115TH CONGRESS 

2D SESSION S. 79 

AN ACT 

To provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

†S 79 ES

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Securing Energy Infra3 structure Act’’. 

4 SEC. 2. DEFINITIONS. 

5 In this Act: 

6 (1) APPROPRIATE COMMITTEE OF CONGRESS.— 

7 The term ‘‘appropriate committee of Congress’’ 

8 means— 

9 (A) the Select Committee on Intelligence, 

10 the Committee on Homeland Security and Gov11 ernmental Affairs, and the Committee on En12 ergy and Natural Resources of the Senate; and 

13 (B) the Permanent Select Committee on 

14 Intelligence, the Committee on Homeland Secu15 rity, and the Committee on Energy and Com16 merce of the House of Representatives. 

17 (2) COVERED ENTITY.—The term ‘‘covered en18 tity’’ means an entity identified pursuant to section 

19 9(a) of Executive Order 13636 of February 12, 

20 2013 (78 Fed. Reg. 11742), relating to identifica21 tion of critical infrastructure where a cybersecurity 

22 incident could reasonably result in catastrophic re23 gional or national effects on public health or safety, 

24 economic security, or national security. 
3 

†S 79 ES

1 (3) EXPLOIT.—The term ‘‘exploit’’ means a 

2 software tool designed to take advantage of a secu3 rity vulnerability. 

4 (4) INDUSTRIAL CONTROL SYSTEM.— 

5 (A) IN GENERAL.—The term ‘‘industrial 

6 control system’’ means an operational tech7 nology used to measure, control, or manage in8 dustrial functions. 

9 (B) INCLUSIONS.—The term ‘‘industrial 

10 control system’’ includes supervisory control 

11 and data acquisition systems, distributed con12 trol systems, and programmable logic or embed13 ded controllers. 

14 (5) NATIONAL LABORATORY.—The term ‘‘Na15 tional Laboratory’’ has the meaning given the term 

16 in section 2 of the Energy Policy Act of 2005 (42 

17 U.S.C. 15801). 

18 (6) PROGRAM.—The term ‘‘Program’’ means 

19 the pilot program established under section 3. 

20 (7) SECRETARY.—The term ‘‘Secretary’’ means 

21 the Secretary of Energy. 

22 (8) SECURITY VULNERABILITY.—The term ‘‘se23 curity vulnerability’’ means any attribute of hard24 ware, software, process, or procedure that could en25 able or facilitate the defeat of a security control. 
4 

†S 79 ES

1 SEC. 3. PILOT PROGRAM FOR SECURING ENERGY INFRA2 STRUCTURE. 

3 Not later than 180 days after the date of enactment 

4 of this Act, the Secretary shall establish a 2-year control 

5 systems implementation pilot program within the National 

6 Laboratories for the purposes of— 

7 (1) partnering with covered entities in the en8 ergy sector (including critical component manufac9 turers in the supply chain) that voluntarily partici10 pate in the Program to identify new classes of secu11 rity vulnerabilities of the covered entities; and 

12 (2) evaluating technology and standards, in 

13 partnership with covered entities, to isolate and de14 fend industrial control systems of covered entities 

15 from security vulnerabilities and exploits in the most 

16 critical systems of the covered entities, including— 

17 (A) analog and nondigital control systems; 

18 (B) purpose-built control systems; and 

19 (C) physical controls. 

20 SEC. 4. WORKING GROUP TO EVALUATE PROGRAM STAND21 ARDS AND DEVELOP STRATEGY. 

22 (a) ESTABLISHMENT.—The Secretary shall establish 

23 a working group— 

24 (1) to evaluate the technology and standards 

25 used in the Program under section 3(2); and 
5 

†S 79 ES

1 (2) to develop a national cyber-informed engi2 neering strategy to isolate and defend covered enti3 ties from security vulnerabilities and exploits in the 

4 most critical systems of the covered entities. 

5 (b) MEMBERSHIP.—The working group established 

6 under subsection (a) shall be composed of not fewer than 

7 10 members, to be appointed by the Secretary, at least 

8 1 member of which shall represent each of the following: 

9 (1) The Department of Energy. 

10 (2) The energy industry, including electric utili11 ties and manufacturers recommended by the Energy 

12 Sector coordinating councils. 

13 (3)(A) The Department of Homeland Security; 

14 or 

15 (B) the Industrial Control Systems Cyber 

16 Emergency Response Team. 

17 (4) The North American Electric Reliability 

18 Corporation. 

19 (5) The Nuclear Regulatory Commission. 

20 (6)(A) The Office of the Director of National 

21 Intelligence; or 

22 (B) the intelligence community (as defined in 

23 section 3 of the National Security Act of 1947 (50 

24 U.S.C. 3003)). 

25 (7)(A) The Department of Defense; or 
6 

†S 79 ES

1 (B) the Assistant Secretary of Defense for 

2 Homeland Security and America’s Security Affairs. 

3 (8) A State or regional energy agency. 

4 (9) A national research body or academic insti5 tution. 

6 (10) The National Laboratories. 

7 SEC. 5. REPORTS ON THE PROGRAM. 

8 (a) INTERIM REPORT.—Not later than 180 days 

9 after the date on which funds are first disbursed under 

10 the Program, the Secretary shall submit to the appro11 priate committees of Congress an interim report that— 

12 (1) describes the results of the Program; 

13 (2) includes an analysis of the feasibility of 

14 each method studied under the Program; and 

15 (3) describes the results of the evaluations con16 ducted by the working group established under sec17 tion 4(a). 

18 (b) FINAL REPORT.—Not later than 2 years after the 

19 date on which funds are first disbursed under the Pro20 gram, the Secretary shall submit to the appropriate com21 mittees of Congress a final report that— 

22 (1) describes the results of the Program; 

23 (2) includes an analysis of the feasibility of 

24 each method studied under the Program; and 
7 

†S 79 ES

1 (3) describes the results of the evaluations con2 ducted by the working group established under sec3 tion 4(a). 

4 SEC. 6. EXEMPTION FROM DISCLOSURE. 

5 Information shared by or with the Federal Govern6 ment or a State, Tribal, or local government under this 

7 Act shall be— 

8 (1) deemed to be voluntarily shared informa9 tion; 

10 (2) exempt from disclosure under section 552 of 

11 title 5, United States Code, or any provision of any 

12 State, Tribal, or local freedom of information law, 

13 open government law, open meetings law, open 

14 records law, sunshine law, or similar law requiring 

15 the disclosure of information or records; and 

16 (3) withheld from the public, without discretion, 

17 under section 552(b)(3) of title 5, United States 

18 Code, or any provision of a State, Tribal, or local 

19 law requiring the disclosure of information or 

20 records. 

21 SEC. 7. PROTECTION FROM LIABILITY. 

22 (a) IN GENERAL.—A cause of action against a cov23 ered entity for engaging in the voluntary activities author24 ized under section 3— 
8 

†S 79 ES

1 (1) shall not lie or be maintained in any court; 

2 and 

3 (2) shall be promptly dismissed by the applica4 ble court. 

5 (b) VOLUNTARY ACTIVITIES.—Nothing in this Act 

6 subjects any covered entity to liability for not engaging 

7 in the voluntary activities authorized under section 3. 

8 SEC. 8. NO NEW REGULATORY AUTHORITY FOR FEDERAL 

9 AGENCIES. 

10 Nothing in this Act authorizes the Secretary or the 

11 head of any other department or agency of the Federal 

12 Government to issue new regulations. 

13 SEC. 9. AUTHORIZATION OF APPROPRIATIONS. 

14 (a) PILOT PROGRAM.—There is authorized to be ap15 propriated $10,000,000 to carry out section 3. 

16 (b) WORKING GROUP AND REPORT.—There is au17 thorized to be appropriated $1,500,000 to carry out sec18 tions 4 and 5. 
9 

†S 79 ES

1 (c) AVAILABILITY.—Amounts made available under 

2 subsections (a) and (b) shall remain available until ex3 pended. 

Passed the Senate December 20 (legislative day, December 19), 2018. 

Attest: 

Secretary. 
115TH CONGRESS 

2D SESSION S. 79 

AN ACT 

To provide for the establishment of a pilot program 

ties in the energy sector. to identify security vulnerabilities of certain enti-