II
114th CONGRESS
2d Session
S. 3018
IN THE SENATE OF THE UNITED STATES
June 6, 2016
Mr. King (for himself, Mr. Risch, Ms. Collins, and Mr. Heinrich) introduced the following bill; which was read twice and referred to the Committee on Energy and Natural Resources
A BILL
To provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector.
Short title
This Act may be cited as the Securing Energy Infrastructure Act
.
Definitions
In this Act:
Covered entity
The term covered entity means an entity identified pursuant to section 9(a) of Executive Order 13636 of February 12, 2013 (78 Fed. Reg. 11742), relating to identification of critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.
Exploit
The term exploit
means a software tool designed to take advantage of a security vulnerability.
Industrial control system
In general
The term industrial control system means an operational technology used to measure, control, or manage industrial functions.
Inclusions
The term industrial control system
includes supervisory control and data acquisition systems, distributed control systems, and programmable logic or embedded controllers.
National Laboratory
The term National Laboratory has the meaning given the term in section 2 of the Energy Policy Act of 2005 (42 U.S.C. 15801).
Program
The term Program
means the pilot program established under section 3.
Secretary
The term Secretary
means the Secretary of Energy.
Security vulnerability
The term security vulnerability means any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of a security control.
Pilot program for securing energy infrastructure
Not later than 60 days after the date of enactment of this Act, the Secretary shall establish a 2-year control systems implementation pilot program within the National Laboratories for the purposes of—
studying the covered entities in the energy sector that voluntarily participate in the Program to identify new classes of security vulnerabilities of the covered entities; and
researching, developing, testing, and implementing technology platforms and standards to isolate and defend industrial control systems of covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities, including—
analog and nondigital control systems;
purpose-built control systems; and
physical controls.
Working group
Establishment
The Secretary shall establish a working group—
to evaluate the technology platforms and standards used in the Program under section 3(2); and
to develop a national cyber-informed engineering strategy to isolate and defend covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities.
Membership
The working group established under subsection (a) shall be composed of not fewer than 10 members, to be appointed by the Secretary, at least 1 member of which shall represent each of the following:
The Department of Energy.
The energy industry, including electric utilities and manufacturers recommended by the Energy Sector coordinating councils.
The Department of Homeland Security; or
the Industrial Control Systems Cyber Emergency Response Team.
The North American Electric Reliability Corporation.
The Nuclear Regulatory Commission.
The Office of the Director of National Intelligence; or
the intelligence community (as defined in section 3 of the National Security Act of 1947 (50 U.S.C. 3003)).
The Department of Defense; or
the Assistant Secretary of Defense for Homeland Security and America's Security Affairs.
A State or regional energy agency.
A national research body or academic institution.
The National Laboratories.
Report
Not later than 2 years after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress a final report that—
describes the results of the Program;
includes an analysis of the feasibility of each method studied under the Program; and
describes the results of the evaluations conducted by the working group established under section 4(a).
No new regulatory authority
Nothing in this Act authorizes the Secretary or the head of any other Federal agency to issue new regulations.
Exemption from disclosure
Information shared by or with the Federal Government or a State, tribal, or local government under this Act shall be—
deemed to be voluntarily shared information; and
exempt from disclosure under any provision of Federal, State, tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring the disclosure of information or records.
Protection from liability
In general
A cause of action against a covered entity for engaging in the voluntary activities authorized under section 3—
shall not lie or be maintained in any court; and
shall be promptly dismissed by the applicable court.
Voluntary activities
Nothing in this Act subjects any covered entity to liability for not engaging in the voluntary activities authorized under section 3.
Authorization of appropriations
Pilot Program
There is authorized to be appropriated $10,000,000 to carry out section 3.
Working Group and Report
There is authorized to be appropriated $1,500,000 to carry out sections 4 and 5.
Availability
Amounts made available under subsections (a) and (b) shall remain available until expended.
