Securing Energy Infrastructure Act

To provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector. 1. Short title This Act may be cited as the Securing Energy Infrastructure Act 2. Definitions In this Act: (1) Covered entity The term covered entity (2) Exploit The term exploit (3) Industrial control system (A) In general The term industrial control system (B) Inclusions The term industrial control system (4) National Laboratory The term National Laboratory 42 U.S.C. 15801 (5) Program The term Program (6) Secretary The term Secretary (7) Security vulnerability The term security vulnerability 3. Pilot program for securing energy infrastructure Not later than 180 days after the date of enactment of this Act, the Secretary shall establish a 2-year control systems implementation pilot program within the National Laboratories for the purposes of— (1) partnering with covered entities in the energy sector (including critical component manufacturers in the supply chain) that voluntarily participate in the Program to identify new classes of security vulnerabilities of the covered entities; and (2) researching, developing, testing, and implementing technology platforms and standards, in partnership with covered entities, to isolate and defend industrial control systems of covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities, including— (A) analog and non-digital control systems; (B) purpose-built control systems; and (C) physical controls. 4. Working group (a) Establishment The Secretary shall establish a working group— (1) to evaluate the technology platforms and standards used in the Program under section 3(2); and (2) to develop a national cyber-informed engineering strategy to isolate and defend covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities. (b) Membership The working group established under subsection (a) shall be composed of not fewer than 10 members, to be appointed by the Secretary, at least 1 member of which shall represent each of the following: (1) The Department of Energy. (2) The energy industry, including electric utilities and manufacturers recommended by the Energy Sector coordinating councils. (3) (A) The Department of Homeland Security; or (B) the Industrial Control Systems Cyber Emergency Response Team. (4) The North American Electric Reliability Corporation. (5) The Nuclear Regulatory Commission. (6) (A) The Office of the Director of National Intelligence; or (B) the intelligence community (as defined in section 3 of the National Security Act of 1947 ( 50 U.S.C. 3003 (7) (A) The Department of Defense; or (B) the Assistant Secretary of Defense for Homeland Security and America's Security Affairs. (8) A State or regional energy agency. (9) A national research body or academic institution. (10) The National Laboratories. 5. Report Not later than 2 years after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress a final report that— (1) describes the results of the Program; (2) includes an analysis of the feasibility of each method studied under the Program; and (3) describes the results of the evaluations conducted by the working group established under section 4(a). 6. No new regulatory authority Nothing in this Act authorizes the Secretary or the head of any other Federal agency to issue new regulations. 7. Exemption from disclosure Information shared by or with the Federal Government or a State, tribal, or local government under this Act shall be— (1) deemed to be voluntarily shared information; and (2) exempt from disclosure under any provision of Federal, State, tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring the disclosure of information or records. 8. Protection from liability (a) In general A cause of action against a covered entity for engaging in the voluntary activities authorized under section 3— (1) shall not lie or be maintained in any court; and (2) shall be promptly dismissed by the applicable court. (b) Voluntary activities Nothing in this Act subjects any covered entity to liability for not engaging in the voluntary activities authorized under section 3. 9. Authorization of appropriations (a) Pilot Program There is authorized to be appropriated $10,000,000 to carry out section 3. (b) Working Group and Report There is authorized to be appropriated $1,500,000 to carry out sections 4 and 5. (c) Availability Amounts made available under subsections (a) and (b) shall remain available until expended. 1. Short title This Act may be cited as the Securing Energy Infrastructure Act 2. Definitions In this Act: (1) Appropriate committee of Congress The term appropriate committee of Congress (A) the Select Committee on Intelligence, the Committee on Homeland Security and Governmental Affairs, and the Committee on Energy and Natural Resources of the Senate (B) the Permanent Select Committee on Intelligence, the Committee on Homeland Security, and the Committee on Energy and Commerce of the House of Representatives (2) Covered entity The term covered entity (3) Exploit The term exploit (4) Industrial control system (A) In general The term industrial control system (B) Inclusions The term industrial control system (5) National Laboratory The term National Laboratory 42 U.S.C. 15801 (6) Program The term Program (7) Secretary The term Secretary (8) Security vulnerability The term security vulnerability 3. Pilot program for securing energy infrastructure Not later than 180 days after the date of enactment of this Act, the Secretary shall establish a 2-year control systems implementation pilot program within the National Laboratories for the purposes of— (1) partnering with covered entities in the energy sector (including critical component manufacturers in the supply chain) that voluntarily participate in the Program to identify new classes of security vulnerabilities of the covered entities; and (2) evaluating technology and standards, in partnership with covered entities, to isolate and defend industrial control systems of covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities, including— (A) analog and nondigital control systems; (B) purpose-built control systems; and (C) physical controls. 4. Working group to evaluate program standards and develop strategy (a) Establishment The Secretary shall establish a working group— (1) to evaluate the technology and standards used in the Program under section 3(2); and (2) to develop a national cyber-informed engineering strategy to isolate and defend covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities. (b) Membership The working group established under subsection (a) shall be composed of not fewer than 10 members, to be appointed by the Secretary, at least 1 member of which shall represent each of the following: (1) The Department of Energy. (2) The energy industry, including electric utilities and manufacturers recommended by the Energy Sector coordinating councils. (3) (A) The Department of Homeland Security; or (B) the Industrial Control Systems Cyber Emergency Response Team. (4) The North American Electric Reliability Corporation. (5) The Nuclear Regulatory Commission. (6) (A) The Office of the Director of National Intelligence; or (B) the intelligence community (as defined in section 3 of the National Security Act of 1947 ( 50 U.S.C. 3003 (7) (A) The Department of Defense; or (B) the Assistant Secretary of Defense for Homeland Security and America's Security Affairs. (8) A State or regional energy agency. (9) A national research body or academic institution. (10) The National Laboratories. 5. Reports on the Program (a) Interim report Not later than 180 days after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress an interim report that— (1) describes the results of the Program; (2) includes an analysis of the feasibility of each method studied under the Program; and (3) describes the results of the evaluations conducted by the working group established under section 4(a). (b) Final report Not later than 2 years after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress a final report that— (1) describes the results of the Program; (2) includes an analysis of the feasibility of each method studied under the Program; and (3) describes the results of the evaluations conducted by the working group established under section 4(a). 6. Exemption from disclosure Information shared by or with the Federal Government or a State, Tribal, or local government under this Act shall be— (1) deemed to be voluntarily shared information; (2) exempt from disclosure under section 552 of title 5, United States Code, or any provision of any State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring the disclosure of information or records; and (3) withheld from the public, without discretion, under section 552(b)(3) of title 5, United States Code, or any provision of a State, Tribal, or local law requiring the disclosure of information or records. 7. Protection from liability (a) In general A cause of action against a covered entity for engaging in the voluntary activities authorized under section 3— (1) shall not lie or be maintained in any court; and (2) shall be promptly dismissed by the applicable court. (b) Voluntary activities Nothing in this Act subjects any covered entity to liability for not engaging in the voluntary activities authorized under section 3. 8. No new regulatory authority for Federal agencies Nothing in this Act authorizes the Secretary or the head of any other department or agency of the Federal Government to issue new regulations. 9. Authorization of appropriations (a) Pilot Program There is authorized to be appropriated $10,000,000 to carry out section 3. (b) Working Group and Report There is authorized to be appropriated $1,500,000 to carry out sections 4 and 5. (c) Availability Amounts made available under subsections (a) and (b) shall remain available until expended. May 10, 2018 Reported with an amendment

Summary: Securing Energy Infrastructure Act This bill establishes a two-year pilot program within the Department of Energy's (DOE)national laboratories to identify thesecurity vulnerabilities of certain entities in the energy sector, and research and test technology that can be used to isolate the most critical systems of such entities from cyber-attacks. In addition,DOE must establish a working group to evaluate the technology solutions proposed by the national laboratories and to develop a national cyber strategy to isolate the energy grid from attacks. DOE must also submit a report to Congress describing the results of the pilot program, assessing the feasibility of the techniques considered, and outlining the results of the working group's evaluation.