ALLcrimesfood&drugstaxestelecomcommercehealthconservationtransportationagricultureveteransbrowse all titles »
0

42 U.S.C. § 18722 — Energy cyber sense program

submitted 5 years ago by Pub. L. 117-58 to r/title-42-THE-PUBLIC-HEALTH-AND-WELFARE · 480 words · no verdicts yet

in plain englishAI-generated · not legal advice

The Secretary of Energy must create a voluntary "Energy Cyber Sense" program to test the cybersecurity of energy sector products. The program tests technologies, tracks vulnerabilities, and helps utilities fix problems. Information collected under the program is protected from public disclosure, and the law does not let anyone sue the government over the testing.

(a) Definitions
"Bulk-power system" has the meaning given in section 824o(a) of title 16. "Program" means the voluntary Energy Cyber Sense program created under this section.

(b) Establishment
The Secretary, working with the Secretary of Homeland Security and consulting other relevant federal agencies, must create a voluntary program called Energy Cyber Sense. It tests the cybersecurity of products and technologies used in the energy sector, including the bulk-power system.

(c) Program requirements
Running the program, the Secretary must:

  1. Set up a way to test the cybersecurity of energy sector products, including industrial control systems and operational technology like supervisory control and data acquisition (SCADA) systems.
  2. Build and maintain a database that reports cybersecurity vulnerabilities found in tested products, connected to other federal vulnerability-reporting systems.
  3. Give technical help to electric utilities, manufacturers, and other energy companies so they can fix vulnerabilities found in testing.
  4. Review tested products for vulnerabilities every two years and study how well they respond to and stop cyber threats.
  5. Write guidance, based on the testing results, to help utilities and other energy companies buy safer products and technologies.
  6. Give the public reasonable notice and ask for comments before starting or changing the testing process.
  7. Oversee how products and technologies are tested.
  8. Consider ways to encourage manufacturers to use the program's analysis and results when designing their products.

(d) Protection of information
If the Secretary reasonably believes that releasing information collected under this section could hurt the physical security or cybersecurity of any part of the energy sector -- including an electric utility or the bulk-power system -- that information:

  1. Is exempt from release under the Freedom of Information Act ("exempt from disclosure under section 552(b)(3) of title 5" -- meaning FOIA does not force it to be released).
  2. Cannot be released by any federal agency, state, political subdivision of a state, or Tribal authority under a public-records law.

(e) Federal Government liability
Nothing in this section lets anyone sue the United States over how a product or technology was tested under the program.

the actual law source: uscode.house.gov ↗public domain
(a) Definitions

In this section:

(1) Bulk-power system

The term “bulk-power system” has the meaning given the term in section 824o(a) of title 16.

(2) Program

The term “program” means the voluntary Energy Cyber Sense program established under subsection (b).

(b) Establishment

The Secretary, in coordination with the Secretary of Homeland Security and in consultation with the heads of other relevant Federal agencies, shall establish a voluntary Energy Cyber Sense program to test the cybersecurity of products and technologies intended for use in the energy sector, including in the bulk-power system.

(c) Program requirements

In carrying out subsection (b), the Secretary, in coordination with the Secretary of Homeland Security and in consultation with the heads of other relevant Federal agencies, shall—

(1)

establish a testing process under the program to test the cybersecurity of products and technologies intended for use in the energy sector, including products relating to industrial control systems and operational technologies, such as supervisory control and data acquisition systems;

(2)

for products and technologies tested under the program, establish and maintain cybersecurity vulnerability reporting processes and a related database that are integrated with Federal vulnerability coordination processes;

(3)

provide technical assistance to electric utilities, product manufacturers, and other energy sector stakeholders to develop solutions to mitigate identified cybersecurity vulnerabilities in products and technologies tested under the program;

(4)

biennially review products and technologies tested under the program for cybersecurity vulnerabilities and provide analysis with respect to how those products and technologies respond to and mitigate cyber threats;

(5)

develop guidance that is informed by analysis and testing results under the program for electric utilities and other components of the energy sector for the procurement of products and technologies;

(6)

provide reasonable notice to, and solicit comments from, the public prior to establishing or revising the testing process under the program;

(7)

oversee the testing of products and technologies under the program; and

(8)

consider incentives to encourage the use of analysis and results of testing under the program in the design of products and technologies for use in the energy sector.

(d) Protection of information

Information provided to, or collected by, the Federal Government pursuant to this section the disclosure of which the Secretary reasonably foresees could be detrimental to the physical security or cybersecurity of any component of the energy sector, including any electric utility or the bulk-power system—

(1)

shall be exempt from disclosure under section 552(b)(3) of title 5; and

(2)

shall not be made available by any Federal agency, State, political subdivision of a State, or Tribal authority pursuant to any Federal, State, political subdivision of a State, or Tribal law, respectively, requiring public disclosure of information or records.

(e) Federal Government liability

Nothing in this section authorizes the commencement of an action against the United States with respect to the testing of a product or technology under the program.

Source credit: (Pub. L. 117–58, div. D, title I, § 40122, Nov. 15, 2021, 135 Stat. 950.)

history & why it existsrecord from the source credit
  • 2021Enacted · Pub. L. 117-58 · 135 Stat. 950

A history note hasn’t been published yet. The record shows enactment by Pub. L. 117-58 on 2021-11-15.

all 0 arguments · sorted by: best

0/280

no arguments yet — make the first case