42 U.S.C. § 18721 — Enhancing grid security through public-private partnerships
submitted 5 years ago by Pub. L. 117-58 to r/title-42-THE-PUBLIC-HEALTH-AND-WELFARE · 612 words · no verdicts yet
This section creates a Department of Energy program to boost electric utility physical security and cybersecurity. It builds assessment tools, training, and technical help, prioritizing smaller and under-resourced utilities. It also shields sensitive security information from public disclosure.
(a) Definitions. (1) "Bulk-power system" and "Electric Reliability Organization" have the meanings given in a separate law (section 824o(a) of title 16); this section does not redefine them. (2) "Electric utility" and "State* regulatory authority" have the meanings given in another separate law (section 796 of title 16).
(b) Program to promote and advance physical security and cybersecurity of electric utilities. (1) Establishment: working with the Secretary* of Homeland Security and, as appropriate, other federal agencies, State regulatory authorities, industry stakeholders, and the Electric Reliability Organization, the Secretary must run a program to (A) develop, and offer for voluntary use, maturity models, self-assessments, and auditing methods for judging utilities' physical security and cybersecurity; (B) help with threat assessment and cybersecurity training for utilities; (C) give technical assistance to utilities taking part; (D) train utilities to address and reduce cybersecurity supply-chain risks; (E) work with utilities to improve the cybersecurity of third-party vendors that make grid components; (F) increase opportunities to share best practices* and collect data across the electric sector; and (G) for utilities that own "defense critical electric infrastructure," help with full engineering reviews of critical functions at both the utility and defense-infrastructure levels, to (i) find unprotected paths for cyber-sabotage that could seriously harm national security, and (ii) recommend and put in place engineering protections so critical functions keep running even under constant cyberattack by sophisticated adversaries who have gained perimeter access. (2) Scope: in running the program, the Secretary must (A) consider the different sizes of electric utilities and the regions they serve, (B) prioritize utilities with fewer resources because of their size or region, and (C) as much as practical, use and build on existing Department, Department of Homeland Security, and other relevant federal agency programs.
(c) Report on cybersecurity of distribution systems. Within 1 year of November 15, 2021, working with the Secretary of Homeland Security and, as appropriate, other federal agencies, State regulatory authorities, and industry stakeholders, the Secretary must report to Congress assessing (1) priorities, policies, procedures, and actions for improving the physical security and cybersecurity of electricity distribution systems — including behind-the-meter generation, storage, and load-management devices — to address their threats and vulnerabilities, and (2) how to put those priorities into action, including (A) an estimate of the potential costs and benefits, and (B) an assessment of possible public-private cost-sharing* opportunities.
(d) Protection of information. Information given to, or collected by, the federal government under this section that the Secretary reasonably believes could harm a utility's or the bulk-power system's physical security or cybersecurity if disclosed: (1) is exempt from disclosure under a named Freedom of Information Act provision; and (2) cannot be released by any federal agency, State, political subdivision of a State, or Tribal authority under any federal, State, subdivision, or Tribal law that would otherwise require public disclosure.
In this section:
The terms “bulk-power system” and “Electric Reliability Organization” has the meaning given the terms in section 824o(a) of title 16.
The terms “electric utility” and “State regulatory authority” have the meanings given the terms in section 796 of title 16.
The Secretary*, in coordination with the Secretary of Homeland Security and in consultation with, as the Secretary determines to be appropriate, the heads of other relevant Federal agencies, State regulatory authorities, industry stakeholders, and the Electric Reliability Organization, shall carry out a program—
to develop, and provide for voluntary implementation of, maturity models, self-assessments, and auditing methods for assessing the physical security and cybersecurity of electric utilities;
to assist with threat assessment and cybersecurity training for electric utilities;
to provide technical assistance for electric utilities subject to the program;
to provide training to electric utilities to address and mitigate cybersecurity supply chain management risks;
to advance, in partnership with electric utilities, the cybersecurity of third-party vendors that manufacture components of the electric grid;
to increase opportunities for sharing best practices* and data collection within the electric sector; and
to assist, in the case of electric utilities that own defense critical electric infrastructure (as defined in section 824o–1(a) of title 16), with full engineering reviews of critical functions and operations at both the utility and defense infrastructure levels—
to identify unprotected avenues for cyber-enabled sabotage that would have catastrophic effects to national security; and
to recommend and implement engineering protections to ensure continued operations of identified critical functions even in the face of constant cyber attacks and achieved perimeter access by sophisticated adversaries.
In carrying out the program under paragraph (1), the Secretary shall—
take into consideration—
the different sizes of electric utilities; and
the regions that electric utilities serve;
prioritize electric utilities with fewer available resources due to size or region; and
to the maximum extent practicable, use and leverage—
existing Department and Department of Homeland Security programs; and
existing programs of the Federal agencies determined to be appropriate under paragraph (1).
Not later than 1 year after November 15, 2021, the Secretary, in coordination with the Secretary of Homeland Security and in consultation with, as the Secretary determines to be appropriate, the heads of other Federal agencies, State regulatory authorities, and industry stakeholders, shall submit to Congress a report that assesses—
priorities, policies, procedures, and actions for enhancing the physical security and cybersecurity of electricity distribution systems, including behind-the-meter generation, storage, and load management devices, to address threats to, and vulnerabilities of, electricity distribution systems; and
the implementation of the priorities, policies, procedures, and actions assessed under paragraph (1), including—
an estimate of potential costs and benefits of the implementation; and
an assessment of any public-private cost-sharing* opportunities.
Information provided to, or collected by, the Federal Government pursuant to this section the disclosure of which the Secretary reasonably foresees could be detrimental to the physical security or cybersecurity of any electric utility or the bulk-power system—
shall be exempt from disclosure under section 552(b)(3) of title 5; and
shall not be made available by any Federal agency, State, political subdivision of a State, or Tribal authority pursuant to any Federal, State, political subdivision of a State, or Tribal law, respectively, requiring public disclosure of information or records.
Source credit: (Pub. L. 117–58, div. D, title I, § 40121, Nov. 15, 2021, 135 Stat. 949.)
- 2021Enacted · Pub. L. 117-58 · 135 Stat. 949
A history note hasn’t been published yet. The record shows enactment by Pub. L. 117-58 on 2021-11-15.
all 0 arguments · sorted by: best
no arguments yet — make the first case