111TH CONGRESS 

2D SESSION H. R. 5026 

AN ACT 

To amend the Federal Power Act to protect the bulk-power 

system and electric infrastructure critical to the defense 

of the United States against cybersecurity and other 

threats and vulnerabilities. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

•HR 5026 EH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Grid Reliability and 

3 Infrastructure Defense Act’’ or the ‘‘GRID Act’’. 

4 SEC. 2. AMENDMENT TO THE FEDERAL POWER ACT. 

5 (a) CRITICAL ELECTRIC INFRASTRUCTURE SECU6 RITY.—Part II of the Federal Power Act (16 U.S.C. 824 

7 et seq.) is amended by adding after section 215 the fol8 lowing new section: 

9 ‘‘SEC. 215A. CRITICAL ELECTRIC INFRASTRUCTURE SECU10 RITY. 

11 ‘‘(a) DEFINITIONS.—For purposes of this section: 

12 ‘‘(1) BULK-POWER SYSTEM; ELECTRIC RELI13 ABILITY ORGANIZATION; REGIONAL ENTITY.—The 

14 terms ‘bulk-power system’, ‘Electric Reliability Or15 ganization’, and ‘regional entity’ have the meanings 

16 given such terms in paragraphs (1), (2), and (7) of 

17 section 215(a), respectively. 

18 ‘‘(2) DEFENSE CRITICAL ELECTRIC INFRA19 STRUCTURE.—The term ‘defense critical electric in20 frastructure’ means any infrastructure located in the 

21 United States (including the territories) used for the 

22 generation, transmission, or distribution of electric 

23 energy that— 

24 ‘‘(A) is not part of the bulk-power system; 

25 and 
3 

•HR 5026 EH

1 ‘‘(B) serves a facility designated by the 

2 President pursuant to subsection (d)(1), but is 

3 not owned or operated by the owner or operator 

4 of such facility. 

5 ‘‘(3) DEFENSE CRITICAL ELECTRIC INFRA6 STRUCTURE VULNERABILITY.—The term ‘defense 

7 critical electric infrastructure vulnerability’ means a 

8 weakness in defense critical electric infrastructure 

9 that, in the event of a malicious act using electronic 

10 communication or an electromagnetic pulse, would 

11 pose a substantial risk of disruption of those elec12 tronic devices or communications networks, includ13 ing hardware, software, and data, that are essential 

14 to the reliability of defense critical electric infra15 structure. 

16 ‘‘(4) ELECTROMAGNETIC PULSE.—The term 

17 ‘electromagnetic pulse’ means 1 or more pulses of 

18 electromagnetic energy emitted by a device capable 

19 of disabling, disrupting, or destroying electronic 

20 equipment by means of such a pulse. 

21 ‘‘(5) GEOMAGNETIC STORM.—The term ‘geo22 magnetic storm’ means a temporary disturbance of 

23 the Earth’s magnetic field resulting from solar activ24 ity. 
4 

•HR 5026 EH

1 ‘‘(6) GRID SECURITY THREAT.—The term ‘grid 

2 security threat’ means a substantial likelihood of— 

3 ‘‘(A)(i) a malicious act using electronic 

4 communication or an electromagnetic pulse, or 

5 a geomagnetic storm event, that could disrupt 

6 the operation of those electronic devices or com7 munications networks, including hardware, soft8 ware, and data, that are essential to the reli9 ability of the bulk-power system or of defense 

10 critical electric infrastructure; and 

11 ‘‘(ii) disruption of the operation of such 

12 devices or networks, with significant adverse ef13 fects on the reliability of the bulk-power system 

14 or of defense critical electric infrastructure, as 

15 a result of such act or event; or 

16 ‘‘(B)(i) a direct physical attack on the 

17 bulk-power system or on defense critical electric 

18 infrastructure; and 

19 ‘‘(ii) significant adverse effects on the reli20 ability of the bulk-power system or of defense 

21 critical electric infrastructure as a result of 

22 such physical attack. 

23 ‘‘(7) GRID SECURITY VULNERABILITY.—The 

24 term ‘grid security vulnerability’ means a weakness 

25 that, in the event of a malicious act using electronic 
5 

•HR 5026 EH

1 communication or an electromagnetic pulse, would 

2 pose a substantial risk of disruption to the operation 

3 of those electronic devices or communications net4 works, including hardware, software, and data, that 

5 are essential to the reliability of the bulk-power sys6 tem. 

7 ‘‘(8) LARGE TRANSFORMER.—The term ‘large 

8 transformer’ means an electric transformer that is 

9 part of the bulk-power system. 

10 ‘‘(9) PROTECTED INFORMATION.—The term 

11 ‘protected information’ means information, other 

12 than classified national security information, des13 ignated as protected information by the Commission 

14 under subsection (e)(2)— 

15 ‘‘(A) that was developed or submitted in 

16 connection with the implementation of this sec17 tion; 

18 ‘‘(B) that specifically discusses grid secu19 rity threats, grid security vulnerabilities, de20 fense critical electric infrastructure 

21 vulnerabilities, or plans, procedures, or meas22 ures to address such threats or vulnerabilities; 

23 and 

24 ‘‘(C) the unauthorized disclosure of which 

25 could be used in a malicious manner to impair 
6 

•HR 5026 EH

1 the reliability of the bulk-power system or of 

2 defense critical electric infrastructure. 

3 ‘‘(10) SECRETARY.—The term ‘Secretary’ 

4 means the Secretary of Energy. 

5 ‘‘(11) SECURITY.—The definition of ‘security’ 

6 in section 3(16) shall not apply to the provisions in 

7 this section. 

8 ‘‘(b) EMERGENCY RESPONSE MEASURES.— 

9 ‘‘(1) AUTHORITY TO ADDRESS GRID SECURITY

10 THREATS.—Whenever the President issues and pro11 vides to the Commission (either directly or through 

12 the Secretary) a written directive or determination 

13 identifying an imminent grid security threat, the 

14 Commission may, with or without notice, hearing, or 

15 report, issue such orders for emergency measures as 

16 are necessary in its judgment to protect the reli17 ability of the bulk-power system or of defense critical 

18 electric infrastructure against such threat. As soon 

19 as practicable but not later than 180 days after the 

20 date of enactment of this section, the Commission 

21 shall, after notice and opportunity for comment, es22 tablish rules of procedure that ensure that such au23 thority can be exercised expeditiously. 

24 ‘‘(2) NOTIFICATION OF CONGRESS.—Whenever 

25 the President issues and provides to the Commission 
7 

•HR 5026 EH

1 (either directly or through the Secretary) a written 

2 directive or determination under paragraph (1), the 

3 President (or the Secretary, as the case may be) 

4 shall promptly notify congressional committees of 

5 relevant jurisdiction, including the Committee on 

6 Energy and Commerce of the House of Representa7 tives and the Committee on Energy and Natural Re8 sources of the Senate, of the contents of, and jus9 tification for, such directive or determination. 

10 ‘‘(3) CONSULTATION.—Before issuing an order 

11 for emergency measures under paragraph (1), the 

12 Commission shall, to the extent practicable in light 

13 of the nature of the grid security threat and the ur14 gency of the need for such emergency measures, con15 sult with appropriate governmental authorities in 

16 Canada and Mexico, entities described in paragraph 

17 (4), the Secretary, and other appropriate Federal 

18 agencies regarding implementation of such emer19 gency measures. 

20 ‘‘(4) APPLICATION.—An order for emergency 

21 measures under this subsection may apply to— 

22 ‘‘(A) the Electric Reliability Organization; 

23 ‘‘(B) a regional entity; or 
8 

•HR 5026 EH

1 ‘‘(C) any owner, user, or operator of the 

2 bulk-power system or of defense critical electric 

3 infrastructure within the United States. 

4 ‘‘(5) DISCONTINUANCE.—The Commission shall 

5 issue an order discontinuing any emergency meas6 ures ordered under this subsection, effective not 

7 later than 30 days after the earliest of the following: 

8 ‘‘(A) The date upon which the President 

9 issues and provides to the Commission (either 

10 directly or through the Secretary) a written di11 rective or determination that the grid security 

12 threat identified under paragraph (1) no longer 

13 exists. 

14 ‘‘(B) The date upon which the Commission 

15 issues a written determination that the emer16 gency measures are no longer needed to address 

17 the grid security threat identified under para18 graph (1), including by means of Commission 

19 approval of a reliability standard under section 

20 215 that the Commission determines adequately 

21 addresses such threat. 

22 ‘‘(C) The date that is 1 year after the 

23 issuance of an order under paragraph (1). 

24 ‘‘(6) COST RECOVERY.—If the Commission de25 termines that owners, operators, or users of the 
9 

•HR 5026 EH

1 bulk-power system or of defense critical electric in2 frastructure have incurred substantial costs to com3 ply with an order under this subsection and that 

4 such costs were prudently incurred and cannot rea5 sonably be recovered through regulated rates or 

6 market prices for the electric energy or services sold 

7 by such owners, operators, or users, the Commission 

8 shall, after notice and an opportunity for comment, 

9 establish a mechanism that permits such owners, op10 erators, or users to recover such costs. 

11 ‘‘(c) MEASURES TO ADDRESS GRID SECURITY

12 VULNERABILITIES.— 

13 ‘‘(1) COMMISSION AUTHORITY.—If the Commis14 sion, in consultation with appropriate Federal agen15 cies, identifies a grid security vulnerability that the 

16 Commission determines has not adequately been ad17 dressed through a reliability standard developed and 

18 approved under section 215, the Commission shall, 

19 after notice and opportunity for comment and after 

20 consultation with the Secretary, other appropriate 

21 Federal agencies, and appropriate governmental au22 thorities in Canada and Mexico, promulgate a rule 

23 or issue an order requiring implementation, by any 

24 owner, operator, or user of the bulk-power system in 

25 the United States, of measures to protect the bulk- 
10 

•HR 5026 EH

1 power system against such vulnerability. Before pro2 mulgating a rule or issuing an order under this 

3 paragraph, the Commission shall, to the extent prac4 ticable in light of the urgency of the need for action 

5 to address the grid security vulnerability, request 

6 and consider recommendations from the Electric Re7 liability Organization regarding such rule or order. 

8 The Commission may establish an appropriate dead9 line for the submission of such recommendations. 

10 ‘‘(2) CERTAIN EXISTING CYBERSECURITY

11 VULNERABILITIES.—Not later than 180 days after 

12 the date of enactment of this section, the Commis13 sion shall, after notice and opportunity for comment 

14 and after consultation with the Secretary, other ap15 propriate Federal agencies, and appropriate govern16 mental authorities in Canada and Mexico, promul17 gate a rule or issue an order requiring the imple18 mentation, by any owner, user, or operator of the 

19 bulk-power system in the United States, of such 

20 measures as are necessary to protect the bulk-power 

21 system against the vulnerabilities identified in the 

22 June 21, 2007, communication to certain ‘Electricity 

23 Sector Owners and Operators’ from the North 

24 American Electric Reliability Corporation, acting in 
11 

•HR 5026 EH

1 its capacity as the Electricity Sector Information 

2 and Analysis Center. 

3 ‘‘(3) RESCISSION.—The Commission shall ap4 prove a reliability standard developed under section 

5 215 that addresses a grid security vulnerability that 

6 is the subject of a rule or order under paragraph (1) 

7 or (2), unless the Commission determines that such 

8 reliability standard does not adequately protect 

9 against such vulnerability or otherwise does not sat10 isfy the requirements of section 215. Upon such ap11 proval, the Commission shall rescind the rule pro12 mulgated or order issued under paragraph (1) or (2) 

13 addressing such vulnerability, effective upon the ef14 fective date of the newly approved reliability stand15 ard. 

16 ‘‘(4) GEOMAGNETIC STORMS.—Not later than 1 

17 year after the date of enactment of this section, the 

18 Commission shall, after notice and an opportunity 

19 for comment and after consultation with the Sec20 retary and other appropriate Federal agencies, issue 

21 an order directing the Electric Reliability Organiza22 tion to submit to the Commission for approval under 

23 section 215, not later than 1 year after the issuance 

24 of such order, reliability standards adequate to pro25 tect the bulk-power system from any reasonably 
12 

•HR 5026 EH

1 foreseeable geomagnetic storm event. The Commis2 sion’s order shall specify the nature and magnitude 

3 of the reasonably foreseeable events against which 

4 such standards must protect. Such standards shall 

5 appropriately balance the risks to the bulk-power 

6 system associated with such events, including any 

7 regional variation in such risks, and the costs of 

8 mitigating such risks. 

9 ‘‘(5) LARGE TRANSFORMER AVAILABILITY.— 

10 Not later than 1 year after the date of enactment 

11 of this section, the Commission shall, after notice 

12 and an opportunity for comment and after consulta13 tion with the Secretary and other appropriate Fed14 eral agencies, issue an order directing the Electric 

15 Reliability Organization to submit to the Commis16 sion for approval under section 215, not later than 

17 1 year after the issuance of such order, reliability 

18 standards addressing availability of large trans19 formers. Such standards shall require entities that 

20 own or operate large transformers to ensure, individ21 ually or jointly, adequate availability of large trans22 formers to promptly restore the reliable operation of 

23 the bulk-power system in the event that any such 

24 transformer is destroyed or disabled as a result of 

25 a reasonably foreseeable physical or other attack or 
13 

•HR 5026 EH

1 geomagnetic storm event. The Commission’s order 

2 shall specify the nature and magnitude of the rea3 sonably foreseeable attacks or events that shall pro4 vide the basis for such standards. Such standards 

5 shall— 

6 ‘‘(A) provide entities subject to the stand7 ards with the option of meeting such standards 

8 individually or jointly; and 

9 ‘‘(B) appropriately balance the risks asso10 ciated with a reasonably foreseeable attack or 

11 event, including any regional variation in such 

12 risks, and the costs of ensuring adequate avail13 ability of spare transformers. 

14 ‘‘(d) CRITICAL DEFENSE FACILITIES.— 

15 ‘‘(1) DESIGNATION.—Not later than 180 days 

16 after the date of enactment of this section, the 

17 President shall designate, in a written directive or 

18 determination provided to the Commission, facilities 

19 located in the United States (including the terri20 tories) that are— 

21 ‘‘(A) critical to the defense of the United 

22 States; and 

23 ‘‘(B) vulnerable to a disruption of the sup24 ply of electric energy provided to such facility 

25 by an external provider. 
14 

•HR 5026 EH

1 The number of facilities designated by such directive 

2 or determination shall not exceed 100. The Presi3 dent may periodically revise the list of designated fa4 cilities through a subsequent written directive or de5 termination provided to the Commission, provided 

6 that the total number of designated facilities at any 

7 time shall not exceed 100. 

8 ‘‘(2) COMMISSION AUTHORITY.—If the Commis9 sion identifies a defense critical electric infrastruc10 ture vulnerability that the Commission, in consulta11 tion with owners and operators of any facility or fa12 cilities designated by the President pursuant to 

13 paragraph (1), determines has not adequately been 

14 addressed through measures undertaken by owners 

15 or operators of defense critical electric infrastruc16 ture, the Commission shall, after notice and an op17 portunity for comment and after consultation with 

18 the Secretary and other appropriate Federal agen19 cies, promulgate a rule or issue an order requiring 

20 implementation, by any owner or operator of defense 

21 critical electric infrastructure, of measures to protect 

22 the defense critical electric infrastructure against 

23 such vulnerability. The Commission shall exempt 

24 from any such rule or order any specific defense 

25 critical electric infrastructure that the Commission 
15 

•HR 5026 EH

1 determines already has been adequately protected 

2 against the identified vulnerability. The Commission 

3 shall make any such determination in consultation 

4 with the owner or operator of the facility designated 

5 by the President pursuant to paragraph (1) that re6 lies upon such defense critical electric infrastructure. 

7 ‘‘(3) COST RECOVERY.—An owner or operator 

8 of defense critical electric infrastructure shall be re9 quired to take measures under paragraph (2) only to 

10 the extent that the owners or operators of a facility 

11 or facilities designated by the President pursuant to 

12 paragraph (1) that rely upon such infrastructure 

13 agree to bear the full incremental costs of compli14 ance with a rule promulgated or order issued under 

15 paragraph (2). 

16 ‘‘(e) PROTECTION OF INFORMATION.— 

17 ‘‘(1) PROHIBITION OF PUBLIC DISCLOSURE OF

18 PROTECTED INFORMATION.—Protected informa19 tion— 

20 ‘‘(A) shall be exempt from disclosure under 

21 section 552(b)(3) of title 5, United States Code; 

22 and 

23 ‘‘(B) shall not be made available pursuant 

24 to any State, local, or tribal law requiring dis25 closure of information or records. 
16 

•HR 5026 EH

1 ‘‘(2) INFORMATION SHARING.— 

2 ‘‘(A) IN GENERAL.—Consistent with the 

3 Controlled Unclassified Information framework 

4 established by the President, the Commission 

5 shall promulgate such regulations and issue 

6 such orders as necessary to designate protected 

7 information and to prohibit the unauthorized 

8 disclosure of such protected information. 

9 ‘‘(B) SHARING OF PROTECTED INFORMA10 TION.—The regulations promulgated and orders 

11 issued pursuant to subparagraph (A) shall pro12 vide standards for and facilitate the appropriate 

13 sharing of protected information with, between, 

14 and by Federal, State, local, and tribal authori15 ties, the Electric Reliability Organization, re16 gional entities, and owners, operators, and 

17 users of the bulk-power system in the United 

18 States and of defense critical electric infrastruc19 ture. In promulgating such regulations and 

20 issuing such orders, the Commission shall take 

21 account of the role of State commissions in re22 viewing the prudence and cost of investments 

23 within their respective jurisdictions. The Com24 mission shall consult with appropriate Canadian 

25 and Mexican authorities to develop protocols for 
17 

•HR 5026 EH

1 the sharing of protected information with, be2 tween, and by appropriate Canadian and Mexi3 can authorities and owners, operators, and 

4 users of the bulk-power system outside the 

5 United States. 

6 ‘‘(3) SUBMISSION OF INFORMATION TO CON7 GRESS.—Nothing in this section shall permit or au8 thorize the withholding of information from Con9 gress, any committee or subcommittee thereof, or 

10 the Comptroller General. 

11 ‘‘(4) DISCLOSURE OF NON-PROTECTED INFOR12 MATION.—In implementing this section, the Com13 mission shall protect from disclosure only the min14 imum amount of information necessary to protect 

15 the reliability of the bulk-power system and of de16 fense critical electric infrastructure. The Commission 

17 shall segregate protected information within docu18 ments and electronic communications, wherever fea19 sible, to facilitate disclosure of information that is 

20 not designated as protected information. 

21 ‘‘(5) DURATION OF DESIGNATION.—Informa22 tion may not be designated as protected information 

23 for longer than 5 years, unless specifically redesig24 nated by the Commission. 
18 

•HR 5026 EH

1 ‘‘(6) REMOVAL OF DESIGNATION.—The Com2 mission may remove the designation of protected in3 formation, in whole or in part, from a document or 

4 electronic communication if the unauthorized disclo5 sure of such information could no longer be used to 

6 impair the reliability of the bulk-power system or of 

7 defense critical electric infrastructure. 

8 ‘‘(7) JUDICIAL REVIEW OF DESIGNATIONS.— 

9 Notwithstanding subsection (f) of this section or sec10 tion 313, a person or entity may seek judicial review 

11 of a determination by the Commission concerning 

12 the designation of protected information under this 

13 subsection exclusively in the district court of the 

14 United States in the district in which the complain15 ant resides, or has his principal place of business, or 

16 in the District of Columbia. In such a case the court 

17 shall determine the matter de novo, and may exam18 ine the contents of documents or electronic commu19 nications designated as protected information in 

20 camera to determine whether such documents or any 

21 part thereof were improperly designated as protected 

22 information. The burden is on the Commission to 

23 sustain its designation. 

24 ‘‘(f) JUDICIAL REVIEW.—The Commission shall act 

25 expeditiously to resolve all applications for rehearing of 
19 

•HR 5026 EH

1 orders issued pursuant to this section that are filed under 

2 section 313(a). Any party seeking judicial review pursuant 

3 to section 313 of an order issued under this section may 

4 obtain such review only in the United States Court of Ap5 peals for the District of Columbia Circuit. 

6 ‘‘(g) PROVISION OF ASSISTANCE TO INDUSTRY IN

7 MEETING GRID SECURITY PROTECTION NEEDS.— 

8 ‘‘(1) EXPERTISE AND RESOURCES.—The Sec9 retary shall establish a program, in consultation with 

10 other appropriate Federal agencies, to develop tech11 nical expertise in the protection of systems for the 

12 generation, transmission, and distribution of electric 

13 energy against geomagnetic storms or malicious acts 

14 using electronic communications or electromagnetic 

15 pulse that would pose a substantial risk of disrup16 tion to the operation of those electronic devices or 

17 communications networks, including hardware, soft18 ware, and data, that are essential to the reliability 

19 of such systems. Such program shall include the 

20 identification and development of appropriate tech21 nical and electronic resources, including hardware, 

22 software, and system equipment. 

23 ‘‘(2) SHARING EXPERTISE.—As appropriate, 

24 the Secretary shall offer to share technical expertise 

25 developed under the program under paragraph (1), 
20 

•HR 5026 EH

1 through consultation and assistance, with owners, 

2 operators, or users of systems for the generation, 

3 transmission, or distribution of electric energy lo4 cated in the United States and with State commis5 sions. In offering such support, the Secretary shall 

6 assign higher priority to systems serving facilities 

7 designated by the President pursuant to subsection 

8 (d)(1) and other critical-infrastructure facilities, 

9 which the Secretary shall identify in consultation 

10 with the Commission and other appropriate Federal 

11 agencies. 

12 ‘‘(3) SECURITY CLEARANCES AND COMMUNICA13 TION.—The Secretary shall facilitate and, to the ex14 tent practicable, expedite the acquisition of adequate 

15 security clearances by key personnel of any entity 

16 subject to the requirements of this section to enable 

17 optimum communication with Federal agencies re18 garding grid security threats, grid security 

19 vulnerabilities, and defense critical electric infra20 structure vulnerabilities. The Secretary, the Com21 mission, and other appropriate Federal agencies 

22 shall, to the extent practicable and consistent with 

23 their obligations to protect classified and protected 

24 information, share timely actionable information re25 garding grid security threats, grid security 
21 

•HR 5026 EH

1 vulnerabilities, and defense critical electric infra2 structure vulnerabilities with appropriate key per3 sonnel of owners, operators, and users of the bulk4 power system and of defense critical electric infra5 structure. 

6 ‘‘(h) CERTAIN FEDERAL ENTITIES.—For the 11-year 

7 period commencing on the date of enactment of this sec8 tion, the Tennessee Valley Authority and the Bonneville 

9 Power Administration shall be exempt from any require10 ment under subsection (b) or (c) (except for any require11 ment addressing a malicious act using electronic commu12 nication).’’. 

13 (b) CONFORMING AMENDMENTS.— 

14 (1) JURISDICTION.—Section 201(b)(2) of the 

15 Federal Power Act (16 U.S.C. 824(b)(2)) is amend16 ed by inserting ‘‘215A,’’ after ‘‘215,’’ each place it 

17 appears. 

18 (2) PUBLIC UTILITY.—Section 201(e) of the 

19 Federal Power Act (16 U.S.C. 824(e)) is amended 

20 by inserting ‘‘215A,’’ after ‘‘215,’’. 

21 SEC. 3. BUDGETARY COMPLIANCE. 

22 The budgetary effects of this Act, for the purpose of 

23 complying with the Statutory Pay-As-You-Go Act of 2010, 

24 shall be determined by reference to the latest statement 

25 titled ‘‘Budgetary Effects of PAYGO Legislation’’ for this 
22 

•HR 5026 EH

1 Act, submitted for printing in the Congressional Record 

2 by the Chairman of the House Budget Committee, pro3 vided that such statement has been submitted prior to the 

4 vote on passage. 

Passed the House of Representatives June 9, 2010. 

Attest: 

Clerk. 

111TH CONGRESS 

2D SESSION H. R. 5026 

AN ACT 

To amend the Federal Power Act to protect the 

vulnerabilities. against cybersecurity and other threats and critical to the defense of the United States bulk-power system and electric infrastructure