; and (B) shall include any electric infrastructure located in any of the 48 contiguous States or the District of Columbia that serves a facility— (i) designated by the Secretary of Defense as— (I) critical to the defense of the United States; and (II) vulnerable to a disruption of the supply of electric energy provided to such facility by an external provider; and (ii) that is not owned or operated by the owner or operator of such facility. (3) The term security risk shall have such meaning as the Secretary of Defense shall determine, in coordination with the Director of National Intelligence and the Secretary of Energy, for purposes of the report required by subsection (a). (4) The term significant malicious cyber-enabled activities includes— (A) significant efforts— (i) to deny access to or degrade, disrupt, or destroy an information and communications technology system or network; or (ii) to exfiltrate, degrade, corrupt, destroy, or release information from such a system or network without authorization for purposes of— (I) conducting influence operations; or (II) causing a significant misappropriation of funds, economic resources, trade secrets, personal identifications, or financial information for commercial or competitive advantage or private financial gain; (B) significant destructive malware attacks; and (C) significant denial of service activities.