II 114th CONGRESS 1st Session S. 1068 IN THE SENATE OF THE UNITED STATES April 23, 2015 Mr. Risch (for himself and Mr. Heinrich ) introduced the following bill; which was read twice and referred to the Committee on Energy and Natural Resources A BILL To amend the Federal Power Act to protect the bulk-power system from cyber security threats.

1. Cyber security threats Part II of the Federal Power Act ( 16 U.S.C. 824 et seq. ) is amended by adding at the end the following: 224. Cyber security threats (a) Definitions In this section: (1) Bulk-power system The term bulk-power system has the meaning given the term in section 215. (2) Cyber security threat The term cyber security threat means the imminent danger of a malicious act that disrupts, attempts to disrupt, or poses a significant risk of disrupting the operation of programmable electronic devices or communications networks (including hardware, software, and data) essential to the reliable operation of the bulk-power system. (3) Electric Reliability Organization The term Electric Reliability Organization has the meaning given the term in section 215. (4) Secretary The term Secretary means the Secretary of Energy. (b) Emergency authority of Secretary (1) In general If the President submits to the Secretary a written notice of a determination by the President that immediate action is necessary to protect the bulk-power system from a cyber security threat, the Secretary may require, by order and with or without notice, any entity that owns, controls, or operates a bulk-power system facility to take such actions as the Secretary determines will best avert or mitigate the cyber security threat. (2) Coordination with Canada and Mexico In exercising the authority pursuant to this subsection, the Secretary is encouraged to consult and coordinate with the appropriate officials in Canada and Mexico responsible for the protection of cyber security of the interconnected North American electricity grid. (3) Consultation Before exercising authority pursuant to this subsection, to the maximum extent practicable, taking into consideration the nature of an identified cyber security threat and the urgency of need for action, the Secretary shall consult regarding implementation of actions that will effectively address the cyber security threat with— (A) any entities potentially subject to the cyber security threat that own, control, or operate bulk-power system facilities; (B) the Electric Reliability Organization; (C) the Electricity Sub-sector Coordinating Council (as defined in the document entitled Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection ); and (D) officials of other Federal departments and agencies, as appropriate. (4) Cost recovery (A) In general The Commission shall establish a mechanism that permits owners, operators, or users of the bulk-power system to seek recovery of prudently incurred costs required to implement actions ordered by the Secretary under this subsection. (B) Requirements Any rate or charge approved under a mechanism established under this paragraph— (i) shall be just and reasonable; and (ii) shall not be unduly discriminatory or preferential. (c) Duration of emergency orders An order issued by the Secretary pursuant to subsection (b) shall remain in effect for not longer than the 30-day period beginning on the effective date of the order, unless, during that 30 day-period, the Secretary— (1) provides to interested persons an opportunity to submit written data, recommendations, and arguments; and (2) affirms, amends, or repeals the order, subject to the condition that an amended order shall not exceed a total duration of 90 days. .