skip to main content
Hide All The Ads With a Yearly Membership Subscribe ▶

H.R. 1148: Critical Electric Infrastructure Cybersecurity Incident Reporting Act

Compare this bill to another bill:

React to this bill with an emoji

(About Ads | Hide These Ads)

The text of the bill below is as of Feb 21, 2023 (Introduced).

I

118th CONGRESS

1st Session

H. R. 1148

IN THE HOUSE OF REPRESENTATIVES

February 21, 2023

introduced the following bill; which was referred to the Committee on Energy and Commerce

A BILL

To direct the Secretary of Energy to promulgate regulations to facilitate the timely submission of notifications regarding cybersecurity incidents and potential cybersecurity incidents with respect to critical electric infrastructure, and for other purposes.

1.

Short title

This Act may be cited as the Critical Electric Infrastructure Cybersecurity Incident Reporting Act.

2.

Cybersecurity incident reporting for critical electric infrastructure

Section 215A of the Federal Power Act (16 U.S.C. 824o–1) is amended—

(1)

in subsection (a)—

(A)

by amending paragraph (1) to read as follows:

(1)

Bulk-power system; cybersecurity incident; electric reliability organization; regional entity

The terms bulk-power system, cybersecurity incident, Electric Reliability Organization, and regional entity have the meanings given such terms in paragraphs (1), (8), (2), and (7) of section 215(a), respectively.

; and

(B)

in paragraph (7)(A)(i), by inserting , including a cybersecurity incident, after a malicious act;

(2)

by redesignating subsections (e) and (f) as subsections (f) and (g), respectively; and

(3)

by inserting after subsection (d) the following:

(e)

Cybersecurity incident reporting

(1)

Designation

The Department of Energy shall be a designated agency within the Federal Government to receive notifications regarding cybersecurity incidents and potential cybersecurity incidents with respect to critical electric infrastructure from other Federal agencies and owners, operators, and users of critical electric infrastructure.

(2)

Regulations

(A)

In general

Not later than 240 days after the date of enactment of the Critical Electric Infrastructure Cybersecurity Incident Reporting Act, the Secretary shall promulgate regulations to facilitate the submission of timely, secure, and confidential notifications regarding cybersecurity incidents and potential cybersecurity incidents with respect to critical electric infrastructure from Federal agencies and owners, operators, and users of critical electric infrastructure.

(B)

Inclusions

The regulations promulgated under subparagraph (A) shall—

(i)

detail what constitutes a potential cybersecurity incident for purposes of this subsection; and

(ii)

require a Federal agency or an owner, operator, or user of critical electric infrastructure that discovers a cybersecurity incident or a potential cybersecurity incident with respect to critical electric infrastructure to submit to the Secretary, not later than 24 hours after discovery of such cybersecurity incident or potential cybersecurity incident, notification regarding such cybersecurity incident or potential cybersecurity incident.

(3)

Annual reports

Not later than one year after the date of enactment of the Critical Electric Infrastructure Cybersecurity Incident Reporting Act, and annually thereafter, the Secretary shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Energy and Natural Resources of the Senate a report, in classified form if necessary, on the number of notifications received pursuant to this subsection, and a description of the actions taken by the Department of Energy regarding such notifications, during the 1-year period preceding the report.

.