US Codex
Bill
Notes

S. 79 — what changed

Securing Energy Infrastructure Act

From Reported in Senate to Engrossed in Senate. 7 sections amended between Reported in Senate and Engrossed in Senate.

Sec. 2 Definitions

In this Act:

(1)
changed Covered entity—Appropriate committee of Congress— The term covered entity means an entity identified pursuant to section 9(a) of Executive Order 13636 of February 12, 2013 (78 Fed. Reg. 11742) relating to identification appropriate committee of critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.Congress means—
(A)
added the Select Committee on Intelligence, the Committee on Homeland Security and Governmental Affairs, and the Committee on Energy and Natural Resources of the Senate; and
(B)
added the Permanent Select Committee on Intelligence, the Committee on Homeland Security, and the Committee on Energy and Commerce of the House of Representatives.
(2)
changed Exploit—Covered entity— The term “exploit” covered entity means a software tool designed an entity identified pursuant to take advantage section 9(a) of Executive Order 13636 of February 12, 2013 (78 Fed. Reg. 11742), relating to identification of critical infrastructure where a security vulnerability.cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.
(3)
added Exploit— The term exploit means a software tool designed to take advantage of a security vulnerability.
(4)
added Industrial control system—
(3)
removed Industrial control system—
(A)
renumbered was (5)(2) In general— The term industrial control system means an operational technology used to measure, control, or manage industrial functions.
(B)
renumbered was (5)(3) Inclusions— The term “industrial control system” includes supervisory control and data acquisition systems, distributed control systems, and programmable logic or embedded controllers.
(5)
renumbered was (6) National Laboratory— The term National Laboratory has the meaning given the term in section 2 of the Energy Policy Act of 2005 (42 U.S.C. 15801).
(5)
removed Program— The term “Program” means the pilot program established under section 3.
(6)
changed Secretary—Program— The term “Secretary” Program means the Secretary of Energy.pilot program established under section 3.
(7)
added Secretary— The term Secretary means the Secretary of Energy.
(8)
renumbered was (9) Security vulnerability— The term security vulnerability means any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of a security control.

Sec. 3 Pilot program for securing energy infrastructure

Not later than 180 days after the date of enactment of this Act, the Secretary shall establish a 2-year control systems implementation pilot program within the National Laboratories for the purposes of—

(1)
partnering with covered entities in the energy sector (including critical component manufacturers in the supply chain) that voluntarily participate in the Program to identify new classes of security vulnerabilities of the covered entities; and
(2)
changed researching, developing, testing, and implementing evaluating technology platforms and standards, in partnership with covered entities, to isolate and defend industrial control systems of covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities, including—
(A)
changed analog and non-digital nondigital control systems;
(B)
purpose-built control systems; and
(C)
physical controls.

Sec. 4 Working group to evaluate program standards and develop strategy

(a)
Establishment— The Secretary shall establish a working group—
(1)
changed to evaluate the technology platforms and standards used in the Program under section 3(2); and
(2)
to develop a national cyber-informed engineering strategy to isolate and defend covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities.
(b)
Membership— The working group established under subsection (a) shall be composed of not fewer than 10 members, to be appointed by the Secretary, at least 1 member of which shall represent each of the following:
(1)
The Department of Energy.
(2)
The energy industry, including electric utilities and manufacturers recommended by the Energy Sector coordinating councils.
(3)
(A)
The Department of Homeland Security; or
(B)
the Industrial Control Systems Cyber Emergency Response Team.
(4)
The North American Electric Reliability Corporation.
(5)
The Nuclear Regulatory Commission.
(6)
(A)
The Office of the Director of National Intelligence; or
(B)
the intelligence community (as defined in section 3 of the National Security Act of 1947 (50 U.S.C. 3003)).
(7)
(A)
The Department of Defense; or
(B)
the Assistant Secretary of Defense for Homeland Security and America's Security Affairs.
(8)
A State or regional energy agency.
(9)
A national research body or academic institution.
(10)
The National Laboratories.

Sec. 5 Reports on the Program

(a)
added Interim report— Not later than 180 days after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress an interim report that—

removed Not later than 2 years after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress a final report that—

(1)
renumbered was (3) describes the results of the Program;
(2)
renumbered was (4) includes an analysis of the feasibility of each method studied under the Program; and
(3)
renumbered was (5) describes the results of the evaluations conducted by the working group established under section 4(a).
(b)
added Final report— Not later than 2 years after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress a final report that—
(1)
added describes the results of the Program;
(2)
added includes an analysis of the feasibility of each method studied under the Program; and
(3)
added describes the results of the evaluations conducted by the working group established under section 4(a).

Sec. 6 Exemption from disclosure

changed Nothing in this Act authorizes the Secretary Information shared by or with the head of any other Federal agency to issue new regulations.Government or a State, Tribal, or local government under this Act shall be—

(1)
added deemed to be voluntarily shared information;
(2)
added exempt from disclosure under section 552 of title 5, United States Code, or any provision of any State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring the disclosure of information or records; and
(3)
added withheld from the public, without discretion, under section 552(b)(3) of title 5, United States Code, or any provision of a State, Tribal, or local law requiring the disclosure of information or records.

Sec. 7 Protection from liability

(a)
added In general— A cause of action against a covered entity for engaging in the voluntary activities authorized under section 3—
(1)
added shall not lie or be maintained in any court; and
(2)
added shall be promptly dismissed by the applicable court.

removed Information shared by or with the Federal Government or a State, tribal, or local government under this Act shall be—

(b)
changed Voluntary activities— deemed Nothing in this Act subjects any covered entity to be voluntarily shared information; andliability for not engaging in the voluntary activities authorized under section 3.
(2)
removed exempt from disclosure under any provision of Federal, State, tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring the disclosure of information or records.

Sec. 8 No new regulatory authority for Federal agencies

added Nothing in this Act authorizes the Secretary or the head of any other department or agency of the Federal Government to issue new regulations.

(a)
removed In general— A cause of action against a covered entity for engaging in the voluntary activities authorized under section 3—
(1)
removed shall not lie or be maintained in any court; and
(2)
removed shall be promptly dismissed by the applicable court.
(b)
removed Voluntary activities— Nothing in this Act subjects any covered entity to liability for not engaging in the voluntary activities authorized under section 3.