This report provides an overview of risk and risk management in the US oil and gas subsector - part of the energy critical infrastructure sector - considering interdependencies between its various segments and a wide range of other critical supply functions. Effects from disruptions to the oil and gas subsector may propagate across the entire economy, beginning with the petrochemical manufacturing and electricity generation subsectors.

In addition, this report analyzes the complex interdependencies between development ofvoluntary consensus standards, public-private partnerships, and regulatory regimes within the oiland gas subsector, and how these influence government and industry riskmanagement activities.

Next, the report describes risk management programs and activities in the subsector as these relate to regulatory and non-regulatory aspects of the US risk management enterprise. These programs and activities address four risk categories of particular concern in the oil and gas industry: process safety; physical security; cybersecurity; and third-party or supply chain risk.