Federal

Critical Electric Infrastructure Cybersecurity Incident Reporting Act

Source: Congress.gov · 737 words in original text

What This Bill Does

This bill requires the Secretary of Energy to create rules for reporting cyber attacks and potential cyber attacks on the electric power system. The bill directs the Department of Energy to receive notifications about these incidents from federal agencies and companies that own or operate critical electric infrastructure.

Who It Affects

Federal agencies, owners of critical electric infrastructure, operators of critical electric infrastructure, and users of critical electric infrastructure.

Key Provisions

• The Department of Energy becomes the designated federal agency to receive notifications about cyber security incidents and potential cyber security incidents affecting critical electric infrastructure (Sec. 2(3)). • The Secretary of Energy must create regulations within 240 days after the bill becomes law to make it easier for people to submit timely, secure and confidential reports about cyber incidents affecting the electric system (Sec. 2(3)). • The regulations must explain what counts as a potential cyber security incident and require anyone who discovers a cyber incident to notify the Secretary within 24 hours of discovery (Sec. 2(3)). • The Secretary must submit an annual report to Congress describing how many notifications were received and what actions the Department of Energy took in response (Sec. 2(3)).

What Changes

The Department of Energy gains the responsibility to receive cyber incident reports from federal agencies and electric infrastructure companies. Federal agencies and electric infrastructure companies must report incidents within 24 hours.

Important Definitions

None defined in the bill text.

I 118TH CONGRESS 1ST SESSION H. R. 1148 To direct the Secretary of Energy to promulgate regulations to facilitate the timely submission of notifications regarding cybersecurity incidents and potential cybersecurity incidents with respect to critical electric infra- structure, and for other purposes. IN THE HOUSE OF REPRESENTATIVES FEBRUARY 21, 2023 Mr. WALBERG introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To direct the Secretary of Energy to promulgate regulations to facilitate the timely submission of notifications regard- ing cybersecurity incidents and potential cybersecurity incidents with respect to critical electric infrastructure, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Critical Electric Infra- 4 structure Cybersecurity Incident Reporting Act’’. 5 VerDate Sep 11 2014 03:34 Mar 11, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H1148.IH H1148 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 1148 IH SEC. 2. CYBERSECURITY INCIDENT REPORTING FOR CRIT- 1 ICAL ELECTRIC INFRASTRUCTURE. 2 Section 215A of the Federal Power Act (16 U.S.C. 3 824o–1) is amended— 4 (1) in subsection (a)— 5 (A) by amending paragraph (1) to read as 6 follows: 7 ‘‘(1) BULK-POWER SYSTEM; CYBERSECURITY 8 INCIDENT; ELECTRIC RELIABILITY ORGANIZATION; 9 REGIONAL ENTITY.—The terms ‘bulk-power system’, 10 ‘cybersecurity incident’, ‘Electric Reliability Organi- 11 zation’, and ‘regional entity’ have the meanings 12 given such terms in paragraphs (1), (8), (2), and (7) 13 of section 215(a), respectively.’’; and 14 (B) in paragraph (7)(A)(i), by inserting ‘‘, 15 including a cybersecurity incident,’’ after ‘‘a 16 malicious act’’; 17 (2) by redesignating subsections (e) and (f) as 18 subsections (f) and (g), respectively; and 19 (3) by inserting after subsection (d) the fol- 20 lowing: 21 ‘‘(e) CYBERSECURITY INCIDENT REPORTING.— 22 ‘‘(1) DESIGNATION.—The Department of En- 23 ergy shall be a designated agency within the Federal 24 Government to receive notifications regarding cyber- 25 security incidents and potential cybersecurity inci- 26 VerDate Sep 11 2014 03:34 Mar 11, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H1148.IH H1148 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 1148 IH dents with respect to critical electric infrastructure 1 from other Federal agencies and owners, operators, 2 and users of critical electric infrastructure. 3 ‘‘(2) REGULATIONS.— 4 ‘‘(A) IN GENERAL.—Not later than 240 5 days after the date of enactment of the Critical 6 Electric Infrastructure Cybersecurity Incident 7 Reporting Act, the Secretary shall promulgate 8 regulations to facilitate the submission of time- 9 ly, secure, and confidential notifications regard- 10 ing cybersecurity incidents and potential cyber- 11 security incidents with respect to critical elec- 12 tric infrastructure from Federal agencies and 13 owners, operators, and users of critical electric 14 infrastructure. 15 ‘‘(B) INCLUSIONS.—The regulations pro- 16 mulgated under subparagraph (A) shall— 17 ‘‘(i) detail what constitutes a potential 18 cybersecurity incident for purposes of this 19 subsection; and 20 ‘‘(ii) require a Federal agency or an 21 owner, operator, or user of critical electric 22 infrastructure that discovers a cybersecu- 23 rity incident or a potential cybersecurity 24 incident with respect to critical electric in- 25 VerDate Sep 11 2014 03:34 Mar 11, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H1148.IH H1148 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 1148 IH frastructure to submit to the Secretary, 1 not later than 24 hours after discovery of 2 such cybersecurity incident or potential cy- 3 bersecurity incident, notification regarding 4 such cybersecurity incident or potential cy- 5 bersecurity incident. 6 ‘‘(3) ANNUAL REPORTS.—Not later than one 7 year after the date of enactment of the Critical Elec- 8 tric Infrastructure Cybersecurity Incident Reporting 9 Act, and annually thereafter, the Secretary shall 10 submit to the Committee on Energy and Commerce 11 of the House of Representatives and the Committee 12 on Energy and Natural Resources of the Senate a 13 report, in classified form if necessary, on the number 14 of notifications received pursuant to this subsection, 15 and a description of the actions taken by the De- 16 partment of Energy regarding such notifications, 17 during the 1-year period preceding the report.’’. 18 Æ VerDate Sep 11 2014 03:34 Mar 11, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\H1148.IH H1148 kjohnson on DSK79L0C42PROD with BILLS

Important: This plain English summary was generated by AI and is provided for informational purposes only. It is not legal advice. Always consult the official bill text on Congress.gov or a qualified attorney for legal matters.