What This Bill Does
This bill directs the Secretary of Energy to create rules for reporting cybersecurity attacks and potential attacks on electric power systems. The rules must make it easier and faster for federal agencies and electric power companies to report these incidents to the Department of Energy.
Who It Affects
Federal agencies, owners of electric power infrastructure, operators of electric power infrastructure and users of electric power infrastructure.
Key Provisions
• The Department of Energy becomes the official federal agency to receive reports about cybersecurity incidents and potential cybersecurity incidents affecting critical electric infrastructure (Sec. 2(e)(1))
• The Secretary of Energy must create regulations within 240 days that allow timely, secure and confidential notifications of cybersecurity incidents and potential cybersecurity incidents (Sec. 2(e)(2)(A))
• The regulations must explain what counts as a potential cybersecurity incident (Sec. 2(e)(2)(B)(i))
• Federal agencies and electric power owners, operators and users must notify the Secretary within 24 hours of discovering a cybersecurity incident or potential cybersecurity incident (Sec. 2(e)(2)(B)(ii))
• The Secretary must submit annual reports to Congress describing the number of notifications received and actions taken by the Department of Energy (Sec. 2(e)(3))
What Changes
The Department of Energy gains a new responsibility to receive cybersecurity incident reports. Federal agencies and electric power companies gain a new obligation to report incidents within 24 hours of discovery.
Important Definitions
The bill references existing definitions from another law (the Federal Power Act) for "bulk-power system," "cybersecurity incident," "Electric Reliability Organization" and "regional entity." The specific definitions are not restated in this bill.
Effective Date
Not specified in bill text
I
118TH CONGRESS
1ST SESSION H. R. 1160
To direct the Secretary of Energy to promulgate regulations to facilitate
the timely submission of notifications regarding cybersecurity incidents
and potential cybersecurity incidents with respect to critical electric infra-
structure, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
FEBRUARY 24, 2023
Mr. WALBERG (for himself and Ms. SCHRIER) introduced the following bill;
which was referred to the Committee on Energy and Commerce
A BILL
To direct the Secretary of Energy to promulgate regulations
to facilitate the timely submission of notifications regard-
ing cybersecurity incidents and potential cybersecurity
incidents with respect to critical electric infrastructure,
and for other purposes.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘Critical Electric Infra-
4
structure Cybersecurity Incident Reporting Act’’.
5
VerDate Sep 11 2014
00:55 Mar 12, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1160.IH
H1160
kjohnson on DSK79L0C42PROD with BILLS
2
•HR 1160 IH
SEC. 2. CYBERSECURITY INCIDENT REPORTING FOR CRIT-
1
ICAL ELECTRIC INFRASTRUCTURE.
2
Section 215A of the Federal Power Act (16 U.S.C.
3
824o–1) is amended—
4
(1) in subsection (a)—
5
(A) by amending paragraph (1) to read as
6
follows:
7
‘‘(1) BULK-POWER
SYSTEM; CYBERSECURITY
8
INCIDENT; ELECTRIC
RELIABILITY
ORGANIZATION;
9
REGIONAL ENTITY.—The terms ‘bulk-power system’,
10
‘cybersecurity incident’, ‘Electric Reliability Organi-
11
zation’, and ‘regional entity’ have the meanings
12
given such terms in paragraphs (1), (8), (2), and (7)
13
of section 215(a), respectively.’’; and
14
(B) in paragraph (7)(A)(i), by inserting ‘‘,
15
including a cybersecurity incident,’’ after ‘‘a
16
malicious act’’;
17
(2) by redesignating subsections (e) and (f) as
18
subsections (f) and (g), respectively; and
19
(3) by inserting after subsection (d) the fol-
20
lowing:
21
‘‘(e) CYBERSECURITY INCIDENT REPORTING.—
22
‘‘(1) DESIGNATION.—The Department of En-
23
ergy shall be a designated agency within the Federal
24
Government to receive notifications regarding cyber-
25
security incidents and potential cybersecurity inci-
26
VerDate Sep 11 2014
00:55 Mar 12, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1160.IH
H1160
kjohnson on DSK79L0C42PROD with BILLS
3
•HR 1160 IH
dents with respect to critical electric infrastructure
1
from other Federal agencies and owners, operators,
2
and users of critical electric infrastructure.
3
‘‘(2) REGULATIONS.—
4
‘‘(A) IN
GENERAL.—Not later than 240
5
days after the date of enactment of the Critical
6
Electric Infrastructure Cybersecurity Incident
7
Reporting Act, the Secretary shall promulgate
8
regulations to facilitate the submission of time-
9
ly, secure, and confidential notifications regard-
10
ing cybersecurity incidents and potential cyber-
11
security incidents with respect to critical elec-
12
tric infrastructure from Federal agencies and
13
owners, operators, and users of critical electric
14
infrastructure.
15
‘‘(B) INCLUSIONS.—The regulations pro-
16
mulgated under subparagraph (A) shall—
17
‘‘(i) detail what constitutes a potential
18
cybersecurity incident for purposes of this
19
subsection; and
20
‘‘(ii) require a Federal agency or an
21
owner, operator, or user of critical electric
22
infrastructure that discovers a cybersecu-
23
rity incident or a potential cybersecurity
24
incident with respect to critical electric in-
25
VerDate Sep 11 2014
00:55 Mar 12, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1160.IH
H1160
kjohnson on DSK79L0C42PROD with BILLS
4
•HR 1160 IH
frastructure to submit to the Secretary,
1
not later than 24 hours after discovery of
2
such cybersecurity incident or potential cy-
3
bersecurity incident, notification regarding
4
such cybersecurity incident or potential cy-
5
bersecurity incident.
6
‘‘(3) ANNUAL REPORTS.—Not later than one
7
year after the date of enactment of the Critical Elec-
8
tric Infrastructure Cybersecurity Incident Reporting
9
Act, and annually thereafter, the Secretary shall
10
submit to the Committee on Energy and Commerce
11
of the House of Representatives and the Committee
12
on Energy and Natural Resources of the Senate a
13
report, in classified form if necessary, on the number
14
of notifications received pursuant to this subsection,
15
and a description of the actions taken by the De-
16
partment of Energy regarding such notifications,
17
during the 1-year period preceding the report.’’.
18
Æ
VerDate Sep 11 2014
00:55 Mar 12, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H1160.IH
H1160
kjohnson on DSK79L0C42PROD with BILLS