II 

Calendar No. 410 

115TH CONGRESS 

2D SESSION S. 79 

[Report No. 115–246] 

To provide for the establishment of a pilot program to identify security 

vulnerabilities of certain entities in the energy sector. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 10, 2017 

Mr. KING (for himself, Mr. RISCH, Mr. HEINRICH, Ms. COLLINS, and Mr. 

CRAPO) introduced the following bill; which was read twice and referred 

to the Committee on Energy and Natural Resources 

MAY 10, 2018 

Reported by Ms. MURKOWSKI, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Securing Energy Infra5 structure Act’’. 


lotter on DSKBCFDHB2PROD with BILLS
2 

•S 79 RS

1 SEC. 2. DEFINITIONS. 

2 In this Act: 

3 (1) COVERED ENTITY.—The term ‘‘covered en4 tity’’ means an entity identified pursuant to section 

5 9(a) of Executive Order 13636 of February 12, 

6 2013 (78 Fed. Reg. 11742) relating to identification 

7 of critical infrastructure where a cybersecurity inci8 dent could reasonably result in catastrophic regional 

9 or national effects on public health or safety, eco10 nomic security, or national security. 

11 (2) EXPLOIT.—The term ‘‘exploit’’ means a 

12 software tool designed to take advantage of a secu13 rity vulnerability. 

14 (3) INDUSTRIAL CONTROL SYSTEM.— 

15 (A) IN GENERAL.—The term ‘‘industrial 

16 control system’’ means an operational tech17 nology used to measure, control, or manage in18 dustrial functions. 

19 (B) INCLUSIONS.—The term ‘‘industrial 

20 control system’’ includes supervisory control 

21 and data acquisition systems, distributed con22 trol systems, and programmable logic or embed23 ded controllers. 

24 (4) NATIONAL LABORATORY.—The term ‘‘Na25 tional Laboratory’’ has the meaning given the term 


lotter on DSKBCFDHB2PROD with BILLS
3 

•S 79 RS

1 in section 2 of the Energy Policy Act of 2005 (42 

2 U.S.C. 15801). 

3 (5) PROGRAM.—The term ‘‘Program’’ means 

4 the pilot program established under section 3. 

5 (6) SECRETARY.—The term ‘‘Secretary’’ means 

6 the Secretary of Energy. 

7 (7) SECURITY VULNERABILITY.—The term ‘‘se8 curity vulnerability’’ means any attribute of hard9 ware, software, process, or procedure that could en10 able or facilitate the defeat of a security control. 

11 SEC. 3. PILOT PROGRAM FOR SECURING ENERGY INFRA12 STRUCTURE. 

13 Not later than 180 days after the date of enactment 

14 of this Act, the Secretary shall establish a 2-year control 

15 systems implementation pilot program within the National 

16 Laboratories for the purposes of— 

17 (1) partnering with covered entities in the en18 ergy sector (including critical component manufac19 turers in the supply chain) that voluntarily partici20 pate in the Program to identify new classes of secu21 rity vulnerabilities of the covered entities; and 

22 (2) researching, developing, testing, and imple23 menting technology platforms and standards, in 

24 partnership with covered entities, to isolate and de25 fend industrial control systems of covered entities 


lotter on DSKBCFDHB2PROD with BILLS
4 

•S 79 RS

1 from security vulnerabilities and exploits in the most 

2 critical systems of the covered entities, including— 

3 (A) analog and non-digital control systems; 

4 (B) purpose-built control systems; and 

5 (C) physical controls. 

6 SEC. 4. WORKING GROUP. 

7 (a) ESTABLISHMENT.—The Secretary shall establish 

8 a working group— 

9 (1) to evaluate the technology platforms and 

10 standards used in the Program under section 3(2); 

11 and 

12 (2) to develop a national cyber-informed engi13 neering strategy to isolate and defend covered enti14 ties from security vulnerabilities and exploits in the 

15 most critical systems of the covered entities. 

16 (b) MEMBERSHIP.—The working group established 

17 under subsection (a) shall be composed of not fewer than 

18 10 members, to be appointed by the Secretary, at least 

19 1 member of which shall represent each of the following: 

20 (1) The Department of Energy. 

21 (2) The energy industry, including electric utili22 ties and manufacturers recommended by the Energy 

23 Sector coordinating councils. 

24 (3)(A) The Department of Homeland Security; 

25 or 


lotter on DSKBCFDHB2PROD with BILLS
5 

•S 79 RS

1 (B) the Industrial Control Systems Cyber 

2 Emergency Response Team. 

3 (4) The North American Electric Reliability 

4 Corporation. 

5 (5) The Nuclear Regulatory Commission. 

6 (6)(A) The Office of the Director of National 

7 Intelligence; or 

8 (B) the intelligence community (as defined in 

9 section 3 of the National Security Act of 1947 (50 

10 U.S.C. 3003)). 

11 (7)(A) The Department of Defense; or 

12 (B) the Assistant Secretary of Defense for 

13 Homeland Security and America’s Security Affairs. 

14 (8) A State or regional energy agency. 

15 (9) A national research body or academic insti16 tution. 

17 (10) The National Laboratories. 

18 SEC. 5. REPORT. 

19 Not later than 2 years after the date on which funds 

20 are first disbursed under the Program, the Secretary shall 

21 submit to the appropriate committees of Congress a final 

22 report that— 

23 (1) describes the results of the Program; 

24 (2) includes an analysis of the feasibility of 

25 each method studied under the Program; and 


lotter on DSKBCFDHB2PROD with BILLS
6 

•S 79 RS

1 (3) describes the results of the evaluations con2 ducted by the working group established under sec3 tion 4(a). 

4 SEC. 6. NO NEW REGULATORY AUTHORITY. 

5 Nothing in this Act authorizes the Secretary or the 

6 head of any other Federal agency to issue new regulations. 

7 SEC. 7. EXEMPTION FROM DISCLOSURE. 

8 Information shared by or with the Federal Govern9 ment or a State, tribal, or local government under this 

10 Act shall be— 

11 (1) deemed to be voluntarily shared informa12 tion; and 

13 (2) exempt from disclosure under any provision 

14 of Federal, State, tribal, or local freedom of infor15 mation law, open government law, open meetings 

16 law, open records law, sunshine law, or similar law 

17 requiring the disclosure of information or records. 

18 SEC. 8. PROTECTION FROM LIABILITY. 

19 (a) IN GENERAL.—A cause of action against a cov20 ered entity for engaging in the voluntary activities author21 ized under section 3— 

22 (1) shall not lie or be maintained in any court; 

23 and 

24 (2) shall be promptly dismissed by the applica25 ble court. 


lotter on DSKBCFDHB2PROD with BILLS
7 

•S 79 RS

1 (b) VOLUNTARY ACTIVITIES.—Nothing in this Act 

2 subjects any covered entity to liability for not engaging 

3 in the voluntary activities authorized under section 3. 

4 SEC. 9. AUTHORIZATION OF APPROPRIATIONS. 

5 (a) PILOT PROGRAM.—There is authorized to be ap6 propriated $10,000,000 to carry out section 3. 

7 (b) WORKING GROUP AND REPORT.—There is au8 thorized to be appropriated $1,500,000 to carry out sec9 tions 4 and 5. 

10 (c) AVAILABILITY.—Amounts made available under 

11 subsections (a) and (b) shall remain available until ex12 pended. 

13 SECTION 1. SHORT TITLE. 

14 This Act may be cited as the ‘‘Securing Energy Infra15 structure Act’’. 

16 SEC. 2. DEFINITIONS. 

17 In this Act: 

18 (1) APPROPRIATE COMMITTEE OF CONGRESS.— 

19 The term ‘‘appropriate committee of Congress’’ 

20 means— 

21 (A) the Select Committee on Intelligence, the 

22 Committee on Homeland Security and Govern23 mental Affairs, and the Committee on Energy 

24 and Natural Resources of the Senate; and 


lotter on DSKBCFDHB2PROD with BILLS
8 

•S 79 RS

1 (B) the Permanent Select Committee on In2 telligence, the Committee on Homeland Security, 

3 and the Committee on Energy and Commerce of 

4 the House of Representatives. 

5 (2) COVERED ENTITY.—The term ‘‘covered enti6 ty’’ means an entity identified pursuant to section 

7 9(a) of Executive Order 13636 of February 12, 2013 

8 (78 Fed. Reg. 11742), relating to identification of 

9 critical infrastructure where a cybersecurity incident 

10 could reasonably result in catastrophic regional or 

11 national effects on public health or safety, economic 

12 security, or national security. 

13 (3) EXPLOIT.—The term ‘‘exploit’’ means a soft14 ware tool designed to take advantage of a security 

15 vulnerability. 

16 (4) INDUSTRIAL CONTROL SYSTEM.— 

17 (A) IN GENERAL.—The term ‘‘industrial 

18 control system’’ means an operational technology 

19 used to measure, control, or manage industrial 

20 functions. 

21 (B) INCLUSIONS.—The term ‘‘industrial 

22 control system’’ includes supervisory control and 

23 data acquisition systems, distributed control sys24 tems, and programmable logic or embedded con25 trollers. 


lotter on DSKBCFDHB2PROD with BILLS
9 

•S 79 RS

1 (5) NATIONAL LABORATORY.—The term ‘‘Na2 tional Laboratory’’ has the meaning given the term in 

3 section 2 of the Energy Policy Act of 2005 (42 U.S.C. 

4 15801). 

5 (6) PROGRAM.—The term ‘‘Program’’ means the 

6 pilot program established under section 3. 

7 (7) SECRETARY.—The term ‘‘Secretary’’ means 

8 the Secretary of Energy. 

9 (8) SECURITY VULNERABILITY.—The term ‘‘secu10 rity vulnerability’’ means any attribute of hardware, 

11 software, process, or procedure that could enable or fa12 cilitate the defeat of a security control. 

13 SEC. 3. PILOT PROGRAM FOR SECURING ENERGY INFRA14 STRUCTURE. 

15 Not later than 180 days after the date of enactment 

16 of this Act, the Secretary shall establish a 2-year control 

17 systems implementation pilot program within the National 

18 Laboratories for the purposes of— 

19 (1) partnering with covered entities in the en20 ergy sector (including critical component manufactur21 ers in the supply chain) that voluntarily participate 

22 in the Program to identify new classes of security 

23 vulnerabilities of the covered entities; and 

24 (2) evaluating technology and standards, in 

25 partnership with covered entities, to isolate and deVerDate Sep 11 2014 00:46 May 11, 2018 Jkt 079200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\S79.RS S79

lotter on DSKBCFDHB2PROD with BILLS
10 

•S 79 RS

1 fend industrial control systems of covered entities 

2 from security vulnerabilities and exploits in the most 

3 critical systems of the covered entities, including— 

4 (A) analog and nondigital control systems; 

5 (B) purpose-built control systems; and 

6 (C) physical controls. 

7 SEC. 4. WORKING GROUP TO EVALUATE PROGRAM STAND8 ARDS AND DEVELOP STRATEGY. 

9 (a) ESTABLISHMENT.—The Secretary shall establish a 

10 working group— 

11 (1) to evaluate the technology and standards 

12 used in the Program under section 3(2); and 

13 (2) to develop a national cyber-informed engi14 neering strategy to isolate and defend covered entities 

15 from security vulnerabilities and exploits in the most 

16 critical systems of the covered entities. 

17 (b) MEMBERSHIP.—The working group established 

18 under subsection (a) shall be composed of not fewer than 

19 10 members, to be appointed by the Secretary, at least 1 

20 member of which shall represent each of the following: 

21 (1) The Department of Energy. 

22 (2) The energy industry, including electric utili23 ties and manufacturers recommended by the Energy 

24 Sector coordinating councils. 


lotter on DSKBCFDHB2PROD with BILLS
11 

•S 79 RS

1 (3)(A) The Department of Homeland Security; 

2 or 

3 (B) the Industrial Control Systems Cyber Emer4 gency Response Team. 

5 (4) The North American Electric Reliability Cor6 poration. 

7 (5) The Nuclear Regulatory Commission. 

8 (6)(A) The Office of the Director of National In9 telligence; or 

10 (B) the intelligence community (as defined in 

11 section 3 of the National Security Act of 1947 (50 

12 U.S.C. 3003)). 

13 (7)(A) The Department of Defense; or 

14 (B) the Assistant Secretary of Defense for Home15 land Security and America’s Security Affairs. 

16 (8) A State or regional energy agency. 

17 (9) A national research body or academic insti18 tution. 

19 (10) The National Laboratories. 

20 SEC. 5. REPORTS ON THE PROGRAM. 

21 (a) INTERIM REPORT.—Not later than 180 days after 

22 the date on which funds are first disbursed under the Pro23 gram, the Secretary shall submit to the appropriate com24 mittees of Congress an interim report that— 

25 (1) describes the results of the Program; 


lotter on DSKBCFDHB2PROD with BILLS
12 

•S 79 RS

1 (2) includes an analysis of the feasibility of each 

2 method studied under the Program; and 

3 (3) describes the results of the evaluations con4 ducted by the working group established under section 

5 4(a). 

6 (b) FINAL REPORT.—Not later than 2 years after the 

7 date on which funds are first disbursed under the Program, 

8 the Secretary shall submit to the appropriate committees 

9 of Congress a final report that— 

10 (1) describes the results of the Program; 

11 (2) includes an analysis of the feasibility of each 

12 method studied under the Program; and 

13 (3) describes the results of the evaluations con14 ducted by the working group established under section 

15 4(a). 

16 SEC. 6. EXEMPTION FROM DISCLOSURE. 

17 Information shared by or with the Federal Government 

18 or a State, Tribal, or local government under this Act shall 

19 be— 

20 (1) deemed to be voluntarily shared information; 

21 (2) exempt from disclosure under section 552 of 

22 title 5, United States Code, or any provision of any 

23 State, Tribal, or local freedom of information law, 

24 open government law, open meetings law, open 


lotter on DSKBCFDHB2PROD with BILLS
13 

•S 79 RS

1 records law, sunshine law, or similar law requiring 

2 the disclosure of information or records; and 

3 (3) withheld from the public, without discretion, 

4 under section 552(b)(3) of title 5, United States Code, 

5 or any provision of a State, Tribal, or local law re6 quiring the disclosure of information or records. 

7 SEC. 7. PROTECTION FROM LIABILITY. 

8 (a) IN GENERAL.—A cause of action against a covered 

9 entity for engaging in the voluntary activities authorized 

10 under section 3— 

11 (1) shall not lie or be maintained in any court; 

12 and 

13 (2) shall be promptly dismissed by the applicable 

14 court. 

15 (b) VOLUNTARY ACTIVITIES.—Nothing in this Act sub16 jects any covered entity to liability for not engaging in the 

17 voluntary activities authorized under section 3. 

18 SEC. 8. NO NEW REGULATORY AUTHORITY FOR FEDERAL 

19 AGENCIES. 

20 Nothing in this Act authorizes the Secretary or the 

21 head of any other department or agency of the Federal Gov22 ernment to issue new regulations. 

23 SEC. 9. AUTHORIZATION OF APPROPRIATIONS. 

24 (a) PILOT PROGRAM.—There is authorized to be ap25 propriated $10,000,000 to carry out section 3. 


lotter on DSKBCFDHB2PROD with BILLS
14 

•S 79 RS

1 (b) WORKING GROUP AND REPORT.—There is author2 ized to be appropriated $1,500,000 to carry out sections 4 

3 and 5. 

4 (c) AVAILABILITY.—Amounts made available under 

5 subsections (a) and (b) shall remain available until ex6 pended. 


lotter on DSKBCFDHB2PROD with BILLS

lotter on DSKBCFDHB2PROD with BILLS
Calendar No. 410 

115TH CONGRESS 

2D SESSION S. 79 

[Report No. 115–246] 

A BILL 

To provide for the establishment of a pilot program 

ties in the energy sector. to identify security vulnerabilities of certain entiMAY 10, 2018 

Reported with an amendment 


lotter on DSKBCFDHB2PROD with BILLS