I 

115TH CONGRESS 

2D SESSION H. R. 5239 

To require the Secretary of Energy to establish a voluntary Cyber Sense 

program to identify and promote cyber-secure products intended for 

use in the bulk-power system, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 9, 2018 

Mr. LATTA (for himself and Mr. MCNERNEY) introduced the following bill; 

which was referred to the Committee on Energy and Commerce 

A BILL 

To require the Secretary of Energy to establish a voluntary 

Cyber Sense program to identify and promote cybersecure products intended for use in the bulk-power system, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cyber Sense Act of 

5 2018’’. 

6 SEC. 2. CYBER SENSE. 

7 (a) IN GENERAL.—The Secretary of Energy shall es8 tablish a voluntary Cyber Sense program to identify and 


dlhill on DSK3GLQ082PROD with BILLS
2 

•HR 5239 IH

1 promote cyber-secure products intended for use in the 

2 bulk-power system, as defined in section 215(a) of the 

3 Federal Power Act (16 U.S.C. 824o(a)). 

4 (b) PROGRAM REQUIREMENTS.—In carrying out sub5 section (a), the Secretary of Energy shall— 

6 (1) establish a Cyber Sense testing process to 

7 identify products and technologies intended for use 

8 in the bulk-power system that are cyber-secure, in9 cluding products relating to industrial control sys10 tems, such as supervisory control and data acquisi11 tion systems; 

12 (2) for products tested and identified as cyber13 secure under the Cyber Sense program, establish 

14 and maintain cybersecurity vulnerability reporting 

15 processes and a related database; 

16 (3) provide technical assistance to electric utili17 ties, product manufacturers, and other electricity 

18 sector stakeholders to develop solutions to mitigate 

19 identified cybersecurity vulnerabilities in products 

20 tested and identified as cyber-secure under the 

21 Cyber Sense program; 

22 (4) biennially review products tested and identi23 fied as cyber-secure under the Cyber Sense program 

24 for cybersecurity vulnerabilities and provide analysis 


dlhill on DSK3GLQ082PROD with BILLS
3 

•HR 5239 IH

1 with respect to how such products respond to and 

2 mitigate cyber threats; 

3 (5) develop procurement guidance for electric 

4 utilities for products tested and identified as cyber5 secure under the Cyber Sense program; 

6 (6) provide reasonable notice to the public, and 

7 solicit comments from the public, prior to estab8 lishing or revising the Cyber Sense testing process; 

9 (7) establish procedures for disqualifying prod10 ucts that were tested and identified as cyber-secure 

11 under the Cyber Sense program but that no longer 

12 meet the qualifications to be identified cyber-secure 

13 products under such program; 

14 (8) oversee Cyber Sense testing carried out by 

15 third parties; and 

16 (9) consider incentives to encourage the use in 

17 the bulk-power system of products tested and identi18 fied as cyber-secure under the Cyber Sense program. 

19 (c) DISCLOSURE OF INFORMATION.—Any cybersecu20 rity vulnerability reported pursuant to the process estab21 lished under subsection (b)(2), the disclosure of which the 

22 Secretary of Energy reasonably foresees would cause harm 

23 to critical electric infrastructure (as defined in section 

24 215A of the Federal Power Act), shall be deemed to be 


dlhill on DSK3GLQ082PROD with BILLS
4 

•HR 5239 IH

1 critical electric infrastructure information for purposes of 

2 section 215A(d) of the Federal Power Act. 

3 (d) FEDERAL GOVERNMENT LIABILITY.—Nothing in 

4 this section shall be construed to authorize the commence5 ment of an action against the United States Government 

6 with respect to the testing and identification of a product 

7 under the Cyber Sense program. 

Æ 


dlhill on DSK3GLQ082PROD with BILLS