Data Infrastructure Risk Reduction Act

This Act may be cited as the Data Infrastructure Risk Reduction Act.
Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security, acting through the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, in collaboration, as appropriate, with the Secretary of Defense, shall—
identify data centers that should be treated as critical infrastructure;
consider—
the security of the power and water supply infrastructure (with a particular focus on above-ground electric power transmission lines and electrical substations) connected to such data centers; and
any potential implications of data centers that are sited in proximity to communities or other residential areas; and
submit to Congress a strategy, including recommendations, to—
defend data centers described in this subsection from external breaches from malefactors; and
protect communities and other residential areas described in paragraph (2)(B).
In this section:
The term critical infrastructure has the meaning given such term in section 1016(e) of Public Law 107–56 (42 U.S.C. 5195c(e)).
The term data center has the meaning given such term in section 453(a) of the Energy Independence and Security Act of 2007 (42 U.S.C. 17112(a)).