I 

118TH CONGRESS 

1ST SESSION H. R. 1160 

To direct the Secretary of Energy to promulgate regulations to facilitate 

the timely submission of notifications regarding cybersecurity incidents 

and potential cybersecurity incidents with respect to critical electric infrastructure, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 24, 2023 

Mr. WALBERG (for himself and Ms. SCHRIER) introduced the following bill; 

which was referred to the Committee on Energy and Commerce 

A BILL 

To direct the Secretary of Energy to promulgate regulations 

to facilitate the timely submission of notifications regarding cybersecurity incidents and potential cybersecurity 

incidents with respect to critical electric infrastructure, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Critical Electric Infra5 structure Cybersecurity Incident Reporting Act’’. 


kjohnson on DSK79L0C42PROD with BILLS
2 

•HR 1160 IH

1 SEC. 2. CYBERSECURITY INCIDENT REPORTING FOR CRIT2 ICAL ELECTRIC INFRASTRUCTURE. 

3 Section 215A of the Federal Power Act (16 U.S.C. 

4 824o–1) is amended— 

5 (1) in subsection (a)— 

6 (A) by amending paragraph (1) to read as 

7 follows: 

8 ‘‘(1) BULK-POWER SYSTEM; CYBERSECURITY

9 INCIDENT; ELECTRIC RELIABILITY ORGANIZATION; 

10 REGIONAL ENTITY.—The terms ‘bulk-power system’, 

11 ‘cybersecurity incident’, ‘Electric Reliability Organi12 zation’, and ‘regional entity’ have the meanings 

13 given such terms in paragraphs (1), (8), (2), and (7) 

14 of section 215(a), respectively.’’; and 

15 (B) in paragraph (7)(A)(i), by inserting ‘‘, 

16 including a cybersecurity incident,’’ after ‘‘a 

17 malicious act’’; 

18 (2) by redesignating subsections (e) and (f) as 

19 subsections (f) and (g), respectively; and 

20 (3) by inserting after subsection (d) the fol21 lowing: 

22 ‘‘(e) CYBERSECURITY INCIDENT REPORTING.— 

23 ‘‘(1) DESIGNATION.—The Department of En24 ergy shall be a designated agency within the Federal 

25 Government to receive notifications regarding cyber26 security incidents and potential cybersecurity inciVerDate Sep 11 2014 00:55 Mar 12, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H1160.IH H1160

kjohnson on DSK79L0C42PROD with BILLS
3 

•HR 1160 IH

1 dents with respect to critical electric infrastructure 

2 from other Federal agencies and owners, operators, 

3 and users of critical electric infrastructure. 

4 ‘‘(2) REGULATIONS.— 

5 ‘‘(A) IN GENERAL.—Not later than 240 

6 days after the date of enactment of the Critical 

7 Electric Infrastructure Cybersecurity Incident 

8 Reporting Act, the Secretary shall promulgate 

9 regulations to facilitate the submission of time10 ly, secure, and confidential notifications regard11 ing cybersecurity incidents and potential cyber12 security incidents with respect to critical elec13 tric infrastructure from Federal agencies and 

14 owners, operators, and users of critical electric 

15 infrastructure. 

16 ‘‘(B) INCLUSIONS.—The regulations pro17 mulgated under subparagraph (A) shall— 

18 ‘‘(i) detail what constitutes a potential 

19 cybersecurity incident for purposes of this 

20 subsection; and 

21 ‘‘(ii) require a Federal agency or an 

22 owner, operator, or user of critical electric 

23 infrastructure that discovers a cybersecu24 rity incident or a potential cybersecurity 

25 incident with respect to critical electric inVerDate Sep 11 2014 00:55 Mar 12, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H1160.IH H1160

kjohnson on DSK79L0C42PROD with BILLS
4 

•HR 1160 IH

1 frastructure to submit to the Secretary, 

2 not later than 24 hours after discovery of 

3 such cybersecurity incident or potential cy4 bersecurity incident, notification regarding 

5 such cybersecurity incident or potential cy6 bersecurity incident. 

7 ‘‘(3) ANNUAL REPORTS.—Not later than one 

8 year after the date of enactment of the Critical Elec9 tric Infrastructure Cybersecurity Incident Reporting 

10 Act, and annually thereafter, the Secretary shall 

11 submit to the Committee on Energy and Commerce 

12 of the House of Representatives and the Committee 

13 on Energy and Natural Resources of the Senate a 

14 report, in classified form if necessary, on the number 

15 of notifications received pursuant to this subsection, 

16 and a description of the actions taken by the De17 partment of Energy regarding such notifications, 

18 during the 1-year period preceding the report.’’. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS