,,ii  #aacth ,,congress  #b;d ,session  
,s4 #baeh  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,march #bf1    
#bjad ,mr4 ,markey introduced the       
following bill2 which was read twice and
 referred to the ,committee on ,energy  
and ,natural ,resources  ,a ,,bill  ,to 
amend the ,federal ,power ,act to       
protect the bulk-power system and       
electric infrastructure critical to the 
defense of the ,united ,states against  
cybersecurity and physical and other    
threats and vulnerabilities4  #a4       
,short title  ,this ,act may be cited as
 the ,grid ,reliability and             
,infrastructure ,defense ,act or the    
,,grid ,act4  #b4  ,critical electric   
infrastructure security  7a7  ,in       
general  ,part ,,ii of the ,federal     
,power ,act is amended by inserting     
after section #bae 7#af ,u4,s4,c4 #hbdo7
 the following3  #bae;,a4  ,critical    
electric infrastructure security  7a7   
,definitions  ,in this section3  7#a7   
,bulk-power system2 ,electric           

,reliability ,organization2 ,regional   
,entity  ,the terms bulk-power system1  
,electric ,reliability ,organization1   
and regional entity have the meanings   
given those terms in section #bae7;a74  
7#b7  ,defense critical electric        
infrastructure  ,the term defense       
critical electric infrastructure means  
any infrastructure located in the       
,united ,states 7including the          
territories7 used for the generation1   
transmission1 or distribution of        
electric energy that--  7,a7 is not part
 of the bulk-power system2 and  7,b7    
serves a facility designated by the     
,president pursuant to subsection       
7d77#a71 but is not owned or operated by
 the owner or operator of the facility4 
7#c7  ,defense critical electric        
infrastructure vulnerability  ,the term 
defense critical electric infrastructure
 vulnerability means a weakness in      
defense critical electric infrastructure
 that1 in the event of-- 7,a7 a         
malicious act using electronic          

communication or an electromagnetic     
pulse1 would pose a substantial risk of 
disruption of those electronic devices  
or communications networks1 including   
hardware1 software1 and data1 that are  
essential to the reliability of defense 
critical electric infrastructure2 or    
7,b7 a direct physical attack on the    
defense critical electric               
infrastructure1 would pose a substantial
 risk of significant adverse effects on 
the reliability of defense critical     
electric infrastructure4  7#d7          
,electromagnetic pulse  ,the term       
electromagnetic pulse means #a or more  
pulses of electromagnetic energy emitted
 by any device or weapon capable of     
generating a pulse that would pose a    
substantial risk of disruption to the   
operation of those electronic devices or
 communications networks1 including     
hardware1 software1 and data1 that are  
essential to the reliability of systems 
necessary for the generation1           
transmission1 and distribution of       

electric energy4  7#e7  ,geomagnetic    
storm  ,the term geomagnetic storm means
 a temporary disturbance of the magnetic
 field of the ,earth resulting from     
solar activity4  7#f7  ,grid security   
threat  ,the term grid security threat  
means a substantial likelihood of--     
7,a7  7i7 a malicious act using         
electronic communication or an          
electromagnetic pulse1 or a geomagnetic 
storm event1 that could disrupt the     
operation of those electronic devices or
 communications networks1 including     
hardware1 software1 and data1 that are  
essential to the reliability of the     
bulk-power system or of defense critical
 electric infrastructure2 and  7ii7     
disruption of the operation of those    
devices or networks1 with significant   
adverse effects on the reliability of   
the bulk-power system or of defense     
critical electric infrastructure1 as a  
result of the act or event2 or  7,b7    
7i7 a direct physical attack on the     
bulk-power system or on defense critical

 electric infrastructure2 and  7ii7     
significant adverse effects on the      
reliability of the bulk-power system or 
of defense critical electric            
infrastructure as a result of the       
physical attack4  7#g7 ,grid security   
vulnerability ,the term grid security   
vulnerability means a weakness in the   
bulk power system that1 in the event    
of-- 7,a7 a malicious act using         
electronic communication or an          
electromagnetic pulse1 would pose a     
substantial risk of disruption to the   
operation of those electronic devices or
 communications networks1 including     
hardware1 software1 and data1 that are  
essential to the reliability of the     
bulk-power system2 or  7,b7 a direct    
physical attack on the bulk-power       
system1 would pose a substantial risk of
 significant adverse effects on the     
reliability of the bulk-power system4   
7#h7  ,large transformer  ,the term     
large transformer means an electric     
transformer that is part of the         

bulk-power system4  7#i7  ,protected    
information  ,the term protected        
information means information1 other    
than classified national security       
information1 designated as protected    
information by the ,commission under    
subsection 7e77#b7--  7,a7 that was     
developed or submitted in connection    
with the implementation of this section2
  7,b7 that specifically discusses grid 
security threats1 grid security         
vulnerabilities1 defense critical       
electric infrastructure vulnerabilities1
 or plans1 procedures1 or measures to   
address the threats or vulnerabilities2 
and  7,c7 the unauthorized disclosure of
 which could be used in a malicious     
manner to impair the reliability of the 
bulk-power system or of defense critical
 electric infrastructure4  7#aj7        
,secretary  ,the term ,secretary means  
the ,secretary of ,energy4  7#aa7       
,security  ,the term security does not  
have the definition of the term provided
 in section #c4  7b7  ,emergency        

response measures  7#a7  ,authority to  
address grid security threats  7,a7 ,in 
general ,if the ,president issues and   
provides to the ,commission 7either     
directly or through the ,secretary7 a   
written directive or determination      
identifying an imminent grid security   
threat1 the ,commission may1 with or    
without notice1 hearing1 or report1     
issue such orders for emergency measures
 as are necessary in the judgment of the
 ,commission to protect the reliability 
of the bulk-power system or of defense  
critical electric infrastructure against
 the threat4  7,b7 ,rules of procedure  
,as soon as practicable but not later   
than #ahj days after the date of        
enactment of this section1 the          
,commission shall1 after notice and     
opportunity for comment1 establish rules
 of procedure that ensure that the      
authority described in subparagraph 7,a7
 can be exercised expeditiously4  7#b7  
,notification of ,congress  ,if the     
,president issues and provides to the   

,commission 7either directly or through 
the ,secretary7 a written directive or  
determination under paragraph 7#a71 the 
,president 7or the ,secretary1 as the   
case may be7 shall promptly notify      
congressional committees of relevant    
jurisdiction1 including the ,committee  
on ,energy and ,commerce of the ,house  
of ,representatives and the ,committee  
on ,energy and ,natural ,resources of   
the ,senate1 of the contents of1 and    
justification for1 the directive or     
determination4  7#c7  ,consultation     
,before issuing an order for emergency  
measures under paragraph 7#a71 the      
,commission shall1 to the extent        
practicable in light of the nature of   
the grid security threat and the urgency
 of the need for the emergency measures1
 consult with appropriate governmental  
authorities in ,canada and ,mexico1     
entities described in paragraph 7#d71   
the ,secretary1 and other appropriate   
,federal agencies regarding             
implementation of the emergency         

measures4  7#d7  ,application  ,an order
 for emergency measures under this      
subsection may apply to--  7,a7 the     
,electric ,reliability ,organization2   
7,b7 a regional entity2 or  7,c7 any    
owner1 user1 or operator of the         
bulk-power system or of defense critical
 electric infrastructure within the     
,united ,states4  7#e7  ,discontinuance 
,the ,commission shall issue an order   
discontinuing any emergency measures    
ordered under this subsection1 effective
 not later than #cj days after the      
earliest of the following3  7,a7 ,the   
date on which the ,president issues and 
provides to the ,commission 7either     
directly or through the ,secretary7 a   
written directive or determination that 
the grid security threat identified     
under paragraph 7#a7 no longer exists4  
7,b7 ,the date on which the ,commission 
issues a written determination that the 
emergency measures are no longer needed 
to address the grid security threat     
identified under paragraph 7#a71        

including by means of ,commission       
approval of a reliability standard under
 section #bae that the ,commission      
determines adequately addresses the     
threat4  7,c7 ,the date that is #a year 
after the issuance of an order under    
paragraph 7#a74  7#f7  ,cost recovery   
,if the ,commission determines that     
owners1 operators1 or users of the      
bulk-power system or of defense critical
 electric infrastructure have incurred  
substantial costs to comply with an     
order under this subsection and that the
 costs were prudently incurred and      
cannot reasonably be recovered through  
regulated rates or market prices for the
 electric energy or services sold by the
 owners1 operators1 or users1 the       
,commission shall1 after notice and an  
opportunity for comment1 establish a    
mechanism that permits the owners1      
operators1 or users to recover the      
costs4  7c7  ,measures ,to address grid 
security vulnerabilities  7#a7          
,commission authority  7,a7 ,in general 

,if the ,commission1 in consultation    
with appropriate ,federal agencies1     
identifies a grid security vulnerability
 that the ,commission determines has not
 adequately been addressed through a    
reliability standard developed and      
approved under section #bae1 the        
,commission shall1 after notice and     
opportunity for comment and after       
consultation with the ,secretary1 other 
appropriate ,federal agencies1 and      
appropriate governmental authorities in 
,canada and ,mexico1 promulgate a rule  
or issue an order requiring             
implementation1 by any owner1 operator1 
or user of the bulk-power system in the 
,united ,states1 of measures to protect 
the bulk-power system against such      
vulnerability4  7,b7 ,recommendations   
7i7 ,in general ,before promulgating a  
rule or issuing an order under this     
paragraph1 the ,commission shall1 to the
 extent practicable in light of the     
urgency of the need for action to       
address the grid security vulnerability1

 request and consider recommendations   
from the ,electric ,reliability         
,organization regarding the rule or     
order4  7ii7 ,deadline ,the ,commission 
may establish an appropriate deadline   
for the submission of the               
recommendations4  7#b7  ,certain        
existing cybersecurity vulnerabilities  
,not later than #ahj days after the date
 of enactment of this section1 the      
,commission shall1 after notice and     
opportunity for comment and after       
consultation with the ,secretary1 other 
appropriate ,federal agencies1 and      
appropriate governmental authorities in 
,canada and ,mexico1 promulgate a rule  
or issue an order requiring the         
implementation1 by any owner1 user1 or  
operator of the bulk-power system in the
 ,united ,states1 of such measures as   
are necessary to protect the bulk-power 
system against the vulnerabilities      
identified in the communication entitled
 #8,electricity ,sector ,owners and     
,operators'1 dated ,june #ba1 #bjjg1 of 

the ,north ,american ,electric          
,reliability ,corporation1 acting in the
 capacity of the ,corporation as the    
,electricity ,sector ,information and   
,analysis ,center4  7#c7  ,rescission   
7,a7 ,in general ,the ,commission shall 
approve a reliability standard developed
 under section #bae that addresses a    
grid security vulnerability that is the 
subject of a rule or order under        
paragraph 7#a7 or 7#b71 unless the      
,commission determines that the         
reliability standard does not adequately
 protect against the vulnerability or   
otherwise does not satisfy the          
requirements of section #bae4  7,b7     
,rescission ,on such approval1 the      
,commission shall rescind the rule      
promulgated or order issued under       
paragraph 7#a7 or 7#b7 addressing the   
vulnerability1 effective on the         
effective date of the newly approved    
reliability standard4  7#d7  ,large     
transformer availability  7,a7 ,in      
general ,not later than #a year after   

the date of enactment of this section1  
the ,commission shall1 after notice and 
an opportunity for comment and after    
consultation with the ,secretary and    
other appropriate ,federal agencies1    
issue an order directing the ,electric  
,reliability ,organization to submit to 
the ,commission for approval under      
section #bae1 not later than #a year    
after the issuance of the order1        
reliability standards addressing        
availability of large transformers4     
7,b7 ,restoration of bulk-power system  
,the standards shall require entities   
that own or operate large transformers  
to ensure1 individually or jointly1     
adequate availability of large          
transformers to promptly restore the    
reliable operation of the bulk-power    
system in the event that any such       
transformer is destroyed or disabled as 
a result of a reasonably foreseeable    
physical or other attack or geomagnetic 
storm event4  7,c7 ,basis for standards 
,the order of the ,commission shall     

specify the nature and magnitude of the 
reasonably foreseeable attacks or events
 that shall provide the basis for the   
standards4  7,d7 ,standards ,the        
standards shall--  7i7 provide entities 
subject to the standards with the option
 of meeting the standards individually  
or jointly2 and  7ii7 appropriately     
balance the risks associated with a     
reasonably foreseeable attack or event1 
including-- 7,i7 any regional variation 
in the risks2 and  7,,ii7 the costs of  
ensuring adequate availability of spare 
transformers4  7d7  ,critical defense   
facilities  7#a7  ,designation  7,a7 ,in
 general ,not later than #ahj days after
 the date of enactment of this section1 
the ,president shall designate1 in a    
written directive or determination      
provided to the ,commission1 facilities 
located in the ,united ,states          
7including the territories7 that are--  
7i7 critical to the defense of the      
,united ,states2 and  7ii7 vulnerable to
 a disruption of the supply of electric 

energy provided to such facility by an  
external provider4  7,b7 ,maximum number
 ,the number of facilities designated by
 the directive or determination shall   
not exceed #ajj4  7,c7 ,revision ,the   
,president may periodically revise the  
list of designated facilities through a 
subsequent written directive or         
determination provided to the           
,commission1 except that the total      
number of designated facilities at any  
time shall not exceed #ajj4  7#b7       
,commission authority  7,a7 ,in general 
,if the ,commission identifies a defense
 critical electric infrastructure       
vulnerability that the ,commission1 in  
consultation with owners and operators  
of any #a or more facilities designated 
by the ,president pursuant to paragraph 
7#a71 determines has not adequately been
 addressed through measures undertaken  
by owners or operators of defense       
critical electric infrastructure1 the   
,commission shall1 after notice and an  
opportunity for comment and after       

consultation with the ,secretary and    
other appropriate ,federal agencies1    
promulgate a rule or issue an order     
requiring implementation1 by any owner  
or operator of defense critical electric
 infrastructure1 of measures to protect 
the defense critical electric           
infrastructure against the              
vulnerability4  7,b7 ,exemptions  7i7   
,in general ,the ,commission shall      
exempt from any rule or order           
promulgated under subparagraph 7,a7 any 
specific defense critical electric      
infrastructure that the ,commission     
determines already has been adequately  
protected against the identified        
vulnerability4  7ii7 ,consultation ,the 
,commission shall make any determination
 under clause 7i7 in consultation with  
the owner or operator of the facility   
designated by the ,president pursuant to
 paragraph 7#a7 that relies on the      
defense critical electric               
infrastructure4  7#c7  ,cost recovery   
,an owner or operator of defense        

critical electric infrastructure shall  
be required to take measures under      
paragraph 7#b7 only to the extent that  
the owners or operators of #a or more   
facilities designated by the ,president 
pursuant to paragraph 7#a7 that rely on 
the infrastructure agree to bear the    
full incremental costs of compliance    
with a rule promulgated or order issued 
under paragraph 7#b74  7e7  ,protection 
of information  7#a7  ,prohibition of   
public disclosure of protected          
information  ,protected information--   
7,a7 shall be exempt from disclosure    
under section #eeb7;b77#c7 of title #e1 
,united ,states ,code2 and  7,b7 shall  
not be made available pursuant to any   
,state1 local1 or tribal law requiring  
disclosure of information or records4   
7#b7  ,information sharing  7,a7  ,in   
general  ,consistent with the           
,controlled ,unclassified ,information  
framework established by the ,president1
 the ,commission shall promulgate such  
regulations and issue such orders as    

necessary to designate protected        
information and to prohibit the         
unauthorized disclosure of the protected
 information4  7,b7  ,sharing of        
protected information  7i7 ,in general  
,the regulations promulgated and orders 
issued pursuant to subparagraph 7,a7    
shall provide standards for and         
facilitate the appropriate sharing of   
protected information with1 between1 and
 by ,federal1 ,state1 local1 and tribal 
authorities1 the ,electric ,reliability 
,organization1 regional entities1 and   
owners1 operators1 and users of the     
bulk-power system in the ,united ,states
 and of defense critical electric       
infrastructure4  7ii7 ,state commissions
 ,in promulgating the regulations and   
issuing the orders1 the ,commission     
shall take account of the role of ,state
 commissions in reviewing the prudence  
and cost of investments within the      
respective jurisdictions of the ,state  
commissions4  7iii7 ,canada and ,mexico 
,the ,commission shall consult with     

appropriate ,canadian and ,mexican      
authorities to develop protocols for the
 sharing of protected information with1 
between1 and by appropriate ,canadian   
and ,mexican authorities and owners1    
operators1 and users of the bulk-power  
system outside the ,united ,states4     
7#c7  ,submission of information to     
,congress  ,nothing in this section     
permits or authorizes the withholding of
 information from ,congress1 any        
committee or subcommittee of ,congress1 
or the ,comptroller ,general of the     
,united ,states4  7#d7  ,disclosure of  
nonprotected information  7,a7 ,in      
general ,in implementing this section1  
the ,commission shall protect from      
disclosure only the minimum quantity of 
information necessary to protect the    
reliability of the bulk-power system and
 of defense critical electric           
infrastructure4  7,b7 ,segregation of   
protected information ,the ,commission  
shall segregate protected information   
within documents and electronic         

communications1 whenever feasible1 to   
facilitate disclosure of information    
that is not designated as protected     
information4  7#e7  ,duration of        
designation  ,information may not be    
designated as protected information for 
longer than #e years1 unless            
specifically redesignated by the        
,commission4  7#f7  ,removal of         
designation  ,the ,commission may remove
 the designation of protected           
information1 in whole or in part1 from a
 document or electronic communication if
 the unauthorized disclosure of the     
information could no longer be used to  
impair the reliability of the bulk-power
 system or of defense critical electric 
infrastructure4  7#g7  ,judicial review 
of designations  7,a7 ,in general       
,notwithstanding subsection 7f7 or      
section #cac1 a person or entity may    
seek judicial review of a determination 
by the ,commission concerning the       
designation of protected information    
under this subsection exclusively in the

 district court of the ,united ,states  
in the district in which the complainant
 resides1 or has a principal place of   
business1 or in the ,district of        
,columbia4  7,b7 ,procedure ,in a case  
described in subparagraph 7,a71 the     
court-- 7i7 shall determine the matter  
de novo2 and  7ii7 may examine the      
contents of documents or electronic     
communications designated as protected  
information in camera to determine      
whether the documents or any part of the
 documents were improperly designated as
 protected information4  7,c7 ,burden of
 proof ,the burden shall be on the      
,commission to sustain the designation  
of the ,commission4  7f7  ,judicial     
review  7#a7 ,in general ,the           
,commission shall act expeditiously to  
resolve all applications for rehearing  
of orders issued pursuant to this       
section that are filed under section    
#cac7;a74  7#b7 ,jurisdiction ,any party
 seeking judicial review pursuant to    
section #cac of an order issued under   

this section may obtain the review only 
in the ,united ,states ,court of        
,appeals for the ,district of ,columbia 
,circuit4  7g7  ,provision of assistance
 to industry in meeting grid security   
protection needs  7#a7  ,expertise and  
resources  7,a7 ,in general ,the        
,secretary shall establish a program1 in
 consultation with other appropriate    
,federal agencies1 to develop technical 
expertise in the protection of systems  
for the generation1 transmission1 and   
distribution of electric energy against 
geomagnetic storms or malicious acts    
using electronic communications or      
electromagnetic pulse that would pose a 
substantial risk of disruption to the   
operation of those electronic devices or
 communications networks1 including     
hardware1 software1 and data1 that are  
essential to the reliability of the     
systems4  7,b7 ,resources ,the program  
shall include the identification and    
development of appropriate technical and
 electronic resources1 including        

hardware1 software1 and system          
equipment4  7#b7  ,sharing expertise    
7,a7 ,in general ,as appropriate1 the   
,secretary shall offer to share         
technical expertise developed under the 
program under paragraph 7#a71 through   
consultation and assistance1 with       
owners1 operators1 or users of systems  
for the generation1 transmission1 or    
distribution of electric energy located 
in the ,united ,states and with ,state  
commissions4  7,b7 ,priority ,in        
offering the support1 the ,secretary    
shall assign higher priority to systems 
serving facilities designated by the    
,president pursuant to subsection       
7d77#a7 and other                       
critical-infrastructure facilities1     
which the ,secretary shall identify in  
consultation with the ,commission and   
other appropriate ,federal agencies4    
7#c7  ,security clearances and          
communication  7,a7 ,in general ,the    
,secretary shall facilitate and1 to the 
extent practicable1 expedite the        

acquisition of adequate security        
clearances by key personnel of any      
entity subject to the requirements of   
this section to enable optimum          
communication with ,federal agencies    
regarding grid security threats1 grid   
security vulnerabilities1 and defense   
critical electric infrastructure        
vulnerabilities4  7,b7 ,actionable      
information ,the ,secretary1 the        
,commission1 and other appropriate      
,federal agencies shall1 to the extent  
practicable and consistent with their   
obligations to protect classified and   
protected information1 share timely     
actionable information regarding grid   
security threats1 grid security         
vulnerabilities1 and defense critical   
electric infrastructure vulnerabilities 
with appropriate key personnel of       
owners1 operators1 and users of the     
bulk-power system and of defense        
critical electric infrastructure4  7h7  
,certain ,federal entities  ,during the 
#aa-year period beginning on the date of

 enactment of this section1 the         
,tennessee ,valley ,authority and the   
,bonneville ,power ,administration shall
 be exempt from any requirement under   
subsection 7b7 or 7c7 7except for any   
requirement addressing a malicious act  
using electronic communication74  4  7b7
  ,conforming amendments  7#a7          
,jurisdiction  ,section #bja7;b77#b7 of 
the ,federal ,power ,act 7#af ,u4,s4,c4 
#hbd7;b77#b77 is amended by inserting   
#bae;,a1 after #bae1 each place it      
appears4  7#b7  ,public utility         
,section #bja7;e7 of the ,federal ,power
 ,act 7#af ,u4,s4,c4 #hbd7;e77 is       
amended by inserting #bae;,a1 after     
#bae14