updating The Secretary may— (A) biannually review and update the list of high-risk covered assets developed under paragraph (1); and (B) notify the owners and operators of each covered asset added to or removed from the list as part of a review and update of the list under subparagraph (A). (3) Notice to Congress The Secretary shall notify Congress when an initial list of high-risk covered assets is developed under paragraph (1) and each time the list is updated under paragraph (2). (4) Use The list developed and updated under this subsection may be used by the Department to prioritize resource allocation to high-risk covered assets to bolster cyber resilience.