42 U.S.C. § 18725 — Cybersecurity plan

(a) In general
The Secretary^* may require -- whenever the Secretary decides it is appropriate -- that a recipient of any award or other funding under this division: (1) submit a cybersecurity plan before getting the money, showing how mature the recipient's cybersecurity is for that specific project^*, and (2) set up a plan for maintaining and improving cybersecurity for as long as the funded project runs.

(b) Contents of cybersecurity plan
At minimum, the plan must describe how the recipient will: (1) keep cybersecurity between the networks, systems, devices, applications, and components inside the project, and at the outside connection points where the project meets the outside world; (2) keep evaluating cybersecurity risks throughout the project's life, so new problems get caught as they come up; (3) report any known or suspected break-in of the project's network or systems to the Secretary; and (4) use the Department's cybersecurity programs, including cyber vulnerability testing and security engineering evaluations.

(c) Additional guidance
Recipients should: (1) rely as much as possible on open guidance and standards -- especially the Department's Cybersecurity Capability Maturity Model (or whatever replaces it) and the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity; and (2) document any place they depart from open standards, and explain their use of proprietary standards where they decide that departure is necessary.

(d) Coordination
The Department's Office of Cybersecurity, Energy Security, and Emergency Response must review every cybersecurity plan submitted under subsection (a), to make sure it fits with the Department's research, development, and demonstration programs.

(e) Protection of information
If releasing information collected under this section could reasonably hurt the physical security or cybersecurity of an electric utility or the bulk-power system, that information: (1) is exempt from release under the Freedom of Information Act (section 552(b)(3) of title 5), and (2) cannot be released by any federal agency, state^*, political subdivision of a state, or Tribal authority under a public-records law.