1. Short title This Act may be cited as the National Risk Management Act of 2023 . 2. National risk management process (a) In general Subtitle A of title XXII of the Homeland Security Act of 2002 ( 6 U.S.C. 651 et seq. ) is amended by adding at the end the following new section: 2220F. National risk management process (a) National critical functions defined In this section, the term national critical functions means the functions of government and the private sector so vital to the United States that their disruption, corruption, or dysfunction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof. (b) National risk management process (1) Risk identification and assessment (A) In general The Secretary, acting through the Director, shall establish a recurring process to identify and assess risks to critical infrastructure, considering both cybersecurity threats and physical threats, the associated likelihoods of such threats, vulnerabilities within systems rendering such systems susceptible to such threats, and consequences of such threats to critical functions. (B) Consultation In establishing the process required under subparagraph (A), the Secretary shall consult the following: (i) Sector Risk Management Agencies. (ii) Critical infrastructure owners and operators. (iii) The Assistant to the President for National Security Affairs. (iv) The Assistant to the President for Homeland Security. (v) The National Cyber Director. (C) Process elements The process established under subparagraph (A) shall include elements to— (i) collect relevant information, collected pursuant to section 2218, from Sector Risk Management Agencies relating to the threats, vulnerabilities, and consequences related to the particular sectors of those Sector Risk Management Agencies; (ii) allow critical infrastructure owners and operators to submit relevant information to the Secretary for consideration