II 

116TH CONGRESS 

1ST SESSION S. 2095 

To provide for certain programs and developments in the Department of 

Energy concerning the cybersecurity and vulnerabilities of, and physical 

threats to, the electric grid, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 11, 2019 

Mr. GARDNER (for himself and Mr. BENNET) introduced the following bill; 

which was read twice and referred to the Committee on Energy and Natural Resources 

A BILL 

To provide for certain programs and developments in the 

Department of Energy concerning the cybersecurity and 

vulnerabilities of, and physical threats to, the electric 

grid, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Enhancing Grid Secu5 rity through Public-Private Partnerships Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 


kjohnson on DSK79L0C42 with BILLS
2 

•S 2095 IS

1 (1) ELECTRIC RELIABILITY ORGANIZATION.— 

2 The term ‘‘Electric Reliability Organization’’ has the 

3 meaning given the term in section 215(a) of the 

4 Federal Power Act (16 U.S.C. 824o(a)). 

5 (2) ELECTRIC UTILITY; STATE REGULATORY

6 AUTHORITY.—The terms ‘‘electric utility’’ and 

7 ‘‘State regulatory authority’’ have the meanings 

8 given those terms in section 3 of the Federal Power 

9 Act (16 U.S.C. 796). 

10 (3) SECRETARY.—The term ‘‘Secretary’’ means 

11 the Secretary of Energy. 

12 SEC. 3. PROGRAM TO PROMOTE AND ADVANCE PHYSICAL 

13 SECURITY AND CYBERSECURITY OF ELEC14 TRIC UTILITIES. 

15 (a) ESTABLISHMENT.—The Secretary, in consulta16 tion with State regulatory authorities, industry stake17 holders, the Electric Reliability Organization, and any 

18 other Federal agencies that the Secretary determines to 

19 be appropriate, shall carry out a program— 

20 (1) to develop, and provide for voluntary imple21 mentation of, maturity models, self-assessments, and 

22 auditing methods for assessing the physical security 

23 and cybersecurity of electric utilities; 

24 (2) to assist with threat assessment and cyber25 security training for electric utilities; 


kjohnson on DSK79L0C42 with BILLS
3 

•S 2095 IS

1 (3) to provide technical assistance for electric 

2 utilities subject to the program; 

3 (4) to provide training to electric utilities to ad4 dress and mitigate cybersecurity supply chain man5 agement risks; 

6 (5) to advance the cybersecurity of third-party 

7 vendors in partnerships with electric utilities; and 

8 (6) to increase opportunities for sharing best 

9 practices and data collection within the electric sec10 tor. 

11 (b) SCOPE.—In carrying out the program under sub12 section (a), the Secretary shall— 

13 (1) take into consideration— 

14 (A) the different sizes of electric utilities; 

15 and 

16 (B) the regions that electric utilities serve; 

17 (2) prioritize electric utilities with fewer avail18 able resources due to size or region; and 

19 (3) to the maximum extent practicable, use and 

20 leverage— 

21 (A) existing Department of Energy pro22 grams; and 

23 (B) existing programs of the Federal agen24 cies determined to be appropriate under sub25 section (a). 


kjohnson on DSK79L0C42 with BILLS
4 

•S 2095 IS

1 (c) PROTECTION OF INFORMATION.—Information 

2 provided to, or collected by, the Federal Government pur3 suant to this section— 

4 (1) shall be exempt from disclosure under sec5 tion 552(b)(3) of title 5, United States Code; and 

6 (2) shall not be made available by any Federal 

7 agency, State, political subdivision of a State, or 

8 Tribal authority pursuant to any Federal, State, po9 litical subdivision of a State, or Tribal law, respec10 tively, requiring public disclosure of information or 

11 records. 

12 SEC. 4. REPORT ON CYBERSECURITY AND DISTRIBUTION 

13 SYSTEMS. 

14 (a) IN GENERAL.—Not later than 1 year after the 

15 date of enactment of this Act, the Secretary, in consulta16 tion with State regulatory authorities, industry stake17 holders, and any other Federal agencies that the Secretary 

18 determines to be appropriate, shall submit to Congress a 

19 report that assesses— 

20 (1) priorities, policies, procedures, and actions 

21 for enhancing the physical security and cybersecurity 

22 of electricity distribution systems, including behind23 the-meter generation, storage, and load management 

24 devices, to address threats to, and vulnerabilities of, 

25 electricity distribution systems; and 


kjohnson on DSK79L0C42 with BILLS
5 

•S 2095 IS

1 (2) the implementation of the priorities, poli2 cies, procedures, and actions assessed under para3 graph (1), including— 

4 (A) an estimate of potential costs and ben5 efits of the implementation; and 

6 (B) an assessment of any public-private 

7 cost-sharing opportunities. 

8 (b) PROTECTION OF INFORMATION.—Information 

9 provided to, or collected by, the Federal Government 

10 under this section— 

11 (1) shall be exempt from disclosure under sec12 tion 552(b)(3) of title 5, United States Code; and 

13 (2) shall not be made available by any Federal 

14 agency, State, political subdivision of a State, or 

15 Tribal authority pursuant to any Federal, State, po16 litical subdivision of a State, or Tribal law, respec17 tively, requiring public disclosure of information or 

18 records. 

Æ 


kjohnson on DSK79L0C42 with BILLS