PROTECT Act of 2021

II 117TH CONGRESS 1ST SESSION S. 1400 To amend the Federal Power Act to provide energy cybersecurity investment incentives, to establish a grant and technical assistance program for cybersecurity investments, and for other purposes. IN THE SENATE OF THE UNITED STATES APRIL 28, 2021 Ms. MURKOWSKI (for herself, Mr. MANCHIN, Mr. RISCH, Mr. KING, and Ms. ROSEN) introduced the following bill; which was read twice and referred to the Committee on Energy and Natural Resources A BILL To amend the Federal Power Act to provide energy cyberse- curity investment incentives, to establish a grant and technical assistance program for cybersecurity invest- ments, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Protecting Resources 4 On The Electric grid with Cybersecurity Technology Act 5 of 2021’’ or the ‘‘PROTECT Act of 2021’’. 6 VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS 2 •S 1400 IS SEC. 2. INCENTIVES FOR ADVANCED CYBERSECURITY 1 TECHNOLOGY INVESTMENT. 2 Part II of the Federal Power Act is amended by in- 3 serting after section 219 (16 U.S.C. 824s) the following: 4 ‘‘SEC. 219A. INCENTIVES FOR CYBERSECURITY INVEST- 5 MENTS. 6 ‘‘(a) DEFINITIONS.—In this section: 7 ‘‘(1) ADVANCED CYBERSECURITY TECH- 8 NOLOGY.—The term ‘advanced cybersecurity tech- 9 nology’ means any technology, operational capability, 10 or service, including computer hardware, software, 11 or a related asset, that enhances the security posture 12 of public utilities through improvements in the abil- 13 ity to protect against, detect, respond to, or recover 14 from a cybersecurity threat (as defined in section 15 102 of the Cybersecurity Act of 2015 (6 U.S.C. 16 1501)). 17 ‘‘(2) ADVANCED CYBERSECURITY TECHNOLOGY 18 INFORMATION.—The term ‘advanced cybersecurity 19 technology information’ means information relating 20 to advanced cybersecurity technology or proposed 21 advanced cybersecurity technology that is generated 22 by or provided to the Commission or another Fed- 23 eral agency. 24 ‘‘(b) STUDY.—Not later than 180 days after the date 25 of enactment of this section, the Commission, in consulta- 26 VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS 3 •S 1400 IS tion with the Secretary of Energy, the North American 1 Electric Reliability Corporation, the Electricity Subsector 2 Coordinating Council, and the National Association of 3 Regulatory Utility Commissioners, shall conduct a study 4 to identify incentive-based, including performance-based, 5 rate treatments for the transmission and sale of electric 6 energy subject to the jurisdiction of the Commission that 7 could be used to encourage— 8 ‘‘(1) investment by public utilities in advanced 9 cybersecurity technology; and 10 ‘‘(2) participation by public utilities in cyberse- 11 curity threat information sharing programs. 12 ‘‘(c) INCENTIVE-BASED RATE TREATMENT.—Not 13 later than 1 year after the completion of the study under 14 subsection (b), the Commission shall establish, by rule, in- 15 centive-based, including performance-based, rate treat- 16 ments for the transmission of electric energy in interstate 17 commerce and the sale of electric energy at wholesale in 18 interstate commerce by public utilities for the purpose of 19 benefitting consumers by encouraging— 20 ‘‘(1) investments by public utilities in advanced 21 cybersecurity technology; and 22 ‘‘(2) participation by public utilities in cyberse- 23 curity threat information sharing programs. 24 VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS 4 •S 1400 IS ‘‘(d) FACTORS FOR CONSIDERATION.—In issuing a 1 rule pursuant to this section, the Commission may provide 2 additional incentives beyond those identified in subsection 3 (c) in any case in which the Commission determines that 4 an investment in advanced cybersecurity technology or in- 5 formation sharing program costs will reduce cybersecurity 6 risks to— 7 ‘‘(1) defense critical electric infrastructure (as 8 defined in section 215A(a)) and other facilities sub- 9 ject to the jurisdiction of the Commission that are 10 critical to public safety, national defense, or home- 11 land security, as determined by the Commission in 12 consultation with— 13 ‘‘(A) the Secretary of Energy; and 14 ‘‘(B) appropriate Federal agencies; and 15 ‘‘(2) facilities of small or medium-sized public 16 utilities with limited cybersecurity resources, as de- 17 termined by the Commission. 18 ‘‘(e) RATEPAYER PROTECTION.— 19 ‘‘(1) IN GENERAL.—Any rate approved under a 20 rule issued pursuant to this section, including any 21 revisions to that rule, shall be subject to the require- 22 ments of sections 205 and 206 that all rates, 23 charges, terms, and conditions— 24 ‘‘(A) shall be just and reasonable; and 25 VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS 5 •S 1400 IS ‘‘(B) shall not be unduly discriminatory or 1 preferential. 2 ‘‘(2) PROHIBITION OF DUPLICATE RECOVERY.— 3 Any rule issued pursuant to this section shall pre- 4 clude rate treatments that allow unjust and unrea- 5 sonable double recovery for advanced cybersecurity 6 technology. 7 ‘‘(f) SINGLE-ISSUE RATE FILINGS.—The Commis- 8 sion shall permit public utilities to apply for incentive- 9 based rate treatment under a rule issued under this sec- 10 tion on a single-issue basis by submitting to the Commis- 11 sion a tariff schedule under section 205 that permits re- 12 covery of costs and incentives over the depreciable life of 13 the applicable assets, without regard to changes in receipts 14 or other costs of the public utility. 15 ‘‘(g) PROTECTION OF INFORMATION.—Advanced cy- 16 bersecurity technology information that is provided to, 17 generated by, or collected by the Federal Government 18 under subsection (b), (c), or (f) shall be considered to be 19 critical electric infrastructure information under section 20 215A.’’. 21 SEC. 3. RURAL AND MUNICIPAL UTILITY ADVANCED CY- 22 BERSECURITY GRANT AND TECHNICAL AS- 23 SISTANCE PROGRAM. 24 (a) DEFINITIONS.—In this section: 25 VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS 6 •S 1400 IS (1) ADVANCED CYBERSECURITY TECH- 1 NOLOGY.—The term ‘‘advanced cybersecurity tech- 2 nology’’ means any technology, operational capa- 3 bility, or service, including computer hardware, soft- 4 ware, or a related asset, that enhances the security 5 posture of electric utilities through improvements in 6 the ability to protect against, detect, respond to, or 7 recover from a cybersecurity threat (as defined in 8 section 102 of the Cybersecurity Act of 2015 (6 9 U.S.C. 1501)). 10 (2) ELIGIBLE ENTITY.—The term ‘‘eligible enti- 11 ty’’ means— 12 (A) a rural electric cooperative; 13 (B) a utility owned by a political subdivi- 14 sion of a State, such as a municipally owned 15 electric utility; 16 (C) a utility owned by any agency, author- 17 ity, corporation, or instrumentality of 1 or more 18 political subdivisions of a State; 19 (D) a not-for-profit entity that is in a part- 20 nership with not fewer than 6 entities described 21 in subparagraph (A), (B), or (C); and 22 (E) an investor-owned electric utility that 23 sells less than 4,000,000 megawatt hours of 24 electricity per year. 25 VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS 7 •S 1400 IS (3) PROGRAM.—The term ‘‘Program’’ means 1 the Rural and Municipal Utility Advanced Cyberse- 2 curity Grant and Technical Assistance Program es- 3 tablished under subsection (b). 4 (4) SECRETARY.—The term ‘‘Secretary’’ means 5 the Secretary of Energy. 6 (b) ESTABLISHMENT.—Not later than 180 days after 7 the date of enactment of this Act, the Secretary, in con- 8 sultation with the Federal Energy Regulatory Commis- 9 sion, the North American Electric Reliability Corporation, 10 and the Electricity Subsector Coordinating Council, shall 11 establish a program, to be known as the ‘‘Rural and Mu- 12 nicipal Utility Advanced Cybersecurity Grant and Tech- 13 nical Assistance Program’’, to provide grants and tech- 14 nical assistance to, and enter into cooperative agreements 15 with, eligible entities to protect against, detect, respond 16 to, and recover from cybersecurity threats. 17 (c) OBJECTIVES.—The objectives of the Program 18 shall be— 19 (1) to deploy advanced cybersecurity tech- 20 nologies for electric utility systems; and 21 (2) to increase the participation of eligible enti- 22 ties in cybersecurity threat information sharing pro- 23 grams. 24 (d) AWARDS.— 25 VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS 8 •S 1400 IS (1) IN GENERAL.—The Secretary— 1 (A) shall award grants and provide tech- 2 nical assistance under the Program to eligible 3 entities on a competitive basis; 4 (B) shall develop criteria and a formula for 5 awarding grants and providing technical assist- 6 ance under the Program; 7 (C) may enter into cooperative agreements 8 with eligible entities that can facilitate the ob- 9 jectives described in subsection (c); and 10 (D) shall establish a process to ensure that 11 all eligible entities are informed about and can 12 become aware of opportunities to receive grants 13 or technical assistance under the Program. 14 (2) PRIORITY FOR GRANTS AND TECHNICAL AS- 15 SISTANCE.—In awarding grants and providing tech- 16 nical assistance under the Program, the Secretary 17 shall give priority to an eligible entity that, as deter- 18 mined by the Secretary— 19 (A) has limited cybersecurity resources; 20 (B) owns assets critical to the reliability of 21 the bulk power system; or 22 (C) owns defense critical electric infra- 23 structure (as defined in section 215A(a) of the 24 Federal Power Act (16 U.S.C. 824o–1(a))). 25 VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS 9 •S 1400 IS (e) PROTECTION OF INFORMATION.—Information 1 provided to, or collected by, the Federal Government 2 under this section— 3 (1) shall be exempt from disclosure under sec- 4 tion 552(b)(3) of title 5, United States Code; and 5 (2) shall not be made available by any Federal 6 agency, State, political subdivision of a State, or 7 Tribal authority under any applicable law requiring 8 public disclosure of information or records. 9 (f) FUNDING.—There is authorized to be appro- 10 priated to carry out this section $50,000,000 for each of 11 fiscal years 2022 through 2026, to remain available until 12 expended. 13 Æ VerDate Sep 11 2014 03:00 May 22, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6301 E:\BILLS\S1400.IS S1400 kjohnson on DSK79L0C42PROD with BILLS