I 
114TH CONGRESS 
2D SESSION 
H. R. 6227 
To provide for a comprehensive interdisciplinary research and development 
initiative to strengthen the capacity of the electricity sector to neutralize 
cyber attacks. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 28, 2016 
Mr. BERA (for himself and Ms. EDDIE BERNICE JOHNSON of Texas) intro-
duced the following bill; which was referred to the Committee on Science, 
Space, and Technology, and in addition to the Committees on Homeland 
Security, and Energy and Commerce, for a period to be subsequently de-
termined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To provide for a comprehensive interdisciplinary research 
and development initiative to strengthen the capacity of 
the electricity sector to neutralize cyber attacks. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Grid Cybersecurity Re-
search and Development Act’’. 
SEC. 2. FINDINGS. 
Congress finds the following: 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(1) The Nation, and every other critical infra-
structure sector, depends on reliable electricity. 
(2) Industrial control systems used in the elec-
tricity sector are essential to maintain reliable oper-
ations of the electric grid. 
(3) The cybersecurity threat landscape is con-
stantly changing and attacker capabilities are ad-
vancing rapidly, requiring ongoing modifications, ad-
vancements, and investments in technologies and 
procedures to maintain security. 
(4) There are substantial and important dif-
ferences between cybersecurity approaches needed to 
protect information technology systems and indus-
trial control systems. 
(5) It is in the national interest for Federal 
agencies to invest in industrial control system cyber-
security research that facilitates private sector in-
vestment and the ability of the private sector to de-
velop cybersecurity tools and products for control 
systems. 
(6) The number of elements connecting to the 
electric grid is increasing, and designing cybersecu-
rity into communication, data, and control systems 
when they are built is more effective than modifying 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
products after installation to meet cybersecurity 
goals. 
(7) An understanding of human factors can be 
leveraged to understand the behavior of cyber threat 
actors, develop strategies to counter threat actors, 
improve industrial control system cybersecurity 
training programs, optimize the design of human- 
machine interfaces and cybersecurity tools, and in-
crease the capacity of the electrical sector workforce 
to prevent attacks from gaining entry to industrial 
control systems. 
SEC. 3. DEFINITIONS. 
In this Act: 
(1) CRITICAL ELECTRIC INFRASTRUCTURE IN-
FORMATION.—The term ‘‘critical electric infrastruc-
ture information’’ has the meaning given that term 
in section 215A(a)(3) of the Federal Power Act (16 
U.S.C. 824a–1(a)(3)). 
(2) 
CYBERSECURITY.—The 
term 
‘‘cyber-
security’’ means a set of preventative measures to 
protect information from a digital device or system, 
including a device or system used to manage the 
electric grid, from being stolen, compromised, or 
used to carry out an attack. 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(3) ELECTRICITY
SUBSECTOR
COORDINATING 
COUNCIL.—The term ‘‘Electricity Subsector Coordi-
nating Council’’ means the self-organized, self-gov-
erned council consisting of senior industry represent-
atives to serve as the principal liaison between the 
Federal Government and the electric power sector 
and to carry out the role of the Sector Coordinating 
Council as established in the National Infrastructure 
Protection Plan for the electricity subsector. 
(4) ENERGY
SECTOR
GOVERNMENT
COORDI-
NATING COUNCIL.—The term ‘‘Energy Sector Gov-
ernment Coordinating Council’’ means the council 
consisting of representatives from relevant Federal 
Government agencies to provide effective coordina-
tion of energy sector efforts to ensure a secure, reli-
able, and resilient energy infrastructure and to carry 
out the role of the Government Coordinating Council 
as established in the National Infrastructure Protec-
tion Plan for the energy sector. 
(5) HUMAN
FACTORS
RESEARCH.—The term 
‘‘human factors research’’ means research on human 
performance in social and physical environments, 
and on the integration of humans with physical sys-
tems and computer hardware and software. 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(6) HUMAN-MACHINE INTERFACES.—The term 
‘‘human-machine interfaces’’ means technologies 
that present information to an operator about the 
state of a process or system, or accept human in-
structions to implement an action, including visual-
ization displays such as a graphical user interface. 
(7) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Energy. 
(8) TRANSIENT DEVICES.—The term ‘‘transient 
devices’’ means removable media, including floppy 
disks, compact disks, USB flash drives, external 
hard drives, mobile devices, and other devices that 
utilize wireless connections for limited periods of 
time. 
SEC. 4. ELECTRICITY SECTOR CYBERSECURITY RESEARCH, 
DEVELOPMENT, AND DEMONSTRATION PRO-
GRAM. 
(a) IN GENERAL.—The Secretary, in coordination 
with appropriate Federal agencies, the Electricity Sub-
sector Coordinating Council, State, tribal, local, and terri-
torial governments, private sector vendors, and other rel-
evant stakeholders, shall carry out a research, develop-
ment, and demonstration initiative to harden and mitigate 
the electric grid from the consequences of cyber attacks 
by increasing the cybersecurity capabilities of the elec-
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
tricity sector and accelerating the development of cyberse-
curity technologies and tools. 
(b) DEPARTMENT OF ENERGY.—As part of the ini-
tiative described in subsection (a), the Secretary shall 
carry out activities to— 
(1) identify cybersecurity risks to the commu-
nication and control systems within, and impacting, 
the electricity sector; 
(2) develop methods and tools to rapidly detect 
cyber intruders and cyber incidents, including the 
use of data analytics techniques to validate and 
verify system behavior using multiple data streams 
reflecting the state of the system; 
(3) assess emerging energy technology cyberse-
curity capabilities, and integrate cybersecurity fea-
tures and protocols into the design, development, 
and deployment of emerging technologies, including 
renewable energy technologies; 
(4) develop secure industrial control system 
protocols and identify vulnerabilities in existing pro-
tocols; 
(5) work with manufacturers to build or retrofit 
security features and protocols into— 
(A) communication and network systems 
and management processes; 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(B) industrial control and energy manage-
ment system devices, components, software, 
firmware, and hardware, including distributed 
control and management systems and building 
management systems; 
(C) data storage systems and data man-
agement and analysis processes; 
(D) generation, transmission, distribution, 
and energy storage technologies; 
(E) automated and manually controlled de-
vices and equipment for monitoring or man-
aging frequency, voltage, and current; 
(F) technologies used to synchronize time 
and develop guidance for operational contin-
gency plans when time synchronization tech-
nologies are compromised; 
(G) end user elements that connect to the 
grid, including— 
(i) meters, synchrophasors, and other 
sensors; 
(ii) 
distribution 
automation 
tech-
nologies, smart inverters, and other grid 
control technologies; 
(iii) distributed generation and energy 
storage technologies; 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(iv) demand response technologies; 
(v) home and building energy control 
systems; 
(vi) electric and plug-in hybrid vehi-
cles; and 
(vii) other relevant devices, software, 
firmware, hardware, and distributed energy 
technologies; and 
(H) the supply chain of electric grid man-
agement system components; 
(6) improve the physical security of communica-
tion technologies and industrial control systems, in-
cluding remote assets; 
(7) integrate human factors research into the 
design and development of advanced tools and proc-
esses for dynamic monitoring, detection, protection, 
mitigation, and response; 
(8) advance the capabilities and use of relevant 
interdisciplinary mathematical and computer simula-
tion modeling and analysis methods; 
(9) evaluate and understand the potential con-
sequences of practices used to maintain the cyberse-
curity of information technology systems on the cy-
bersecurity of industrial control systems; 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(10) increase access to and the capabilities of 
existing cybersecurity test beds to simulate impacts 
of cyber attacks on industrial control system devices, 
components, software, and hardware; and 
(11) reduce the cost of implementing effective 
cybersecurity technologies and tools in the electricity 
sector. 
(c) NATIONAL SCIENCE FOUNDATION.—The Na-
tional Science Foundation shall— 
(1) support fundamental research to advance 
cybersecurity applications, technologies, and tools for 
industrial control systems, including incorporating 
interdisciplinary research in— 
(A) evolutionary systems, theories, mathe-
matics, and models; 
(B) economic and financial theories, math-
ematics, and models; and 
(C) big data analytical methods, mathe-
matics, computer coding, and algorithms; and 
(2) support education and training for the in-
dustrial control system cybersecurity workforce, in-
cluding through the Advanced Technological Edu-
cation program, graduate research fellowships, and 
other appropriate programs. 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(d) 
DEPARTMENT
OF
HOMELAND
SECURITY 
SCIENCE AND TECHNOLOGY DIRECTORATE.—The Science 
and Technology Directorate of the Department of Home-
land Security, in collaboration with the Department of En-
ergy, experts in the private sector with the necessary clear-
ances, and other relevant stakeholders, shall assess exist-
ing cybersecurity technologies and tools used in the de-
fense industry and— 
(1) identify technologies and tools that could be 
applied to meeting evolving civilian energy sector cy-
bersecurity needs; 
(2) develop a research strategy that incor-
porates human factors research findings to guide the 
modification of defense industry cybersecurity tools 
for use in the civilian sector; 
(3) develop a strategy to accelerate efforts to 
bring modified defense industry cybersecurity tools 
to the civilian market; and 
(4) carry out other activities the Secretary of 
Homeland Security considers appropriate to meet 
the goals of this subsection. 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
SEC. 5. TECHNICAL STANDARDS AND GUIDANCE DOCU-
MENTS FOR ELECTRICITY SECTOR CYBERSE-
CURITY RESEARCH. 
(a) IN GENERAL.—The Secretary, in coordination 
with appropriate Federal agencies, the Electricity Sub-
sector Coordinating Council, standards development orga-
nizations, State, tribal, local, and territorial governments, 
private sector vendors, and other relevant stakeholders, 
shall coordinate the development of guidance documents 
for research and demonstration activities to improve the 
cybersecurity capabilities of the electricity sector through 
participating agencies. As part of these activities, the Sec-
retary shall— 
(1) facilitate stakeholder involvement to up-
date— 
(A) the Roadmap to Achieve Energy Deliv-
ery Systems Cybersecurity (published in Sep-
tember 2011); 
(B) the Cybersecurity Procurement Lan-
guage for Energy Delivery Systems (published 
by the Energy Sector Control Systems Working 
Group in April 2014), including developing 
guidance for— 
(i) contracting with third parties to 
conduct vulnerability testing for industrial 
control systems; 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(ii) contracting with third parties that 
will utilize transient devices to access in-
dustrial control or information technology 
systems; and 
(iii) managing supply chain risks; and 
(C) the Electricity Subsector Cybersecurity 
Capability Maturity Model (published by the 
Department of Energy in February 2014), in-
cluding the development of— 
(i) metrics to measure changes in cy-
bersecurity capabilities and assess the po-
tential for metrics to drive unexpected be-
havioral changes that would reduce secu-
rity; and 
(ii) an analysis of incentive mecha-
nisms and their potential to increase in-
vestments in cybersecurity; 
(2) develop voluntary guidance to improve fo-
rensic analyses capabilities, including— 
(A) developing standardized terminology 
and monitoring processes; 
(B) identifying minimum data needed; and 
(C) utilizing human factors research to de-
velop more effective procedures for logging inci-
dent events; and 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(3) work with the National Science Foundation, 
Department of Homeland Security, National Insti-
tute of Standards and Technology, and stakeholders 
to develop a mechanism to anonymize, aggregate, 
and share the testing results from cybersecurity in-
dustrial control system test beds to facilitate tech-
nology improvements by public and private sector re-
searchers. 
(b) CRITICAL ELECTRIC INFRASTRUCTURE INFOR-
MATION.—Information provided to Federal agencies for 
the purposes of carrying out subsection (a) shall be consid-
ered critical electric infrastructure information and pro-
vided the protections established in section 10. 
(c) STANDARDS.—The Secretary, in collaboration 
with the Director of the National Institute of Standards 
and Technology and other appropriate Federal agencies, 
shall convene relevant stakeholders and facilitate the de-
velopment of— 
(1) voluntary, consensus-based technical stand-
ards to improve cybersecurity for— 
(A) emerging energy technologies; 
(B) distributed generation and storage 
technologies, and other distributed energy re-
sources; 
(C) electric vehicles; and 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(D) other technologies and devices that 
connect to the electric grid that can affect volt-
age stability; 
(2) recommended cybersecurity features and re-
quirements that can be used by the private sector to 
design and build interoperable cybersecurity features 
into— 
(A) devices and components; 
(B) software and hardware; and 
(C) other technologies that connect to the 
electric grid; and 
(3) voluntary standards for test beds and test 
bed methodologies that will enable reproducible test-
ing of industrial control system devices, components, 
software, and hardware across test beds. 
SEC. 6. VULNERABILITY TESTING AND TECHNICAL ASSIST-
ANCE TO INCREASE CYBERRESILIENCE. 
(a) IN GENERAL.—The Secretary shall— 
(1) collaborate with electricity sector asset own-
ers and operators in the private sector, leveraging 
the research facilities and expertise of the National 
Laboratories, to— 
(A) utilize a range of methods, including 
voluntary vulnerability testing and red team- 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
blue team exercises, to identify vulnerabilities in 
physical and cyber systems; 
(B) develop cybersecurity risk assessment 
tools and provide confidential analyses and rec-
ommendations to participating stakeholders; 
(C) work with stakeholders to develop 
methods to share anonymized and aggregated 
results in a format that enables the electricity 
sector, researchers, and the private sector to 
advance cybersecurity efforts, technologies, and 
tools; and 
(D) leverage the unique strengths and ex-
pertise of the National Laboratories and Fed-
eral agencies; 
(2) collaborate with relevant stakeholders to— 
(A) identify information, research, staff 
training, and analysis tools needed to evaluate 
industrial control system cybersecurity issues 
and challenges in the electricity sector; and 
(B) facilitate the sharing of information 
and the development of tools identified under 
subparagraph (A); 
(3) collaborate with and support electricity sec-
tor trade organizations and their research agencies 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
to improve the cybersecurity of industrial control 
systems used by members and stakeholders; and 
(4) collaborate with tribal governments to— 
(A) identify information, research, and 
analysis tools needed by tribal governments to 
increase the industrial control system cyberse-
curity of electricity assets within their jurisdic-
tion; and 
(B) facilitate the sharing of information 
and the development of tools needed to ensure 
the cybersecurity of tribal electricity assets and 
systems. 
(b) CRITICAL ELECTRIC INFRASTRUCTURE INFOR-
MATION.—Information provided to Federal agencies for 
the purposes of carrying out subsection (a)(1)(C) shall be 
considered critical electric infrastructure information and 
provided the protections established in section 10. 
SEC. 7. EDUCATION AND WORKFORCE TRAINING RE-
SEARCH AND STANDARDS. 
(a) DEPARTMENT
OF
ENERGY.—The Secretary 
shall— 
(1) utilize human factors research and other 
methods to identify core skills used by electricity 
sector industrial control systems cybersecurity pro-
fessionals; and 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(2) develop assessment methods and tools to 
identify existing personnel that show competence in 
the core skills identified under paragraph (1). 
(b) NATIONAL
INSTITUTE
OF
STANDARDS
AND 
TECHNOLOGY.—The Director of the National Institute of 
Standards and Technology shall— 
(1) develop voluntary, innovative industrial con-
trol systems cybersecurity training and retraining 
standards, lessons, and recommendations for the 
electricity sector that minimize duplication of cyber-
security compliance training programs; and 
(2) maintain a public database of industrial 
control systems cybersecurity education, training, 
and certification programs. 
SEC. 8. INTERAGENCY COORDINATION AND STRATEGIC 
PLAN FOR ELECTRICITY SECTOR CYBERSE-
CURITY RESEARCH. 
(a) DUTIES.—The Energy Sector Government Co-
ordinating Council shall— 
(1) review the most recent version of the Road-
map to Achieve Energy Delivery Systems Cybersecu-
rity and identify crosscutting energy grid cybersecu-
rity research needs and opportunities for collabora-
tion among Federal agencies and between Federal 
agencies and other relevant stakeholders; 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(2) identify interdisciplinary research, tech-
nology, and tools that can be applied to industrial 
control system cybersecurity challenges in the elec-
tricity sector; 
(3) identify technology transfer opportunities to 
accelerate the development and commercial applica-
tion of novel industrial control system cybersecurity 
technologies, systems, and processes; and 
(4) develop a coordinated Interagency Strategic 
Plan to advance cybersecurity capabilities for indus-
trial control systems used in the electricity sector 
that builds on the Roadmap to Achieve Energy De-
livery Systems in Cybersecurity. 
(b) STRATEGIC PLAN.— 
(1) SUBMITTAL.—The Interagency Strategic 
Plan developed under subsection (a)(4) shall be sub-
mitted to Congress within 12 months after the date 
of enactment of this Act. 
(2) CONTENTS.—The Interagency Strategic 
Plan shall include— 
(A) an analysis of how existing cybersecu-
rity research efforts conducted by member 
agencies are coordinated and can complement 
and advance the goals of the Roadmap to 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
Achieve Energy Delivery Systems Cybersecu-
rity; 
(B) recommendations for prioritized re-
search efforts that could contribute to advanc-
ing the cybersecurity of electricity sector indus-
trial control systems; 
(C) a description of how existing and pro-
posed public and private sector research efforts 
address the topics described in paragraph (3); 
and 
(D) a description of needed support for 
workforce training in this area. 
(3) CONSIDERATION.—In developing the Inter-
agency Strategic Plan, the Energy Sector Govern-
ment Coordinating Council shall consider— 
(A) opportunities for human factors re-
search to improve the design and effectiveness 
of cybersecurity devices, technologies, tools, 
processes, and training programs; 
(B) contributions of other disciplines to the 
development of innovative cybersecurity proto-
cols, devices, components, technologies, and 
tools; 
(C) opportunities for Small Business Inno-
vation Research (SBIR) and other technology 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
transfer programs to facilitate private sector 
development of industrial control system cyber-
security protocols, devices, components, tech-
nologies, and tools; 
(D) broader applications of the work done 
by relevant Federal agencies to advance the cy-
bersecurity of industrial control systems used 
by other sectors; and 
(E) activities called for in the Federal cy-
bersecurity research and development strategic 
plan required by section 201(a)(1) of the Cy-
bersecurity Enhancement Act of 2014 (15 
U.S.C. 7431(a)(1)). 
(c) MEMBERSHIP.—For the purposes of carrying out 
this section, the Energy Sector Government Coordinating 
Council shall include representatives from Federal agen-
cies with expertise in industrial control systems cybersecu-
rity, information technology cybersecurity, cyber physical 
systems, engineering, human factors research, human-ma-
chine interfaces, high performance computing, big data 
and data analytics, or other disciplines considered appro-
priate by the Council Chair. The Chair shall consider in-
cluding at least one employee designated by the head of 
each of the following agencies: 
(1) In the Department of Energy— 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(A) the Office of Electricity Delivery and 
Energy Reliability; 
(B) the Office of Science’s Advanced Sci-
entific Computing Research program; 
(C) the Office of Small Business Innova-
tion 
Research/Small 
Business 
Technology 
Transfer programs; 
(D) the Office of Technology Transitions; 
and 
(E) other offices considered appropriate by 
the Secretary. 
(2) The National Science Foundation. 
(3) The Department of Homeland Security’s 
Science and Technology Directorate. 
(4) The National Institute of Standards and 
Technology. 
(5) The National Aeronautics and Space Ad-
ministration’s Human Research Program. 
(6) The Office of Science and Technology Pol-
icy. 
(7) The Federal Energy Regulatory Commis-
sion. 
SEC. 9. REPORTS TO CONGRESS. 
(a) IDENTIFICATION
OF
COMMON
FACTORS
IN 
CYBER ATTACKS.— 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(1) STUDY.—The Secretary, in collaboration 
with the Secretary of Homeland Security, other ap-
propriate Federal agencies, and energy sector stake-
holders, shall conduct a study to analyze cyber at-
tacks on electricity sector industrial control systems 
and identify cost-effective opportunities to improve 
cybersecurity. 
(2) CRITICAL ELECTRIC INFRASTRUCTURE IN-
FORMATION.—Incident data provided to Federal 
agencies for the purposes of carrying out this sub-
section shall be considered critical electric infrastruc-
ture information and provided the protections estab-
lished in section 10. 
(3) CONTENT.—The study shall— 
(A) summarize cyber incident data pro-
vided to the Secretary by relevant Federal agen-
cies and energy sector stakeholders; 
(B) analyze processes, operational proce-
dures, and other factors common among cyber 
attacks; 
(C) identify the points where human be-
havior played a critical role in maintaining or 
compromising the security of the system; 
(D) recommend— 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(i) changes to the design of devices, 
human-machine interfaces, technologies, 
and tools to optimize security that do not 
require a change in human behavior; 
(ii) changes to processes or oper-
ational procedures that do not require a 
change in human behavior; and 
(iii) training techniques to increase 
the capacity of employees to actively iden-
tify, prevent, or neutralize the impact of 
cyber attacks; and 
(E) evaluate existing engineering and tech-
nical design criteria and guidelines that incor-
porate human factors research findings, and 
recommend criteria and guidelines for industrial 
control system cybersecurity tools that can be 
used to develop procurement guidance, includ-
ing guidance for alarms, displays, and layouts. 
(4) CONSULTATION.—In conducting the study, 
the Secretary shall consult with electricity sector 
stakeholders, professionals with expertise in human 
factors research, private sector industrial control 
system vendors, and other relevant parties. 
(5) REPORT.—Not later than 24 months after 
the date of enactment of this Act, the Secretary 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
shall submit to the Committee on Science, Space, 
and Technology of the House of Representatives and 
the Committee on Energy and Natural Resources of 
the Senate a report on the results of the study, in-
cluding the findings of the Secretary on each of the 
items described in paragraph (3). 
(b) BALANCING RISKS, SECURITY, AND MODERNIZA-
TION OF INDUSTRIAL SYSTEMS.— 
(1) STUDY.—The Secretary, in collaboration 
with the National Institute of Standards and Tech-
nology, other Federal agencies, and electricity sector 
stakeholders, shall examine the risks associated with 
increasing penetration of digital technologies in 
operational networks. 
(2) CONTENT.—The study shall— 
(A) evaluate the relative qualitative risks 
and benefits of various design and architecture 
options for electricity sector industrial control 
systems, including consideration of— 
(i) designs that include both digital 
and analog control devices and tech-
nologies; 
(ii) different communication tech-
nologies used to move information and 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
data between control system devices, tech-
nologies, and system operators; 
(iii) automated and human-in-the-loop 
devices and technologies; 
(iv) 
programmable 
versus 
non-
programmable devices and technologies; 
and 
(v) increased redundancy using dis-
similar cybersecurity technologies; 
(B) recommend methods or metrics to doc-
ument changes in risks associated with system 
designs and architectures; 
(C) provide recommendations for research, 
development, demonstration, and commercial 
application activities to address issues raised in 
subparagraphs (A) and (B); and 
(D) recommend guidance to minimize over-
all system risks. 
(3) CONSULTATION.—In conducting the study, 
the Secretary shall consult with electricity sector 
stakeholders, academic and private sector research-
ers, private sector industrial control system vendors, 
and other relevant parties. 
(4) REPORT.—Not later than 24 months after 
the date of enactment of this Act, the Secretary 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
shall submit to the Committee on Science, Space, 
and Technology of the House of Representatives and 
the Committee on Energy and Natural Resources of 
the Senate a report on the results of the study, in-
cluding the findings of the Secretary on each of the 
items described in paragraph (2). 
SEC. 10. PROTECTION OF CRITICAL ELECTRIC INFRA-
STRUCTURE INFORMATION. 
Any Federal agency that produces information or has 
information made available to it in the course of carrying 
out this Act shall determine whether to designate any such 
information as critical electric infrastructure information. 
Critical electric infrastructure information— 
(1) shall be exempt from disclosure under sec-
tion 552(b)(3) of title 5, United States Code; and 
(2) shall not be made available by any Federal, 
State, political subdivision, or tribal authority pursu-
ant to any Federal, State, political subdivision, or 
tribal law requiring public disclosure of information 
or records. 
SEC. 11. AUTHORIZATION OF APPROPRIATIONS. 
There are authorized to be appropriated to the Sec-
retary to carry out this Act— 
(1) $65,100,000 for fiscal year 2017; 
(2) $68,355,000 for fiscal year 2018; 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS
(3) $71,773,000 for fiscal year 2019; 
(4) $75,361,000 for fiscal year 2020; and 
(5) $79,129,000 for fiscal year 2021. 
Æ 
VerDate Sep 11 2014 
02:03 Oct 05, 2016
Jkt 069200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6301
E:\BILLS\H6227.IH
H6227
smartinez on DSK3GLQ082PROD with BILLS