42 U.S.C. § 18724 — Enhanced grid security
submitted 5 years ago by Pub. L. 117-58 to r/title-42-THE-PUBLIC-HEALTH-AND-WELFARE · 706 words · no verdicts yet
The Department of Energy must run research programs to strengthen cybersecurity and physical security across the energy grid. It may also help utilities respond to cyberattacks and model risks to electric, gas, and oil networks. Congress may spend up to $350 million total on these programs from 2022 through 2026.
(a) Definitions
"Electric utility" has the meaning given in section 796 of title 16. "E-ISAC" means the Electricity Information Sharing and Analysis Center.
(b) Cybersecurity for the energy sector research, development, and demonstration program
The Secretary*, working with the Secretary of Homeland Security and consulting other federal agencies, states, Indian Tribes, and other stakeholders as needed, must develop and run a program that must:
- Develop advanced cybersecurity technology for the energy sector. This includes finding and fixing vulnerabilities -- such as the sector's dependence on other critical infrastructure, impacts from weather and fuel-supply problems, growing reliance on inverter-based technology, and risks from unpatched hardware and software. It also includes making field devices and outside companies' control systems more secure, covering systems for generating, moving, and using power and running markets; grid elements like advanced metering, demand response, distribution, generation, and storage; forensic study of infected systems; secure communications; and security tools placed at the network's edge.
- Use electric grid architecture to judge risks to the energy sector, taking an all-hazards approach that looks at communications infrastructure, control systems, and power systems.
- Run pilot demonstration projects with the energy sector to test new technologies.
- Build training programs to grow the energy-sector cybersecurity workforce.
- Develop better supply-chain concepts for securely designing new digital components and power electronics.
Congress may give the Secretary $250,000,000 to run this program for fiscal years 2022 through 2026.
(c) Energy sector operational support for cyberresilience program
The Secretary may develop and run a program to: strengthen and regularly test the Department's emergency response abilities and how well it coordinates with other agencies, the National Laboratories, and private industry; increase how much the Department works with the intelligence community to gather and analyze energy-sector threats; improve the Department's and E-ISAC's tools for tracking the state* of the energy sector; get more industry members participating in E-ISAC; and give technical help to small electric utilities to assess and raise their cybersecurity maturity and close gaps found in that assessment.
Congress may give the Secretary $50,000,000 to run this program for fiscal years 2022 through 2026.
(d) Modeling and assessing energy infrastructure risk
The Secretary, with the Secretary of Homeland Security, must develop and run an advanced energy security program to secure electric networks, natural gas networks, and oil exploration, transmission, and delivery networks.
The goal is to keep electric grid, natural gas, and oil operations running through natural and human-made threats, including electromagnetic pulses and geomagnetic disturbances.
To do this, the Secretary may: identify vulnerabilities and critical components whose loss would create major risks; provide national-level modeling to predict the impact of events; add physical security to the cybersecurity maturity model; run exercises and assessments that find grid vulnerabilities and recommend fixes; research ways to harden critical grid components; research ways to mitigate damage to, and recover, critical components; and give states and other entities technical help with standards and risk analysis. This subsection creates no new regulatory requirements.
Congress may give the Secretary $50,000,000 to run this program for fiscal years 2022 through 2026.
In this section:
The term “electric utility” has the meaning given the term in section 796 of title 16.
The term “E-ISAC” means the Electricity Information Sharing and Analysis Center.
The Secretary*, in coordination with the Secretary of Homeland Security and in consultation with, as determined appropriate, other Federal agencies, the energy sector, the States, Indian Tribes, Tribal organizations, territories or freely associated states, and other stakeholders, shall develop and carry out a program—
to develop advanced cybersecurity applications and technologies for the energy sector—
to identify and mitigate vulnerabilities, including—
dependencies on other critical infrastructure;
impacts from weather and fuel supply;
increased dependence on inverter-based technologies; and
vulnerabilities from unpatched hardware and software systems; and
to advance the security of field devices and third-party control systems, including—
systems for generation, transmission, distribution, end use, and market functions;
specific electric grid elements including advanced metering, demand response, distribution, generation, and electricity storage;
forensic analysis of infected systems;
secure communications; and
application of in-line edge security solutions;
to leverage electric grid architecture as a means to assess risks to the energy sector, including by implementing an all-hazards approach to communications infrastructure, control systems architecture, and power systems architecture;
to perform pilot demonstration projects with the energy sector to gain experience with new technologies;
to develop workforce development curricula for energy sector-related cybersecurity; and
to develop improved supply chain concepts for secure design of emerging digital components and power electronics.
There is authorized to be appropriated to the Secretary to carry out this subsection $250,000,000 for the period of fiscal years 2022 through 2026.
The Secretary may develop and carry out a program—
to enhance and periodically test—
the emergency response capabilities of the Department; and
the coordination of the Department with other agencies, the National Laboratories, and private industry;
to expand cooperation of the Department with the intelligence community for energy sector-related threat collection and analysis;
to enhance the tools of the Department and E-ISAC for monitoring the status of the energy sector;
to expand industry participation in E-ISAC; and
to provide technical assistance to small electric utilities for purposes of assessing and improving cybermaturity levels and addressing gaps identified in the assessment.
There is authorized to be appropriated to the Secretary to carry out this subsection $50,000,000 for the period of fiscal years 2022 through 2026.
The Secretary, in coordination with the Secretary of Homeland Security, shall develop and carry out an advanced energy security program to secure energy networks, including—
electric networks;
natural gas networks; and
oil exploration, transmission, and delivery networks.
The objective of the program developed under paragraph (1) is to increase the functional preservation of electric grid operations or natural gas and oil operations in the face of natural and human-made threats and hazards, including electric magnetic pulse and geomagnetic disturbances.
In carrying out the program developed under paragraph (1), the Secretary may—
develop capabilities to identify vulnerabilities and critical components that pose major risks to grid security if destroyed or impaired;
provide modeling at the national level to predict impacts from natural or human-made events;
add physical security to the cybersecurity maturity model;
conduct exercises and assessments to identify and mitigate vulnerabilities to the electric grid, including providing mitigation recommendations;
conduct research on hardening solutions for critical components of the electric grid;
conduct research on mitigation and recovery solutions for critical components of the electric grid; and
provide technical assistance to States and other entities for standards and risk analysis.
Nothing in this section authorizes new regulatory requirements.
There is authorized to be appropriated to the Secretary to carry out this subsection $50,000,000 for the period of fiscal years 2022 through 2026.
Source credit: (Pub. L. 117–58, div. D, title I, § 40125, Nov. 15, 2021, 135 Stat. 954.)
- 2021Enacted · Pub. L. 117-58 · 135 Stat. 954
A history note hasn’t been published yet. The record shows enactment by Pub. L. 117-58 on 2021-11-15.
all 0 arguments · sorted by: best
no arguments yet — make the first case