Pipeline Security Act

IB Union Calendar No. 60 117TH CONGRESS 1ST SESSION H. R. 3243 [Report No. 117–85] To codify the Transportation Security Administration’s responsibility relating to securing pipelines against cybersecurity threats, acts of terrorism, and other nefarious acts that jeopardize the physical security or cyberse- curity of pipelines, and for other purposes. IN THE HOUSE OF REPRESENTATIVES MAY 14, 2021 Mr. CLEAVER (for himself, Mr. THOMPSON of Mississippi, Mr. KATKO, Mrs. WATSON COLEMAN, Ms. CLARKE of New York, Ms. JACKSON LEE, Mr. LANGEVIN, Mr. CORREA, Mr. GREEN of Texas, Mr. SWALWELL, Ms. TITUS, Ms. BARRAGA´N, Mrs. LURIA, Mr. TORRES of New York, and Mr. GIMENEZ) introduced the following bill; which was referred to the Com- mittee on Homeland Security JULY 13, 2021 Additional sponsors: Mr. VAN DREW and Mrs. AXNE JULY 13, 2021 Reported with amendments, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6652 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 2 •HR 3243 RH A BILL To codify the Transportation Security Administration’s re- sponsibility relating to securing pipelines against cyberse- curity threats, acts of terrorism, and other nefarious acts that jeopardize the physical security or cybersecurity of pipelines, and for other purposes. VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6652 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 3 •HR 3243 RH Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Pipeline Security Act’’. 4 SEC. 2. PIPELINE SECURITY RESPONSIBILITIES. 5 Subsection (f) of section 114 of title 49, United 6 States Code, is amended— 7 (1) in paragraph (15), by striking ‘‘and’’ after 8 the semicolon at the end; 9 (2) by redesignating paragraph (16) as para- 10 graph (17); and 11 (3) by inserting after paragraph (15) the fol- 12 lowing new paragraph: 13 ‘‘(16) maintain responsibility, in coordination 14 with the Director of the Cybersecurity and Infra- 15 structure Security Agency, as appropriate, relating 16 to securing pipeline transportation and pipeline fa- 17 cilities (as such terms are defined in section 60101 18 of this title) against cybersecurity threats (as such 19 term is defined in section 102 of the Cybersecurity 20 Information Sharing Act of 2015 (Public Law 114– 21 113; 6 U.S.C. 1501)), an act of terrorism (as such 22 term is defined in section 3077 of title 18), and 23 other nefarious acts that jeopardize the physical se- 24 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 4 •HR 3243 RH curity or cybersecurity of such transportation or fa- 1 cilities; and’’. 2 SEC. 3. PIPELINE SECURITY SECTION PIPELINE SECURITY 3 DIVISION. 4 (a) IN GENERAL.—Title XVI of the Homeland Secu- 5 rity Act of 2002 (6 U.S.C. 561 et seq.) is amended by 6 adding at the end the following: 7 ‘‘Subtitle D—Pipeline Security 8 ‘‘SEC. 1631. PIPELINE SECURITY SECTION PIPELINE SECU- 9 RITY DIVISION. 10 ‘‘(a) ESTABLISHMENT.—There is within the Admin- 11 istration a pipeline security section pipeline security divi- 12 sion to carry out pipeline security programs in furtherance 13 of section 114(f)(16) of title 49, United States Code. 14 ‘‘(b) MISSION.—The mission of the section division 15 referred to in subsection (a) is to oversee, in coordination 16 with the Cybersecurity and Infrastructure Security Agen- 17 cy of the Department, the security of pipeline transpor- 18 tation and pipeline facilities (as such terms are defined 19 in section 60101 of title 49, United States Code) against 20 cybersecurity threats (as such term is defined in section 21 102 of the Cybersecurity Information Sharing Act of 2015 22 (Public Law 114–113; 6 U.S.C. 1501)), an act of ter- 23 rorism (as such term is defined in section 3077 of title 24 18, United States Code), and other nefarious acts that 25 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 5 •HR 3243 RH jeopardize the physical security or cybersecurity of such 1 transportation or facilities. 2 ‘‘(c) LEADERSHIP; STAFFING.—The Administrator 3 shall appoint as the head of the section division an indi- 4 vidual in the executive service of the Administration with 5 knowledge of the pipeline industry and security best prac- 6 tices, as determined appropriate by the Administrator. 7 The section division shall be staffed by a workforce that 8 includes personnel with cybersecurity expertise. 9 ‘‘(d) RESPONSIBILITIES.—The section division shall 10 be responsible for carrying out the duties of the section 11 division as directed by the Administrator, acting through 12 the head appointed pursuant to subsection (c). Such duties 13 shall include the following: 14 ‘‘(1) Developing, in consultation with relevant 15 Federal, State, local, Tribal, and territorial entities 16 and public and private sector stakeholders, guide- 17 lines for improving the security of pipeline transpor- 18 tation and pipeline facilities against cybersecurity 19 threats, an act of terrorism, and other nefarious acts 20 that jeopardize the physical security or cybersecurity 21 of such transportation or facilities, consistent with 22 the National Institute of Standards and Technology 23 Framework for Improvement of Critical Infrastruc- 24 ture Cybersecurity and any update to such guide- 25 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 6 •HR 3243 RH lines pursuant to section 2(c)(15) of the National 1 Institute for Standards and Technology Act (15 2 U.S.C. 272(c)(15)). 3 ‘‘(2) Updating such guidelines as necessary 4 based on intelligence and risk assessments, but not 5 less frequently than every three years, unless such 6 guidelines are superseded by directives or regulations. 7 ‘‘(3) Sharing of such guidelines and, as appro- 8 priate, intelligence and information regarding such 9 security threats to pipeline transportation and pipe- 10 line facilities, as appropriate, with relevant Federal, 11 State, local, Tribal, and territorial entities and pub- 12 lic and private sector stakeholders. 13 ‘‘(4) Conducting voluntary security assessments 14 based on such guidelines to provide recommenda- 15 tions, or mandatory security assessments if required 16 by superseding directives or regulations, to provide 17 recommendations or requirements for the improve- 18 ment of the security of pipeline transportation and 19 pipeline facilities against cybersecurity threats, an 20 act of terrorism, and other nefarious acts that jeop- 21 ardize the physical security or cybersecurity of such 22 transportation or facilities, including the security 23 policies, plans, practices, and training programs 24 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 7 •HR 3243 RH maintained by owners and operators of pipeline fa- 1 cilities. 2 ‘‘(5) Carrying out a program through which the 3 Administrator identifies and ranks the relative risk 4 of pipelines and inspects pipeline facilities des- 5 ignated by owners and operators of such facilities as 6 critical based on such guidelines or superseding di- 7 rectives or regulations. 8 ‘‘(6) Preparing notice and comment regulations 9 for publication, if determined necessary by the Ad- 10 ministrator. 11 ‘‘(6) Supporting the development and implemen- 12 tation of a security directive or regulation when the 13 Administrator issues such a directive or regulation. 14 ‘‘(e) DETAILS.—In furtherance of the section’s divi- 15 sion’s mission, as set forth in subsection (b), the Adminis- 16 trator and the Director of the Cybersecurity and Infra- 17 structure Security Agency may detail personnel between 18 their components to leverage expertise. Personnel detailed 19 from the Cybersecurity and Infrastructure Security Agen- 20 cy may be considered as fulfilling the cybersecurity exper- 21 tise requirements in referred to in subsection (c).’’. 22 (b) UPDATED GUIDELINES.—Not later than one year 23 after the date of the enactment of this Act, the pipeline 24 security section pipeline security division of the Transpor- 25 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 8 •HR 3243 RH tation Security Administration established pursuant to 1 section 1631 of the Homeland Security Act of 2002, as 2 added by subsection (a), shall publish updated guidelines 3 described in subsection (d) of such section, except to the 4 extent such guidelines have been superseded by directives 5 or regulations. 6 (c) CLERICAL AMENDMENTS.—The table of contents 7 in section 1(b) of the Homeland Security Act of 2002 is 8 amended by— 9 (1) striking the item relating to section 1617 10 and inserting the following new item: 11 ‘‘Sec. 1617. Diversified security technology industry marketplace.’’; (2) by striking the item relating to section 1621 12 and inserting the following new item: 13 ‘‘Sec. 1621. Maintenance validation and oversight.’’; (3) inserting after the item relating to section 14 1621 the following: 15 ‘‘Subtitle D—Pipeline Security ‘‘Sec. 1631. Pipeline security section Pipeline security division.’’. SEC. 4. PERSONNEL STRATEGY. 16 (a) IN GENERAL.—Not later than 180 days after the 17 date of the enactment of this Act, the Administrator of 18 the Transportation Security Administration, in coordina- 19 tion with the Director of the Cybersecurity and Infrastruc- 20 ture Security Agency of the Department of Homeland Se- 21 curity, shall develop a personnel strategy for enhancing 22 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 9 •HR 3243 RH operations within the pipeline security section pipeline se- 1 curity division of the Transportation Security Administra- 2 tion established pursuant to section 1631 of the Homeland 3 Security Act of 2002, as added by section 3. 4 (b) CONTENTS.—The strategy required under sub- 5 section (a) shall take into consideration the most recently 6 published versions of each of the following documents: 7 (1) The Transportation Security Administration 8 National Strategy for Transportation Security. 9 (2) The Department of Homeland Security Cy- 10 bersecurity Strategy. 11 (3) The Transportation Security Administration 12 Cybersecurity Roadmap. 13 (4) The Department of Homeland Security Bal- 14 anced Workforce Strategy. 15 (5) The Department of Homeland Security 16 Quadrennial Homeland Security Review. 17 (c) CYBERSECURITY EXPERTISE.—The strategy shall 18 include an assessment of the cybersecurity expertise deter- 19 mined necessary by the Administrator of the Transpor- 20 tation Security Administration and a plan for developing 21 such expertise within the Administration. 22 (c) (d) RESOURCES.—The strategy shall include an 23 assessment of resources determined necessary by the Ad- 24 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 10 •HR 3243 RH ministrator of the Transportation Security Administration 1 to carry out such strategy. 2 (d) (e) SUBMISSION TO CONGRESS.—Upon develop- 3 ment of the strategy, the Administrator of the Transpor- 4 tation Security Administration shall provide to the Com- 5 mittee on Homeland Security of the House of Representa- 6 tives and the Committee on Commerce, Science, and 7 Transportation of the Senate a copy of such strategy. 8 SEC. 5. OVERSIGHT. 9 (a) REPORT TO CONGRESS.—The Administrator of 10 the Transportation Security Administration shall report to 11 the Committee on Homeland Security of the House of 12 Representatives and the Committee on Commerce, 13 Science, and Transportation of the Senate not less than 14 annually on activities of the pipeline security section pipe- 15 line security division of the Administration established 16 pursuant to section 1631 of the Homeland Security Act 17 of 2002, as added by section 3, including information with 18 respect to guidelines, directives, regulations, security as- 19 sessments, and inspections under such section. Each such 20 report shall include a determination by the Administrator 21 regarding whether there is a need for new regulations or 22 non-regulatory initiatives and the basis for such deter- 23 mination. 24 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS 11 •HR 3243 RH (b) GAO REVIEW.—Not later than two years after 1 the date of the enactment of this Act, the Comptroller 2 General of the United States shall conduct a review of the 3 implementation of this Act and the amendments made by 4 this Act. 5 SEC. 6. STAKEHOLDER ENGAGEMENT. 6 Not later than one year after the date of the enact- 7 ment of this Act, the Administrator of the Transportation 8 Security Administration shall convene not less than two 9 industry days to engage with relevant pipeline transpor- 10 tation and pipeline facilities stakeholders on matters re- 11 lated to the security of pipeline transportation and pipeline 12 facilities (as such terms are defined in section 60101 of 13 title 49, United States Code). 14 VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS Union Calendar No. 60 117TH CONGRESS 1ST SESSION H. R. 3243 [Report No. 117–85] A BILL To codify the Transportation Security Administra- tion’s responsibility relating to securing pipelines against cybersecurity threats, acts of terrorism, and other nefarious acts that jeopardize the physical security or cybersecurity of pipelines, and for other purposes. JULY 13, 2021 Reported with amendments, committed to the Committee of the Whole House on the State of the Union, and or- dered to be printed VerDate Sep 11 2014 20:39 Jul 13, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6651 Sfmt 6651 E:\BILLS\H3243.RH H3243 pamtmann on DSKBC07HB2PROD with BILLS