SEC. 2. CYBERSECURITY INCIDENT REPORTING FOR CRIT-
ICAL ELECTRIC INFRASTRUCTURE. 
Section 215A of the Federal Power Act (16 U.S.C. 
824o–1) is amended— 
(1) in subsection (a)— 
(A) by amending paragraph (1) to read as 
follows: 
‘‘(1) BULK-POWER
SYSTEM; CYBERSECURITY 
INCIDENT; ELECTRIC
RELIABILITY
ORGANIZATION; 
REGIONAL ENTITY.—The terms ‘bulk-power system’, 
‘cybersecurity incident’, ‘Electric Reliability Organi-
zation’, and ‘regional entity’ have the meanings 
given such terms in paragraphs (1), (8), (2), and (7) 
of section 215(a), respectively.’’; and 
(B) in paragraph (7)(A)(i), by inserting ‘‘, 
including a cybersecurity incident,’’ after ‘‘a 
malicious act’’; 
(2) by redesignating subsections (e) and (f) as 
subsections (f) and (g), respectively; and 
(3) by inserting after subsection (d) the fol-
lowing: 
‘‘(e) CYBERSECURITY INCIDENT REPORTING.— 
‘‘(1) DESIGNATION.—The Department of En-
ergy shall be a designated agency within the Federal 
Government to receive notifications regarding cyber-
security incidents and potential cybersecurity inci-
VerDate Sep 11 2014 
03:34 Mar 11, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1148.IH
H1148
kjohnson on DSK79L0C42PROD with BILLS
dents with respect to critical electric infrastructure 
from other Federal agencies and owners, operators, 
and users of critical electric infrastructure. 
‘‘(2) REGULATIONS.— 
‘‘(A) IN
GENERAL.—Not later than 240 
days after the date of enactment of the Critical 
Electric Infrastructure Cybersecurity Incident 
Reporting Act, the Secretary shall promulgate 
regulations to facilitate the submission of time-
ly, secure, and confidential notifications regard-
ing cybersecurity incidents and potential cyber-
security incidents with respect to critical elec-
tric infrastructure from Federal agencies and 
owners, operators, and users of critical electric 
infrastructure. 
‘‘(B) INCLUSIONS.—The regulations pro-
mulgated under subparagraph (A) shall— 
‘‘(i) detail what constitutes a potential 
cybersecurity incident for purposes of this 
subsection; and 
‘‘(ii) require a Federal agency or an 
owner, operator, or user of critical electric 
infrastructure that discovers a cybersecu-
rity incident or a potential cybersecurity 
incident with respect to critical electric in-
VerDate Sep 11 2014 
03:34 Mar 11, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1148.IH
H1148
kjohnson on DSK79L0C42PROD with BILLS
frastructure to submit to the Secretary, 
not later than 24 hours after discovery of 
such cybersecurity incident or potential cy-
bersecurity incident, notification regarding 
such cybersecurity incident or potential cy-
bersecurity incident. 
‘‘(3) ANNUAL REPORTS.—Not later than one 
year after the date of enactment of the Critical Elec-
tric Infrastructure Cybersecurity Incident Reporting 
Act, and annually thereafter, the Secretary shall 
submit to the Committee on Energy and Commerce 
of the House of Representatives and the Committee 
on Energy and Natural Resources of the Senate a 
report, in classified form if necessary, on the number 
of notifications received pursuant to this subsection, 
and a description of the actions taken by the De-
partment of Energy regarding such notifications, 
during the 1-year period preceding the report.’’. 
Æ 
VerDate Sep 11 2014 
03:34 Mar 11, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H1148.IH
H1148
kjohnson on DSK79L0C42PROD with BILLS