Enhancing Grid Security through Public-Private Partnerships Act

II Calendar No. 267 116TH CONGRESS 1ST SESSION S. 2095 [Report No. 116–147] To provide for certain programs and developments in the Department of Energy concerning the cybersecurity and vulnerabilities of, and physical threats to, the electric grid, and for other purposes. IN THE SENATE OF THE UNITED STATES JULY 11, 2019 Mr. GARDNER (for himself and Mr. BENNET) introduced the following bill; which was read twice and referred to the Committee on Energy and Nat- ural Resources OCTOBER 24, 2019 Reported by Ms. MURKOWSKI, without amendment A BILL To provide for certain programs and developments in the Department of Energy concerning the cybersecurity and vulnerabilities of, and physical threats to, the electric grid, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 21:58 Oct 24, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2095.RS S2095 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 2095 RS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Enhancing Grid Secu- 2 rity through Public-Private Partnerships Act’’. 3 SEC. 2. DEFINITIONS. 4 In this Act: 5 (1) ELECTRIC RELIABILITY ORGANIZATION.— 6 The term ‘‘Electric Reliability Organization’’ has the 7 meaning given the term in section 215(a) of the 8 Federal Power Act (16 U.S.C. 824o(a)). 9 (2) ELECTRIC UTILITY; STATE REGULATORY 10 AUTHORITY.—The terms ‘‘electric utility’’ and 11 ‘‘State regulatory authority’’ have the meanings 12 given those terms in section 3 of the Federal Power 13 Act (16 U.S.C. 796). 14 (3) SECRETARY.—The term ‘‘Secretary’’ means 15 the Secretary of Energy. 16 SEC. 3. PROGRAM TO PROMOTE AND ADVANCE PHYSICAL 17 SECURITY AND CYBERSECURITY OF ELEC- 18 TRIC UTILITIES. 19 (a) ESTABLISHMENT.—The Secretary, in consulta- 20 tion with State regulatory authorities, industry stake- 21 holders, the Electric Reliability Organization, and any 22 other Federal agencies that the Secretary determines to 23 be appropriate, shall carry out a program— 24 (1) to develop, and provide for voluntary imple- 25 mentation of, maturity models, self-assessments, and 26 VerDate Sep 11 2014 21:58 Oct 24, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2095.RS S2095 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 2095 RS auditing methods for assessing the physical security 1 and cybersecurity of electric utilities; 2 (2) to assist with threat assessment and cyber- 3 security training for electric utilities; 4 (3) to provide technical assistance for electric 5 utilities subject to the program; 6 (4) to provide training to electric utilities to ad- 7 dress and mitigate cybersecurity supply chain man- 8 agement risks; 9 (5) to advance the cybersecurity of third-party 10 vendors in partnerships with electric utilities; and 11 (6) to increase opportunities for sharing best 12 practices and data collection within the electric sec- 13 tor. 14 (b) SCOPE.—In carrying out the program under sub- 15 section (a), the Secretary shall— 16 (1) take into consideration— 17 (A) the different sizes of electric utilities; 18 and 19 (B) the regions that electric utilities serve; 20 (2) prioritize electric utilities with fewer avail- 21 able resources due to size or region; and 22 (3) to the maximum extent practicable, use and 23 leverage— 24 VerDate Sep 11 2014 21:58 Oct 24, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2095.RS S2095 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 2095 RS (A) existing Department of Energy pro- 1 grams; and 2 (B) existing programs of the Federal agen- 3 cies determined to be appropriate under sub- 4 section (a). 5 (c) PROTECTION OF INFORMATION.—Information 6 provided to, or collected by, the Federal Government pur- 7 suant to this section— 8 (1) shall be exempt from disclosure under sec- 9 tion 552(b)(3) of title 5, United States Code; and 10 (2) shall not be made available by any Federal 11 agency, State, political subdivision of a State, or 12 Tribal authority pursuant to any Federal, State, po- 13 litical subdivision of a State, or Tribal law, respec- 14 tively, requiring public disclosure of information or 15 records. 16 SEC. 4. REPORT ON CYBERSECURITY AND DISTRIBUTION 17 SYSTEMS. 18 (a) IN GENERAL.—Not later than 1 year after the 19 date of enactment of this Act, the Secretary, in consulta- 20 tion with State regulatory authorities, industry stake- 21 holders, and any other Federal agencies that the Secretary 22 determines to be appropriate, shall submit to Congress a 23 report that assesses— 24 VerDate Sep 11 2014 21:58 Oct 24, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2095.RS S2095 pamtmann on DSKBC07HB2PROD with BILLS 5 •S 2095 RS (1) priorities, policies, procedures, and actions 1 for enhancing the physical security and cybersecurity 2 of electricity distribution systems, including behind- 3 the-meter generation, storage, and load management 4 devices, to address threats to, and vulnerabilities of, 5 electricity distribution systems; and 6 (2) the implementation of the priorities, poli- 7 cies, procedures, and actions assessed under para- 8 graph (1), including— 9 (A) an estimate of potential costs and ben- 10 efits of the implementation; and 11 (B) an assessment of any public-private 12 cost-sharing opportunities. 13 (b) PROTECTION OF INFORMATION.—Information 14 provided to, or collected by, the Federal Government 15 under this section— 16 (1) shall be exempt from disclosure under sec- 17 tion 552(b)(3) of title 5, United States Code; and 18 (2) shall not be made available by any Federal 19 agency, State, political subdivision of a State, or 20 Tribal authority pursuant to any Federal, State, po- 21 litical subdivision of a State, or Tribal law, respec- 22 tively, requiring public disclosure of information or 23 records. 24 VerDate Sep 11 2014 21:58 Oct 24, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2095.RS S2095 pamtmann on DSKBC07HB2PROD with BILLS Calendar No. 267 116TH CONGRESS 1ST SESSION S. 2095 [Report No. 116–147] A BILL To provide for certain programs and developments in the Department of Energy concerning the cy- bersecurity and vulnerabilities of, and physical threats to, the electric grid, and for other pur- poses. OCTOBER 24, 2019 Reported without amendment VerDate Sep 11 2014 21:58 Oct 24, 2019 Jkt 099200 PO 00000 Frm 00006 Fmt 6651 Sfmt 6651 E:\BILLS\S2095.RS S2095 pamtmann on DSKBC07HB2PROD with BILLS