II 

115TH CONGRESS 

1ST SESSION S. 79 

To provide for the establishment of a pilot program to identify security 

vulnerabilities of certain entities in the energy sector. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 10, 2017 

Mr. KING (for himself, Mr. RISCH, Mr. HEINRICH, Ms. COLLINS, and Mr. 

CRAPO) introduced the following bill; which was read twice and referred 

to the Committee on Energy and Natural Resources 

A BILL 

To provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Securing Energy Infra5 structure Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 

8 (1) COVERED ENTITY.—The term ‘‘covered en9 tity’’ means an entity identified pursuant to section 


srobinson on DSK5SPTVN1PROD with BILLS
2 

•S 79 IS

1 9(a) of Executive Order 13636 of February 12, 

2 2013 (78 Fed. Reg. 11742) relating to identification 

3 of critical infrastructure where a cybersecurity inci4 dent could reasonably result in catastrophic regional 

5 or national effects on public health or safety, eco6 nomic security, or national security. 

7 (2) EXPLOIT.—The term ‘‘exploit’’ means a 

8 software tool designed to take advantage of a secu9 rity vulnerability. 

10 (3) INDUSTRIAL CONTROL SYSTEM.— 

11 (A) IN GENERAL.—The term ‘‘industrial 

12 control system’’ means an operational tech13 nology used to measure, control, or manage in14 dustrial functions. 

15 (B) INCLUSIONS.—The term ‘‘industrial 

16 control system’’ includes supervisory control 

17 and data acquisition systems, distributed con18 trol systems, and programmable logic or embed19 ded controllers. 

20 (4) NATIONAL LABORATORY.—The term ‘‘Na21 tional Laboratory’’ has the meaning given the term 

22 in section 2 of the Energy Policy Act of 2005 (42 

23 U.S.C. 15801). 

24 (5) PROGRAM.—The term ‘‘Program’’ means 

25 the pilot program established under section 3. 


srobinson on DSK5SPTVN1PROD with BILLS
3 

•S 79 IS

1 (6) SECRETARY.—The term ‘‘Secretary’’ means 

2 the Secretary of Energy. 

3 (7) SECURITY VULNERABILITY.—The term ‘‘se4 curity vulnerability’’ means any attribute of hard5 ware, software, process, or procedure that could en6 able or facilitate the defeat of a security control. 

7 SEC. 3. PILOT PROGRAM FOR SECURING ENERGY INFRA8 STRUCTURE. 

9 Not later than 180 days after the date of enactment 

10 of this Act, the Secretary shall establish a 2-year control 

11 systems implementation pilot program within the National 

12 Laboratories for the purposes of— 

13 (1) partnering with covered entities in the en14 ergy sector (including critical component manufac15 turers in the supply chain) that voluntarily partici16 pate in the Program to identify new classes of secu17 rity vulnerabilities of the covered entities; and 

18 (2) researching, developing, testing, and imple19 menting technology platforms and standards, in 

20 partnership with covered entities, to isolate and de21 fend industrial control systems of covered entities 

22 from security vulnerabilities and exploits in the most 

23 critical systems of the covered entities, including— 

24 (A) analog and non-digital control systems; 

25 (B) purpose-built control systems; and 


srobinson on DSK5SPTVN1PROD with BILLS
4 

•S 79 IS

1 (C) physical controls. 

2 SEC. 4. WORKING GROUP. 

3 (a) ESTABLISHMENT.—The Secretary shall establish 

4 a working group— 

5 (1) to evaluate the technology platforms and 

6 standards used in the Program under section 3(2); 

7 and 

8 (2) to develop a national cyber-informed engi9 neering strategy to isolate and defend covered enti10 ties from security vulnerabilities and exploits in the 

11 most critical systems of the covered entities. 

12 (b) MEMBERSHIP.—The working group established 

13 under subsection (a) shall be composed of not fewer than 

14 10 members, to be appointed by the Secretary, at least 

15 1 member of which shall represent each of the following: 

16 (1) The Department of Energy. 

17 (2) The energy industry, including electric utili18 ties and manufacturers recommended by the Energy 

19 Sector coordinating councils. 

20 (3)(A) The Department of Homeland Security; 

21 or 

22 (B) the Industrial Control Systems Cyber 

23 Emergency Response Team. 

24 (4) The North American Electric Reliability 

25 Corporation. 


srobinson on DSK5SPTVN1PROD with BILLS
5 

•S 79 IS

1 (5) The Nuclear Regulatory Commission. 

2 (6)(A) The Office of the Director of National 

3 Intelligence; or 

4 (B) the intelligence community (as defined in 

5 section 3 of the National Security Act of 1947 (50 

6 U.S.C. 3003)). 

7 (7)(A) The Department of Defense; or 

8 (B) the Assistant Secretary of Defense for 

9 Homeland Security and America’s Security Affairs. 

10 (8) A State or regional energy agency. 

11 (9) A national research body or academic insti12 tution. 

13 (10) The National Laboratories. 

14 SEC. 5. REPORT. 

15 Not later than 2 years after the date on which funds 

16 are first disbursed under the Program, the Secretary shall 

17 submit to the appropriate committees of Congress a final 

18 report that— 

19 (1) describes the results of the Program; 

20 (2) includes an analysis of the feasibility of 

21 each method studied under the Program; and 

22 (3) describes the results of the evaluations con23 ducted by the working group established under sec24 tion 4(a). 


srobinson on DSK5SPTVN1PROD with BILLS
6 

•S 79 IS

1 SEC. 6. NO NEW REGULATORY AUTHORITY. 

2 Nothing in this Act authorizes the Secretary or the 

3 head of any other Federal agency to issue new regulations. 

4 SEC. 7. EXEMPTION FROM DISCLOSURE. 

5 Information shared by or with the Federal Govern6 ment or a State, tribal, or local government under this 

7 Act shall be— 

8 (1) deemed to be voluntarily shared informa9 tion; and 

10 (2) exempt from disclosure under any provision 

11 of Federal, State, tribal, or local freedom of infor12 mation law, open government law, open meetings 

13 law, open records law, sunshine law, or similar law 

14 requiring the disclosure of information or records. 

15 SEC. 8. PROTECTION FROM LIABILITY. 

16 (a) IN GENERAL.—A cause of action against a cov17 ered entity for engaging in the voluntary activities author18 ized under section 3— 

19 (1) shall not lie or be maintained in any court; 

20 and 

21 (2) shall be promptly dismissed by the applica22 ble court. 

23 (b) VOLUNTARY ACTIVITIES.—Nothing in this Act 

24 subjects any covered entity to liability for not engaging 

25 in the voluntary activities authorized under section 3. 


srobinson on DSK5SPTVN1PROD with BILLS
7 

•S 79 IS

1 SEC. 9. AUTHORIZATION OF APPROPRIATIONS. 

2 (a) PILOT PROGRAM.—There is authorized to be ap3 propriated $10,000,000 to carry out section 3. 

4 (b) WORKING GROUP AND REPORT.—There is au5 thorized to be appropriated $1,500,000 to carry out sec6 tions 4 and 5. 

7 (c) AVAILABILITY.—Amounts made available under 

8 subsections (a) and (b) shall remain available until ex9 pended. 

Æ 


srobinson on DSK5SPTVN1PROD with BILLS