(1) it is in the public interest to require the 
Federal Energy Regulatory Commission to promptly 
order measures to address known cybersecurity 
threats to the reliability of the electric bulk power 
system; and 
(2) the Commission must have the necessary 
emergency authority to respond promptly to future 
cybersecurity threats that could compromise reli-
ability of the bulk power system. 
SEC. 3. PROTECTION OF BULK POWER SYSTEM FROM CY-
BERSECURITY THREATS. 
(a) IN GENERAL.—Part II of the Federal Power Act 
is amended by adding the following new section after sec-
tion 215: 
‘‘SEC. 215A. EMERGENCY AUTHORITY TO ADDRESS CYBER-
SECURITY THREATS TO THE BULK POWER 
SYSTEM. 
‘‘(a) DEFINITIONS.—For purposes of this section: 
‘‘(1) The terms ‘reliability standard’, ‘bulk 
power system’, ‘reliable operation’, ‘cybersecurity in-
cident’, ‘Electric Reliability Organization’, ‘regional 
entity’, and ‘owners, users or operators’ shall have 
the same meaning as when used in section 215. 
‘‘(2) The term ‘cybersecurity threat’ means that 
there is credible information or evidence of— 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
‘‘(A) a likelihood of a malicious act that 
could disrupt the operation of those program-
mable electronic devices and communications 
networks including hardware, software and data 
that are essential to the reliable operation of 
the bulk power system; and 
‘‘(B) a substantial possibility of disruption 
to the operation of such devices and networks 
in the event of such a malicious act. 
‘‘(3) CLASSIFIED
INFORMATION.—The term 
‘classified information’ means any information that 
has been determined pursuant to Executive Order 
12958, as amended, or successor orders, or the 
Atomic Energy Act of 1954, to require protection 
against unauthorized disclosure and that is so des-
ignated. 
‘‘(4) SENSITIVE
CYBERSECURITY
INFORMA-
TION.—The term ‘sensitive cybersecurity informa-
tion’ means unclassified information that, if an un-
authorized disclosure is made, could be used in a 
malicious manner to impair the reliability or oper-
ations of the bulk power system or the supply of 
electricity to the bulk power system. 
‘‘(5) The term ‘Secretary’ means the Secretary 
of Energy. 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
‘‘(b) INTERIM AUTHORITY TO ADDRESS EXISTING 
CYBERSECURITY THREATS.— 
‘‘(1) IN
GENERAL.—After notice and oppor-
tunity for comment, and after consultation with ap-
propriate governmental authorities in Canada and 
Mexico (subject to adequate protections against in-
appropriate disclosure of security-sensitive informa-
tion), the Commission shall establish, by rule or 
order, within 120 days after enactment of this sec-
tion, such measures or actions as are necessary to 
protect the reliability of the bulk power system 
against the cybersecurity threats resulting from— 
‘‘(A) the vulnerabilities identified in the 
June 21, 2007, communication to certain ‘Elec-
tricity Sector Owners and Operators’ from the 
North American Electric Reliability Corpora-
tion, acting in its capacity as the Electricity 
Sector Information Sharing and Analysis Cen-
ter; and 
‘‘(B) related remote access issues. 
Such measures or actions may be required of any 
owner, user, or operator of the bulk power system 
within the United States. 
‘‘(2) ADDITIONAL ORDERS.—Until such time as 
the interim reliability measures or actions ordered 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
under this subsection are replaced by cybersecurity 
reliability standards developed, approved, and imple-
mented pursuant to section 215, the Commission 
may issue additional orders to supplement the initial 
rule or order issued under this subsection only if, 
based on subsequent information or petition from an 
affected entity, the Commission determines that 
clarification or refinements to the originally ordered 
measures or actions are necessary to ensure that the 
threats are adequately and appropriately addressed. 
Any such additional orders shall be preceded by no-
tice and opportunity for comment. 
‘‘(c) FUTURE EMERGENCIES INVOLVING IMMINENT 
CYBERSECURITY THREATS.— 
‘‘(1) AUTHORITY TO ADDRESS IMMINENT CY-
BERSECURITY
THREATS.—Whenever the President 
issues and provides to the Commission (either di-
rectly or through the Secretary) a written directive 
or determination that an imminent cybersecurity 
threat to the reliability of the bulk power system ex-
ists, the Commission may on its own motion, with or 
without notice, hearing, or report issue such orders 
for emergency measures or actions as are necessary 
in its judgment to protect the reliability of the bulk 
power system against such threat. 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
‘‘(2) CONSULTATION.—Before acting under this 
subsection, to the extent feasible, taking into ac-
count the nature of the threat and urgency of need 
for action, the Commission shall consult with appro-
priate governmental authorities in Canada and Mex-
ico (subject to adequate protections against inappro-
priate disclosure of security-sensitive information), 
entities described in paragraph (3), and officials at 
other Federal agencies, including the Secretary, as 
appropriate, regarding implementation of measures 
or actions that will effectively address the identified 
threat. 
‘‘(3) APPLICATION
OF
EMERGENCY
MEAS-
URES.—An order for emergency actions or measures 
under this subsection may apply to— 
‘‘(A) the Electric Reliability Organization 
referred to in section 215, 
‘‘(B) a regional entity with respect to the 
United States operations of the Electric Reli-
ability Organization, 
‘‘(C) the regional entity, or 
‘‘(D) any owner, user, or operator of the 
bulk power system within the United States. 
‘‘(d) DISCONTINUANCE OF INTERIM MEASURES.— 
The Commission shall issue an order discontinuing any 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
‘‘(f) PROTECTION OF UNCLASSIFIED SENSITIVE CY-
BERSECURITY INFORMATION.— 
‘‘(1) CONFIDENTIALITY
PROCEDURES.—After 
notice and opportunity for comment, the Commis-
sion shall promulgate rules and procedures to pro-
hibit the unauthorized disclosure of unclassified sen-
sitive cybersecurity information— 
‘‘(A) which was developed or used in con-
nection with the implementation of this section, 
‘‘(B) which specifically discusses cybersecu-
rity threats, vulnerabilities, mitigation plans or 
security procedures, and 
‘‘(C) the unauthorized disclosure of which 
could be used in a malicious manner to impair 
the reliability or operations of the bulk power 
system or the supply of electricity to the bulk 
power system. 
Such rules and procedures shall require the inven-
tory and safeguarding of such information during its 
creation, storage and transmittal by the Commission 
or by any other entity, including any vendor, con-
tractor or consultant. 
‘‘(2) LIMITED DISCLOSURE TO ENTITIES SUB-
JECT
TO
COMMISSION
ACTION.—In the rules and 
procedures promulgated under paragraph (1), the 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
Commission shall authorize the release of sensitive 
cybersecurity information to entities subject to Com-
mission action under this section and to their em-
ployees, contractors and third-party representatives, 
to the extent necessary to enable such entities to im-
plement Commission rules, orders or measures. En-
tities originating, receiving or possessing such infor-
mation shall comply with Commission rules and pro-
cedures to limit disclosure of such information to 
any other entities that have been determined to have 
a need to know, have executed non disclosure agree-
ments, and have been deemed by the entity to be 
trustworthy and reliable. Any entity which signed 
such non disclosure agreement and was found by the 
Commission or by another entity subject to this sec-
tion to have improperly disclosed sensitive cybersecu-
rity information shall thereafter be denied access to 
such information, and the Commission shall suspend 
ability of the entity disclosing such information to 
appear before the Commission. The sanctions under 
this paragraph against any individual or other entity 
shall be in addition to, and not in lieu of, any other 
actions Commission is authorized to take pursuant 
to section 316A for failure to comply with the rules 
or procedures established by the Commission under 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
this section. Information designated sensitive cyber-
security information pursuant to this section shall 
not be subject to disclosure under the Freedom of 
Information Act (5 U.S.C. 552). 
‘‘(3) LIMITATIONS.— 
‘‘(A) The Commission shall consult with 
national security or national intelligence agen-
cies, as appropriate, for purposes of designating 
certain information as sensitive cybersecurity 
information, but shall not designate as sensitive 
cybersecurity information any information that 
has been classified by another Federal agency. 
‘‘(B) Nothing in this section shall be con-
strued to authorize the withholding of informa-
tion from the committees of the Congress with 
jurisdiction over the Commission or the Comp-
troller General. 
‘‘(C) In promulgating and implementing 
rules and procedures under this section, the 
Commission shall protect from disclosure only 
the minimum amount of sensitive cybersecurity 
information necessary to protect the reliability 
or operations of the bulk power system or the 
supply of electricity to the bulk power system. 
The Commission shall segregate sensitive cyber-
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
security information within documents, elec-
tronic communications, and rules, orders or 
records associated with such rules and orders, 
wherever feasible, to facilitate disclosure of in-
formation which is not designated as sensitive 
cybersecurity information. 
‘‘(D) Information may not be designated 
as sensitive cybersecurity information for longer 
than 10 years, unless specifically redesignated 
by the Commission. 
‘‘(E) The Commission is authorized to re-
move the designation of sensitive cybersecurity 
information, in whole or in part, from a docu-
ment or electronic communication if the unau-
thorized disclosure could not be used to impair 
the reliability or operations of the bulk power 
system or the supply of electricity to the bulk 
power system. 
‘‘(4) CONSISTENCY OF MARKINGS.—The Com-
mission is authorized to place markings on docu-
ments, in whole or in part, which designate the de-
gree of sensitivity and limitations on dissemination. 
Regulations and related procedures may be modified, 
as appropriate, to ensure consistency with applicable 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
Executive Orders or laws pertaining to controlled 
unclassified information. 
‘‘(5) NONDISCLOSURE OF SENSITIVE CYBERSE-
CURITY INFORMATION IN RULES OR ORDERS.—If a 
rule or order issued pursuant to this section contains 
sensitive cybersecurity information or if information 
in the record associated with such rule or order con-
stitutes sensitive cybersecurity information, the 
Commission may make the rule, order or informa-
tion non-public in whole or in part. The Commission 
may disclose such non-public rule, order or informa-
tion to entities other than the recipient of the rule 
or order, as the Commission deems necessary, to 
carry out the rule or order and protect the reliability 
of the bulk power system. 
‘‘(6) JUDICIAL
REVIEW
OF
DESIGNATIONS.— 
Any determination by the Commission concerning 
the designation of sensitive cybersecurity informa-
tion shall be subject to judicial review pursuant to 
subsection (a)(4)(B) of section 552 of title 5 of the 
United States Code. 
‘‘(g) REVIEW.—The Commission shall act expedi-
tiously to resolve all applications for rehearing of orders 
issued pursuant to this section which are filed under sec-
tion 313(a). Any person or other entity seeking judicial 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
review pursuant to section 313 may obtain such review 
only in the United States Court of Appeals for the District 
of Columbia Circuit. In the case of any petition for review 
involving rules or orders containing or relating to security- 
sensitive information, the Commission and parties shall 
develop with the court appropriate measures to ensure the 
confidentiality of such information, including, but not lim-
ited to, court filings under seal or otherwise in non-public 
form, or judicial review in camera. 
‘‘(h) ENFORCEMENT DISCRETION.—The Commission 
is authorized to impose penalties pursuant to section 316A 
for any violation of a rule or order of the Commission 
under this section. The Commission shall exercise its dis-
cretion in engaging in enforcement actions under this sec-
tion to recognize good faith efforts to comply with direc-
tives of the Commission. 
‘‘(i) PAPERWORK REDUCTION.—Chapter 35 of title 
44, United States Code (44 U.S.C. 3501 et seq.) (com-
monly referred to as the ‘Paperwork Reduction Act’) shall 
not apply to collections of information that relate to meas-
ures or actions described in this section. 
‘‘(j) PROVISION OF ASSISTANCE TO INDUSTRY IN 
MEETING CYBERSECURITY PROTECTION NEEDS.— 
‘‘(1) EXPERTISE AND RESOURCES.—The Sec-
retary shall establish a program to develop expertise 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
and identify technical and electronic resources, in-
cluding hardware, software and system equipment, 
helpful to cybersecurity protection of the electric 
grid and all electric systems, including distribution- 
level electric systems. 
‘‘(2) SHARING
EXPERTISE.—The Secretary 
shall offer to share such expertise through consulta-
tion and assistance with any owner, operator, or 
user of the bulk power system, to any owner or oper-
ator of an electricity distribution system located in 
the United States whether or not connected to the 
bulk power system, and specifically to any owner or 
operator of an electricity distribution system that 
may provide electricity to national defense and other 
critical-infrastructure facilities of the United States. 
‘‘(3) PRIORITY.—The Secretary shall consult 
with the Commission, the Secretary of Defense, the 
Secretary of Homeland Security, and other Federal 
agencies to confirm the identity of States and elec-
tric systems serving such national defense and crit-
ical-infrastructure facilities, and shall assign higher 
priority to such States and systems in offering such 
support. 
‘‘(4) CLEARANCES.—The Secretary shall facili-
tate the acquisition by key security personnel of any 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS
electric entity affected by this subsection of suffi-
cient security clearances to allow such personnel ac-
cess to information that would enable optimum un-
derstanding of cybersecurity threats and ability to 
respond. 
‘‘(5) DEFENSE FACILITIES.—Within one year of 
the date of enactment of this section, the States of 
Alaska and Hawaii and the Territory of Guam shall 
prepare, in consultation with the Secretary of En-
ergy, the Secretary of Defense, and the electric utili-
ties that serve national defense facilities in those ju-
risdictions, a comprehensive plan, to be implemented 
by the relevant State and territorial governmental 
authorities, identifying the emergency measures or 
actions that will be taken to protect the reliability of 
the electric power supply of the national defense fa-
cilities located in those jurisdictions in the event of 
an imminent cybersecurity threat. A copy of each 
such plan shall be provided to the Secretary of En-
ergy and the Secretary of Defense.’’. 
(b) CONFORMING AMENDMENT.—Section 201(b)(2) 
of the Federal Power Act is amended by inserting ‘‘215A’’ 
after ‘‘215’’. 
Æ 
VerDate Nov 24 2008 
06:39 Apr 30, 2009
Jkt 079200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6301
E:\BILLS\H2165.IH
H2165
rfrederick on PROD1PC67 with BILLS