Energy Cybersecurity Act of 2019

II Calendar No. 264 116TH CONGRESS 1ST SESSION S. 2333 [Report No. 116–144] To provide for enhanced energy grid security. IN THE SENATE OF THE UNITED STATES JULY 30, 2019 Ms. CANTWELL (for herself and Mr. HEINRICH) introduced the following bill; which was read twice and referred to the Committee on Energy and Nat- ural Resources OCTOBER 23, 2019 Reported by Ms. MURKOWSKI, without amendment A BILL To provide for enhanced energy grid security. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Energy Cybersecurity 4 Act of 2019’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS 2 •S 2333 RS (1) DEPARTMENT.—The term ‘‘Department’’ 1 means the Department of Energy. 2 (2) ELECTRIC UTILITY.—The term ‘‘electric 3 utility’’ has the meaning given the term in section 4 3 of the Federal Power Act (16 U.S.C. 796). 5 (3) ES–ISAC.—The term ‘‘ES–ISAC’’ means 6 the Electricity Sector Information Sharing and 7 Analysis Center. 8 (4) NATIONAL LABORATORY.—The term ‘‘Na- 9 tional Laboratory’’ has the meaning given the term 10 in section 2 of the Energy Policy Act of 2005 (42 11 U.S.C. 15801). 12 (5) SECRETARY.—The term ‘‘Secretary’’ means 13 the Secretary of Energy. 14 SEC. 3. ENHANCED GRID SECURITY. 15 (a) CYBERSECURITY FOR THE ENERGY SECTOR RE- 16 SEARCH, DEVELOPMENT, AND DEMONSTRATION PRO- 17 GRAM.— 18 (1) IN GENERAL.—The Secretary, in consulta- 19 tion with appropriate Federal agencies, the energy 20 sector, the States, and other stakeholders, shall 21 carry out a program— 22 (A) to develop advanced cybersecurity ap- 23 plications and technologies for the energy sec- 24 tor— 25 VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS 3 •S 2333 RS (i) to identify and mitigate 1 vulnerabilities, including— 2 (I) dependencies on other critical 3 infrastructure; and 4 (II) impacts from weather and 5 fuel supply; and 6 (ii) to advance the security of field de- 7 vices and third-party control systems, in- 8 cluding— 9 (I) systems for generation, trans- 10 mission, distribution, end use, and 11 market functions; 12 (II) specific electric grid elements 13 including advanced metering, demand 14 response, distributed generation, and 15 electricity storage; 16 (III) forensic analysis of infected 17 systems; and 18 (IV) secure communications; 19 (B) to leverage electric grid architecture as 20 a means to assess risks to the energy sector, in- 21 cluding by implementing an all-hazards ap- 22 proach to communications infrastructure, con- 23 trol systems architecture, and power systems 24 architecture; 25 VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS 4 •S 2333 RS (C) to perform pilot demonstration projects 1 with the energy sector to gain experience with 2 new technologies; and 3 (D) to develop workforce development cur- 4 ricula for energy sector-related cybersecurity. 5 (2) AUTHORIZATION OF APPROPRIATIONS.— 6 There is authorized to be appropriated to carry out 7 this subsection $65,000,000 for each of fiscal years 8 2020 through 2028. 9 (b) ENERGY SECTOR COMPONENT TESTING FOR 10 CYBERRESILIENCE PROGRAM.— 11 (1) IN GENERAL.—The Secretary shall carry 12 out a program— 13 (A) to establish a cybertesting and mitiga- 14 tion program to identify vulnerabilities of en- 15 ergy sector supply chain products to known 16 threats; 17 (B) to oversee third-party cybertesting; 18 and 19 (C) to develop procurement guidelines for 20 energy sector supply chain components. 21 (2) AUTHORIZATION OF APPROPRIATIONS.— 22 There is authorized to be appropriated to carry out 23 this subsection $15,000,000 for each of fiscal years 24 2020 through 2028. 25 VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS 5 •S 2333 RS (c) ENERGY SECTOR OPERATIONAL SUPPORT FOR 1 CYBERRESILIENCE PROGRAM.— 2 (1) IN GENERAL.—The Secretary may carry out 3 a program— 4 (A) to enhance and periodically test— 5 (i) the emergency response capabilities 6 of the Department; and 7 (ii) the coordination of the Depart- 8 ment with other agencies, the National 9 Laboratories, and private industry; 10 (B) to expand cooperation of the Depart- 11 ment with the intelligence communities for en- 12 ergy sector-related threat collection and anal- 13 ysis; 14 (C) to enhance the tools of the Department 15 and ES–ISAC for monitoring the status of the 16 energy sector; 17 (D) to expand industry participation in 18 ES–ISAC; and 19 (E) to provide technical assistance to small 20 electric utilities for purposes of assessing 21 cybermaturity level. 22 (2) AUTHORIZATION OF APPROPRIATIONS.— 23 There is authorized to be appropriated to carry out 24 VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS 6 •S 2333 RS this subsection $10,000,000 for each of fiscal years 1 2020 through 2028. 2 (d) MODELING AND ASSESSING ENERGY INFRA- 3 STRUCTURE RISK.— 4 (1) IN GENERAL.—The Secretary shall develop 5 an advanced energy security program to secure en- 6 ergy networks, including electric, natural gas, and 7 oil exploration, transmission, and delivery. 8 (2) SECURITY AND RESILIENCY OBJECTIVE.— 9 The objective of the program developed under para- 10 graph (1) is to increase the functional preservation 11 of the electric grid operations or natural gas and oil 12 operations in the face of natural and human-made 13 threats and hazards, including electric magnetic 14 pulse and geomagnetic disturbances. 15 (3) ELIGIBLE ACTIVITIES.—In carrying out the 16 program developed under paragraph (1), the Sec- 17 retary may— 18 (A) develop capabilities to identify 19 vulnerabilities and critical components that pose 20 major risks to grid security if destroyed or im- 21 paired; 22 (B) provide modeling at the national level 23 to predict impacts from natural or human-made 24 events; 25 VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS 7 •S 2333 RS (C) develop a maturity model for physical 1 security and cybersecurity; 2 (D) conduct exercises and assessments to 3 identify and mitigate vulnerabilities to the elec- 4 tric grid, including providing mitigation rec- 5 ommendations; 6 (E) conduct research hardening solutions 7 for critical components of the electric grid; 8 (F) conduct research mitigation and recov- 9 ery solutions for critical components of the elec- 10 tric grid; and 11 (G) provide technical assistance to States 12 and other entities for standards and risk anal- 13 ysis. 14 (4) AUTHORIZATION OF APPROPRIATIONS.— 15 There is authorized to be appropriated to carry out 16 this subsection $10,000,000 for each of fiscal years 17 2020 through 2028. 18 (e) LEVERAGING EXISTING PROGRAMS.—The pro- 19 grams established under this section shall be carried out 20 consistent with— 21 (1) the report of the Department entitled 22 ‘‘Roadmap to Achieve Energy Delivery Systems Cy- 23 bersecurity’’ and dated 2011; 24 (2) existing programs of the Department; and 25 VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS 8 •S 2333 RS (3) any associated strategic framework that 1 links together academic and National Laboratory re- 2 searchers, electric utilities, manufacturers, and any 3 other relevant private industry organizations, includ- 4 ing the Electricity Sub-sector Coordinating Council. 5 (f) STUDY.— 6 (1) IN GENERAL.—Not later than 180 days 7 after the date of enactment of this Act, the Sec- 8 retary, in consultation with the Federal Energy Reg- 9 ulatory Commission and the North American Elec- 10 tric Reliability Corporation, shall conduct a study to 11 explore alternative management structures and fund- 12 ing mechanisms to expand industry membership and 13 participation in ES–ISAC. 14 (2) REPORT.—The Secretary shall submit to 15 the appropriate committees of Congress a report de- 16 scribing the results of the study conducted under 17 paragraph (1). 18 VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS Calendar No. 264 116TH CONGRESS 1ST SESSION S. 2333 [Report No. 116–144] A BILL To provide for enhanced energy grid security. OCTOBER 23, 2019 Reported without amendment VerDate Sep 11 2014 22:01 Oct 23, 2019 Jkt 099200 PO 00000 Frm 00010 Fmt 6651 Sfmt 6651 E:\BILLS\S2333.RS S2333 kjohnson on DSK79L0C42 with BILLS