ties, trade organizations, and transmission and 
distribution system organizations, owners, and 
operators; 
‘‘(B) State and local governments and reg-
ulatory authorities, including public utility com-
missions; 
‘‘(C) tribal and Alaska Native govern-
mental entities; 
‘‘(D) partnerships among entities under 
subparagraphs (A) through (C); 
‘‘(E) regional partnerships; and 
‘‘(F) any other entities the Secretary 
deems appropriate. 
‘‘(4) AUTHORITY.—Nothing in this section shall 
authorize the Secretary to require any entity to 
adopt any model, tool, technology, plan, analysis, or 
assessment. 
‘‘SEC. 1312. BEST PRACTICES AND GUIDANCE DOCUMENTS 
FOR ENERGY SECTOR CYBERSECURITY RE-
SEARCH. 
‘‘(a) IN GENERAL.—The Secretary, in coordination 
with appropriate Federal agencies, the Electricity Sub-
sector Coordinating Council, standards development orga-
nizations, State, tribal, local, and territorial governments, 
the private sector, public utility commissions, and other 
VerDate Sep 11 2014 
22:32 Feb 06, 2020
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5760.IH
H5760
kjohnson on DSK79L0C42PROD with BILLS
relevant stakeholders, shall coordinate the development of 
guidance documents for research, development, and dem-
onstration activities to improve the cybersecurity capabili-
ties of the energy sector through participating agencies. 
As part of these activities, the Secretary shall— 
‘‘(1) facilitate stakeholder involvement to up-
date— 
‘‘(A) the Roadmap to Achieve Energy De-
livery Systems Cybersecurity; 
‘‘(B) the Cybersecurity Procurement Lan-
guage for Energy Delivery Systems, including 
developing guidance for— 
‘‘(i) contracting with third parties to 
conduct vulnerability testing for informa-
tion systems used across the energy pro-
duction, delivery, storage, and end use sys-
tems; 
‘‘(ii) contracting with third parties 
that utilize transient devices to access in-
formation systems; and 
‘‘(iii) managing supply chain risks; 
and 
‘‘(C) the Electricity Subsector Cybersecu-
rity Capability Maturity Model, including the 
VerDate Sep 11 2014 
22:32 Feb 06, 2020
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5760.IH
H5760
kjohnson on DSK79L0C42PROD with BILLS
development of metrics to measure changes in 
cybersecurity readiness; and 
‘‘(2) develop voluntary guidance to improve dig-
ital forensic analyses capabilities, including— 
‘‘(A) developing standardized terminology 
and monitoring processes; and 
‘‘(B) utilizing human factors research to 
develop more effective procedures for logging 
incident events; and 
‘‘(3) work with the National Science Founda-
tion, Department of Homeland Security, and stake-
holders to develop a mechanism to anonymize, ag-
gregate, and share the testing results from cyberse-
curity test beds to facilitate technology improve-
ments by public and private sector researchers. 
‘‘(b) BEST PRACTICES.—The Secretary, in collabora-
tion with the Director of the National Institute of Stand-
ards and Technology and other appropriate Federal agen-
cies, shall convene relevant stakeholders and facilitate the 
development of— 
‘‘(1) consensus-based best practices to improve 
cybersecurity for— 
‘‘(A) emerging energy technologies; 
VerDate Sep 11 2014 
20:33 Feb 10, 2020
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5760.IH
H5760
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) distributed generation and storage 
technologies, and other distributed energy re-
sources; 
‘‘(C) electric vehicles and electric vehicle 
charging stations; and 
‘‘(D) other technologies and devices that 
connect to the electric grid; 
‘‘(2) recommended cybersecurity features and 
requirements that can be used by the private sector 
to design and build interoperable cybersecurity fea-
tures into technologies that connect to the electric 
grid, including networked devices and components 
on distribution systems; and 
‘‘(3) technical analysis that can be used by the 
private sector in developing best practices for test 
beds and test bed methodologies that will enable re-
producible testing of cybersecurity protections for in-
formation systems, electronic devices, and other rel-
evant components, software, and hardware across 
test beds. 
‘‘(c) REGULATORY AUTHORITY.—None of the activi-
ties authorized in this section shall be construed to author-
ize regulatory actions. Additionally, the voluntary stand-
ards developed under this section shall not duplicate or 
conflict with mandatory reliability standards. 
VerDate Sep 11 2014 
20:33 Feb 10, 2020
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5760.IH
H5760
kjohnson on DSK79L0C42PROD with BILLS
‘‘SEC. 1313. VULNERABILITY TESTING AND TECHNICAL AS-
SISTANCE TO IMPROVE CYBERSECURITY. 
‘‘(a) IN GENERAL.—The Secretary shall— 
‘‘(1) coordinate with energy sector asset owners 
and operators, leveraging the research facilities and 
expertise of the National Laboratories, to assist enti-
ties in developing testing capabilities by— 
‘‘(A) utilizing a range of methods to iden-
tify vulnerabilities in physical and cyber sys-
tems; 
‘‘(B) developing cybersecurity risk assess-
ment tools and providing analyses and rec-
ommendations to participating stakeholders; 
and 
‘‘(C) working with stakeholders to develop 
methods to share anonymized and aggregated 
test results to assist relevant stakeholders in 
the energy sector, researchers, and the private 
sector to advance cybersecurity efforts, tech-
nologies, and tools; 
‘‘(2) collaborate with relevant stakeholders, in-
cluding public utility commissions, to— 
‘‘(A) identify information, research, staff 
training, and analytical tools needed to evaluate 
cybersecurity issues and challenges in the en-
ergy sector; and 
VerDate Sep 11 2014 
22:32 Feb 06, 2020
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5760.IH
H5760
kjohnson on DSK79L0C42PROD with BILLS