,i  #aae? ,,congress  #a/ ,session  ,h4 
,r4 #dabj  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,octob] #be1 #bjag,mr4
 ,b]a 7= himself1 ,ms4 ,eddie ,b]nice   
,johnson ( ,texas1 ,mr4 ,lip9ski1 ,ms4  
,bonamici1 & ,ms4 ,ros57 introduc$ !    
foll[+ bill2 :i* 0 ref]r$ to !          
,committee on ,sci5ce1 ,space1 &        
,te*nology1 & 9 addition to !           
,committees on ,homel& ,security1 &     
,en]gy & ,comm]ce1 = a p]iod to be      
subsequ5tly det]m9$ by ! ,speak]1 9 ea* 
case = consid]ation ( su* provisions z  
fall )9 ! jurisdiction ( ! committee    
conc]n$  ,a ,,bill  ,to provide = a     
compreh5sive int]discipl9>y rese>* &    
developm5t initiative to /r5g!n !       
capacity ( ! electricity sector to      
neutralize cyb] attacks4  #a4 ,%ort     
title ,?is ,act may be cit$ z ! ,grid   
,cyb]security ,rese>* & ,developm5t     
,act4  #b4 ,f9d+s ,congress f9ds !      
foll[+3  7#a7 ,! ,nation1 & e o!r       
critical infra/ructure sector1 dep5ds on
 reliable electricity4  7#b7 ,indu/rial 

control sy/ems us$ 9 ! electricity      
sector are ess5tial to ma9ta9 reliable  
op]ations ( ! electric grid4  7#c7 ,!   
cyb]security ?reat l&scape is con/antly 
*ang+ & attack] capabilities are advanc+
 rapidly1 requir+ ongo+ modifications1  
advancem5ts1 & inve/m5ts 9 te*nologies &
 proc$ures to ma9ta9 security4  7#d7    
,!re are sub/antial & important         
diff]5ces betwe5 cyb]security approa*es 
ne$$ to protect in=mation te*nology     
sy/ems & indu/rial control sy/ems4  7#e7
 ,x is 9 ! national int]e/ = ,f$]al     
ag5cies to inve/ 9 indu/rial control    
sy/em cyb]security rese>* t facilitates 
private sector inve/m5t & ! ability ( ! 
private sector to develop cyb]security  
tools & products = control sy/ems4  7#f7
 ,! numb] ( elem5ts connect+ to !       
electric grid is increas+1 & design+    
cyb]security into communication1 data1 &
 control sy/ems :5 !y are built is m    
effective ?an modify+ products aft]     
in/allation to meet cyb]security goals4 
7#g7 ,an und]/&+ ( human factors c be   

lev]ag$ to und]/& ! behavior ( cyb]     
?reat actors1 develop /rategies to c\nt]
 ?reat actors1 improve indu/rial control
 sy/em cyb]security tra9+ programs1     
optimize ! design ( human-ma*9e         
int]faces & cyb]security tools1 &       
increase ! capacity ( ! electrical      
sector work=ce to prev5t attacks f ga9+ 
entry to indu/rial control sy/ems4  #c4 
,def9itions ,9 ?is ,act3 7#a7 ,critical 
electric infra/ructure in=mation ,! t]m 
critical electric infra/ructure         
in=mation has ! mean+ giv5 t t]m 9      
section #bae;,a7a77#c7 ( ! ,f$]al ,p[]  
,act 7#af ,u4,s4,c4 #hbd;a-#a7;a77#c774 
7#b7 ,cyb]security ,! t]m cyb]security  
means a set ( prev5tative measures to   
protect in=mation f a digital device or 
sy/em1 includ+ a device or sy/em us$ to 
manage ! electric grid1 f be+ /ol51     
compromis$1 or us$ to c>ry out an       
attack4  7#c7 ,electricity ,subsector   
,coord9at+ ,c\ncil ,! t]m ,electricity  
,subsector ,coord9at+ ,c\ncil means !   
self-organiz$1 self-gov]n$ c\ncil       

consi/+ ( s5ior indu/ry repres5tatives  
to s]ve z ! pr9cipal liaison betwe5 !   
,f$]al ,gov]nm5t & ! electric p[] sector
 & to c>ry out ! role ( ! ,sector       
,coord9at+ ,c\ncil z e/abli%$ 9 !       
,national ,infra/ructure ,protection    
,plan = ! electricity subsector4  7#d7  
,en]gy ,sector ,gov]nm5t ,coord9at+     
,c\ncil ,! t]m ,en]gy ,sector ,gov]nm5t 
,coord9at+ ,c\ncil means ! c\ncil       
consi/+ ( repres5tatives f relevant     
,f$]al ,gov]nm5t ag5cies to provide     
effective coord9ation ( en]gy sector    
ef=ts to ensure a secure1 reliable1 &   
resili5t en]gy infra/ructure & to c>ry  
out ! role ( ! ,gov]nm5t ,coord9at+     
,c\ncil z e/abli%$ 9 ! ,national        
,infra/ructure ,protection ,plan = !    
en]gy sector4  7#e7 ,human factors      
rese>* ,! t]m human factors rese>* means
 rese>* on human p]=mance 9 social &    
physical environm5ts1 & on ! integration
 ( humans ) physical sy/ems & comput]   
h>dw>e & s(tw>e4  7#f7 ,human-ma*9e     
int]faces ,! t]m human-ma*9e int]faces  

means te*nologies t pres5t in=mation to 
an op]ator ab\t ! /ate ( a process or   
sy/em1 or accept human in/ructions to   
implem5t an action1 includ+             
visualization displays su* z a graphical
 us] int]face4  7#g7 ,secret>y ,! t]m   
,secret>y means ! ,secret>y ( ,en]gy4   
7#h7 ,transi5t devices ,! t]m transi5t  
devices means removable m$ia1 includ+   
floppy disks1 compact disks1 ,,usb fla% 
drives1 ext]nal h>d drives1 mobile      
devices1 & o!r devices t utilize        
wireless connections = limit$ p]iods (  
"t4  #d4 ,electricity sector            
cyb]security rese>*1 developm5t1 &      
demon/ration program  7a7 ,9 g5]al ,!   
,secret>y1 9 coord9ation ) appropriate  
,f$]al ag5cies1 ! ,electricity          
,subsector ,coord9at+ ,c\ncil1 ,/ate1   
tribal1 local1 & t]ritorial gov]nm5ts1  
private sector v5dors1 & o!r relevant   
/akehold]s1 %all c>ry out a rese>*1     
developm5t1 & demon/ration initiative to
 h>d5 & mitigate ! electric grid f !    
consequ5ces ( cyb] attacks by increas+ !

 cyb]security capabilities ( !          
electricity sector & accel]at+ !        
developm5t ( cyb]security te*nologies & 
tools4  7b7 ,dep>tm5t ( ,en]gy ,z "p ( !
 initiative describ$ 9 subsection 7a71 !
 ,secret>y %all c>ry out activities to--
 7#a7 id5tify cyb]security risks to !   
communication & control sy/ems )91 &    
impact+1 ! electricity sector2  7#b7    
develop me?ods & tools to rapidly detect
 cyb] intrud]s & cyb] incid5ts1 includ+ 
! use ( data analytics te*niques to     
validate & v]ify sy/em behavior us+     
multiple data /reams reflect+ ! /ate ( !
 sy/em2  7#c7 assess em]g+ en]gy        
te*nology cyb]security capabilities1 &  
integrate cyb]security features &       
protocols into ! design1 developm5t1 &  
deploym5t ( em]g+ te*nologies1 includ+  
r5ewable en]gy te*nologies2  7#d7       
develop secure indu/rial control sy/em  
protocols & id5tify vuln]abilities 9    
exi/+ protocols2  7#e7 "w ) manufactur]s
 to build or retr(it security features &
 protocols into-- 7,a7 communication &  

network sy/ems & managem5t processes2   
7,b7 indu/rial control & en]gy managem5t
 sy/em devices1 compon5ts1 s(tw>e1      
firmw>e1 & h>dw>e1 includ+ di/ribut$    
control & managem5t sy/ems & build+     
managem5t sy/ems2  7,c7 data /orage     
sy/ems & data managem5t & analysis      
processes2  7,d7 g5]ation1 transmission1
 di/ribution1 & en]gy /orage            
te*nologies2  7,e7 automat$ & manually  
controll$ devices & equipm5t = monitor+ 
or manag+ frequ5cy1 voltage1 & curr5t2  
7,f7 te*nologies us$ to syn*ronize "t & 
develop guidance = op]ational cont+5cy  
plans :5 "t syn*ronization te*nologies  
are compromis$2  7,g7 end us] elem5ts t 
connect to ! grid1 includ+-- 7i7 met]s1 
syn*rophasors1 & o!r s5sors2  7ii7      
di/ribution automation te*nologies1 sm>t
 inv]t]s1 & o!r grid control            
te*nologies2  7iii7 di/ribut$ g5]ation &
 en]gy /orage te*nologies2  7iv7 dem&   
response te*nologies2  7v7 home & build+
 en]gy control sy/ems2  7vi7 electric & 
plug-9 hybrid vehicles2 &  7vii7 o!r    

relevant devices1 s(tw>e1 firmw>e1      
h>dw>e1 & di/ribut$ en]gy te*nologies2 &
  7,h7 ! supply *a9 ( electric grid     
managem5t sy/em compon5ts2  7#f7 improve
 ! physical security ( communication    
te*nologies & indu/rial control sy/ems1 
includ+ remote assets2  7#g7 integrate  
human factors rese>* into ! design &    
developm5t ( advanc$ tools & processes =
 dynamic monitor+1 detection1           
protection1 mitigation1 & response2     
7#h7 advance ! capabilities & use (     
relevant int]discipl9>y ma!matical &    
comput] simulation model+ & analysis    
me?ods2  7#i7 evaluate & und]/& !       
pot5tial consequ5ces ( practices us$ to 
ma9ta9 ! cyb]security ( in=mation       
te*nology sy/ems on ! cyb]security (    
indu/rial control sy/ems2  7#aj7        
increase access to & ! capabilities (   
exi/+ cyb]security te/ b$s to simulate  
impacts ( cyb] attacks on indu/rial     
control sy/em devices1 compon5ts1       
s(tw>e1 & h>dw>e2 &  7#aa7 r$uce ! co/ (
 implem5t+ effective cyb]security       

te*nologies & tools 9 ! electricity     
sector4  7c7 ,national ,sci5ce          
,f\ndation ,! ,national ,sci5ce         
,f\ndation %all-- 7#a7 support          
fundam5tal rese>* to advance            
cyb]security applications1 te*nologies1 
& tools = indu/rial control sy/ems1     
includ+ incorporat+ int]discipl9>y      
rese>* 9--  7,a7 evolution>y sy/ems1    
!ories1 ma!matics1 & models2  7,b7      
economic & f9ancial !ories1 ma!matics1 &
 models2 &  7,c7 big data analytical    
me?ods1 ma!matics1 comput] cod+1 &      
algori?ms2 &  7#b7 support education &  
tra9+ = ! indu/rial control sy/em       
cyb]security work=ce1 includ+ ?r\gh !   
,advanc$ ,te*nological ,education       
program1 graduate rese>* fell[%ips1 &   
o!r appropriate programs4  7d7 ,dep>tm5t
 ( ,homel& ,security ,sci5ce &          
,te*nology ,directorate ,! ,sci5ce &    
,te*nology ,directorate ( ! ,dep>tm5t ( 
,homel& ,security1 9 collaboration ) !  
,dep>tm5t ( ,en]gy1 exp]ts 9 ! private  
sector ) ! necess>y cle>ances1 & o!r    

relevant /akehold]s1 %all assess exi/+  
cyb]security te*nologies & tools us$ 9 !
 def5se indu/ry &--  7#a7 id5tify       
te*nologies & tools t c\ld be appli$ to 
meet+ evolv+ civilian en]gy sector      
cyb]security ne$s2  7#b7 develop a      
rese>* /rategy t incorporates human     
factors rese>* f9d+s to guide !         
modification ( def5se indu/ry           
cyb]security tools = use 9 ! civilian   
sector2  7#c7 develop a /rategy to      
accel]ate ef=ts to br+ modifi$ def5se   
indu/ry cyb]security tools to ! civilian
 m>ket2 &  7#d7 c>ry out o!r activities 
! ,secret>y ( ,homel& ,security consid]s
 appropriate to meet ! goals ( ?is      
subsection4  #e4 ,te*nical /&>ds &      
guidance docum5ts = electricity sector  
cyb]security rese>*  7a7 ,9 g5]al ,!    
,secret>y1 9 coord9ation ) appropriate  
,f$]al ag5cies1 ! ,electricity          
,subsector ,coord9at+ ,c\ncil1 /&>ds    
developm5t organizations1 ,/ate1 tribal1
 local1 & t]ritorial gov]nm5ts1 private 
sector v5dors1 & o!r relevant           

/akehold]s1 %all coord9ate ! developm5t 
( guidance docum5ts = rese>* &          
demon/ration activities to improve !    
cyb]security capabilities ( !           
electricity sector ?r\gh p>ticipat+     
ag5cies4 ,z "p ( ^! activities1 !       
,secret>y %all--  7#a7 facilitate       
/akehold] involvem5t to update-- 7,a7 ! 
,roadmap to ,a*ieve ,en]gy ,deliv]y     
,sy/ems ,cyb]security 7publi%$ 9        
,septemb] #bjaa72  7,b7 ! ,cyb]security 
,procurem5t ,language = ,en]gy ,deliv]y 
,sy/ems 7publi%$ by ! ,en]gy ,sector    
,control ,sy/ems ,work+ ,gr\p 9 ,april  
#bjad71 includ+ develop+ guidance =--   
7i7 contract+ ) ?ird p>ties to conduct  
vuln]ability te/+ = indu/rial control   
sy/ems2  7ii7 contract+ ) ?ird p>ties t 
w utilize transi5t devices to access    
indu/rial control or in=mation te*nology
 sy/ems2 &  7iii7 manag+ supply *a9     
risks2 &  7,c7 ! ,electricity ,subsector
 ,cyb]security ,capability ,maturity    
,model 7publi%$ by ! ,dep>tm5t ( ,en]gy 
9 ,febru>y #bjad71 includ+ ! developm5t 

(--  7i7 metrics to measure *anges 9    
cyb]security capabilities & assess !    
pot5tial = metrics to drive unexpect$   
behavioral *anges t w\ld r$uce security2
 &  7ii7 an analysis ( inc5tive         
me*anisms & _! pot5tial to increase     
inve/m5ts 9 cyb]security2  7#b7 develop 
volunt>y guidance to improve =5sic      
analyses capabilities1 includ+--  7,a7  
develop+ /&>diz$ t]m9ology & monitor+   
processes2  7,b7 id5tify+ m9imum data   
ne$$2 &  7,c7 utiliz+ human factors     
rese>* to develop m effective proc$ures 
= logg+ incid5t ev5ts2 &  7#c7 "w ) !   
,national ,sci5ce ,f\ndation1 ,dep>tm5t 
( ,homel& ,security1 ,national ,in/itute
 ( ,/&>ds & ,te*nology1 & /akehold]s to 
develop a me*anism to anonymize1        
aggregate1 & %>e ! te/+ results f       
cyb]security indu/rial control sy/em te/
 b$s to facilitate te*nology improvem5ts
 by public & private sector rese>*]s4   
7b7 ,critical electric infra/ructure    
in=mation ,in=mation provid$ to ,f$]al  
ag5cies = ! purposes ( c>ry+ out        

subsection 7a7 %all be consid]$ critical
 electric infra/ructure in=mation &     
provid$ ! protections e/abli%$ 9 section
 #aj4  7c7 ,/&>ds ,! ,secret>y1 9       
collaboration ) ! ,director ( !         
,national ,in/itute ( ,/&>ds &          
,te*nology & o!r appropriate ,f$]al     
ag5cies1 %all conv5e relevant /akehold]s
 & facilitate ! developm5t (--  7#a7    
volunt>y1 cons5sus-bas$ te*nical /&>ds  
to improve cyb]security =-- 7,a7 em]g+  
en]gy te*nologies2  7,b7 di/ribut$      
g5]ation & /orage te*nologies1 & o!r    
di/ribut$ en]gy res\rces2  7,c7 electric
 vehicles2 &  7,d7 o!r te*nologies &    
devices t connect to ! electric grid t c
 affect voltage /ability2  7#b7         
recomm5d$ cyb]security features &       
requirem5ts t c be us$ by ! private     
sector to design & build int]op]able    
cyb]security features into--  7,a7      
devices & compon5ts2  7,b7 s(tw>e &     
h>dw>e2 &  7,c7 o!r te*nologies t       
connect to ! electric grid2 &  7#c7     
volunt>y /&>ds = te/ b$s & te/ b$       

me?odologies t w enable reproducible    
te/+ ( indu/rial control sy/em devices1 
compon5ts1 s(tw>e1 & h>dw>e across te/  
b$s4  7d7 ,regulatory au?ority          
,subsection 7c7 %all n be con/ru$ to    
au?orize regulatory actions t w\ld      
duplicate or conflict ) regulatory      
requirem5ts1 m&atory /&>ds1 or relat$   
processes "u any o!r provision ( ,f$]al 
law4  #f4 ,vuln]ability te/+ & te*nical 
assi/ance to increase cyb]resili5ce  7a7
 ,9 g5]al ,! ,secret>y %all-- 7#a7      
collaborate ) electricity sector asset  
own]s & op]ators 9 ! private sector1    
lev]ag+ ! rese>* facilities & exp]tise (
 ! ,national ,laboratories1 to--  7,a7  
utilize a range ( me?ods1 includ+       
volunt>y vuln]ability te/+ & r$         
team-blue team ex]cises1 to id5tify     
vuln]abilities 9 physical & cyb] sy/ems2
  7,b7 develop cyb]security risk        
assessm5t tools & provide confid5tial   
analyses & recomm5dations to p>ticipat+ 
/akehold]s2  7,c7 "w ) /akehold]s to    
develop me?ods to %>e anonymiz$ &       

aggregat$ results 9 a =mat t enables !  
electricity sector1 rese>*]s1 & !       
private sector to advance cyb]security  
ef=ts1 te*nologies1 & tools2 &  7,d7    
lev]age ! unique /r5g?s & exp]tise ( !  
,national ,laboratories & ,f$]al        
ag5cies2  7#b7 collaborate ) relevant   
/akehold]s to--  7,a7 id5tify in=mation1
 rese>*1 /aff tra9+1 & analysis tools   
ne$$ to evaluate indu/rial control sy/em
 cyb]security issues & *all5ges 9 !     
electricity sector2 &  7,b7 facilitate !
 %>+ ( in=mation & ! developm5t ( tools 
id5tifi$ "u subp>agraph 7,a72  7#c7     
collaborate ) & support electricity     
sector trade organizations & _! rese>*  
ag5cies to improve ! cyb]security (     
indu/rial control sy/ems us$ by memb]s &
 /akehold]s2 &  7#d7 collaborate )      
tribal gov]nm5ts to-- 7,a7 id5tify      
in=mation1 rese>*1 & analysis tools ne$$
 by tribal gov]nm5ts to increase !      
indu/rial control sy/em cyb]security (  
electricity assets )9 _! jurisdiction2 &
  7,b7 facilitate ! %>+ ( in=mation & ! 

developm5t ( tools ne$$ to ensure !     
cyb]security ( tribal electricity assets
 & sy/ems4  7b7 ,critical electric      
infra/ructure in=mation ,in=mation      
provid$ to ,f$]al ag5cies = ! purposes (
 c>ry+ out subsection 7a77#a77;,c7 %all 
be consid]$ critical electric           
infra/ructure in=mation & provid$ !     
protections e/abli%$ 9 section #aj4  #g4
 ,education & work=ce tra9+ rese>* &    
/&>ds  7a7 ,dep>tm5t ( ,en]gy ,!        
,secret>y %all-- 7#a7 utilize human     
factors rese>* & o!r me?ods to id5tify  
core skills us$ by electricity sector   
indu/rial control sy/ems cyb]security   
pr(essionals2 &  7#b7 develop assessm5t 
me?ods & tools to id5tify exi/+ p]sonnel
 t %[ compet5ce 9 ! core skills id5tifi$
 "u p>agraph 7#a74  7b7 ,national       
,in/itute ( ,/&>ds & ,te*nology ,!      
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology %all-- 7#a7 develop 
volunt>y1 innovative indu/rial control  
sy/ems cyb]security tra9+ & retra9+     
/&>ds1 lessons1 & recomm5dations = !    

electricity sector t m9imize duplication
 ( cyb]security compliance tra9+        
programs2 &  7#b7 ma9ta9 a public       
database ( indu/rial control sy/ems     
cyb]security education1 tra9+1 &        
c]tification programs4  #h4 ,int]ag5cy  
coord9ation & ,/rategic ,plan =         
electricity sector cyb]security rese>*  
7a7 ,duties ,! ,en]gy ,sector ,gov]nm5t 
,coord9at+ ,c\ncil %all-- 7#a7 review ! 
mo/ rec5t v]sion ( ! ,roadmap to ,a*ieve
 ,en]gy ,deliv]y ,sy/ems ,cyb]security &
 id5tify crosscutt+ en]gy grid          
cyb]security rese>* ne$s & opportunities
 = collaboration among ,f$]al ag5cies & 
betwe5 ,f$]al ag5cies & o!r relevant    
/akehold]s2  7#b7 id5tify int]discipl9>y
 rese>*1 te*nology1 & tools t c be      
appli$ to indu/rial control sy/em       
cyb]security *all5ges 9 ! electricity   
sector2  7#c7 id5tify te*nology transf] 
opportunities to accel]ate ! developm5t 
& comm]cial application ( novel         
indu/rial control sy/em cyb]security    
te*nologies1 sy/ems1 & processes2 &     

7#d7 develop a coord9at$ ,int]ag5cy     
,/rategic ,plan to advance cyb]security 
capabilities = indu/rial control sy/ems 
us$ 9 ! electricity sector t builds on !
 ,roadmap to ,a*ieve ,en]gy ,deliv]y    
,sy/ems 9 ,cyb]security4  7b7 ,/rategic 
plan  7#a7 ,submittal ,! ,int]ag5cy     
,/rategic ,plan develop$ "u subsection  
7a77#d7 %all be submitt$ to ,congress )9
 #ab mon?s aft] ! date ( enactm5t ( ?is 
,act4  7#b7 ,cont5ts ,! ,int]ag5cy      
,/rategic ,plan %all include-- 7,a7 an  
analysis ( h[ exi/+ cyb]security rese>* 
ef=ts conduct$ by memb] ag5cies are     
coord9at$ & c complem5t & advance !     
goals ( ! ,roadmap to ,a*ieve ,en]gy    
,deliv]y ,sy/ems ,cyb]security2  7,b7   
recomm5dations = prioritiz$ rese>* ef=ts
 t c\ld contribute to advanc+ !         
cyb]security ( electricity sector       
indu/rial control sy/ems2  7,c7 a       
description ( h[ exi/+ & propos$ public 
& private sector rese>* ef=ts address ! 
topics describ$ 9 p>agraph 7#c72 &  7,d7
 a description ( ne$$ support = work=ce 

tra9+ 9 ?is area4  7#c7 ,consid]ation ,9
 develop+ ! ,int]ag5cy ,/rategic ,plan1 
! ,en]gy ,sector ,gov]nm5t ,coord9at+   
,c\ncil %all consid]--  7,a7            
opportunities = human factors rese>* to 
improve ! design & effectiv5ess (       
cyb]security devices1 te*nologies1      
tools1 processes1 & tra9+ programs2     
7,b7 contributions ( o!r discipl9es to !
 developm5t ( innovative cyb]security   
protocols1 devices1 compon5ts1          
te*nologies1 & tools2  7,c7             
opportunities = ,small ,bus9ess         
,innovation ,rese>* 7,,sbir7 & o!r      
te*nology transf] programs to facilitate
 private sector developm5t ( indu/rial  
control sy/em cyb]security protocols1   
devices1 compon5ts1 te*nologies1 &      
tools2  7,d7 broad] applications ( ! "w 
done by relevant ,f$]al ag5cies to      
advance ! cyb]security ( indu/rial      
control sy/ems us$ by o!r sectors2 &    
7,e7 activities call$ = 9 ! ,f$]al      
cyb]security rese>* & developm5t        
/rategic plan requir$ by section        

#bja7;a77#a7 ( ! ,cyb]security          
,enhancem5t ,act ( #bjad 7#ae ,u4,s4,c4 
#gdca7;a77#a774  7c7 ,memb]%ip ,= !     
purposes ( c>ry+ out ?is section1 !     
,en]gy ,sector ,gov]nm5t ,coord9at+     
,c\ncil %all include repres5tatives f   
,f$]al ag5cies ) exp]tise 9 indu/rial   
control sy/ems cyb]security1 in=mation  
te*nology cyb]security1 cyb] physical   
sy/ems1 eng9e]+1 human factors rese>*1  
human-ma*9e int]faces1 high p]=mance    
comput+1 big data & data analytics1 or  
o!r discipl9es consid]$ appropriate by !
 ,c\ncil ,*air4 ,! ,*air %all consid]   
includ+ at lea/ "o employee designat$ by
 ! head ( ea* ( ! foll[+ ag5cies3  7#a7 
,9 ! ,dep>tm5t ( ,en]gy-- 7,a7 ! ,(fice 
( ,electricity ,deliv]y & ,en]gy        
,reliability2  7,b7 ! ,(fice ( ,sci5ce's
 ,advanc$ ,sci5tific ,comput+ ,rese>*   
program2  7,c7 ! ,(fice ( ,small        
,bus9ess ,innovation ,rese>*_/,small    
,bus9ess ,te*nology ,transf] programs2  
7,d7 ! ,(fice ( ,te*nology ,transitions2
 &  7,e7 o!r (fices consid]$ appropriate

 by ! ,secret>y4  7#b7 ,! ,national     
,sci5ce ,f\ndation4  7#c7 ,! ,dep>tm5t (
 ,homel& ,security's ,sci5ce &          
,te*nology ,directorate4  7#d7 ,!       
,national ,in/itute ( ,/&>ds &          
,te*nology4  7#e7 ,! ,national          
,a]onautics & ,space ,adm9i/ration's    
,human ,rese>* ,program4  7#f7 ,! ,(fice
 ( ,sci5ce & ,te*nology ,policy4  7#g7  
,! ,f$]al ,en]gy ,regulatory            
,commission4  #i4 ,reports to ,congress 
7a7 ,id5tification ( common factors 9   
cyb] attacks  7#a7 ,/udy ,! ,secret>y1 9
 collaboration ) ! ,secret>y ( ,homel&  
,security1 o!r appropriate ,f$]al       
ag5cies1 & en]gy sector /akehold]s1 %all
 conduct a /udy to analyze cyb] attacks 
on electricity sector indu/rial control 
sy/ems & id5tify co/-effective          
opportunities to improve cyb]security4  
7#b7 ,critical electric infra/ructure   
in=mation ,incid5t data provid$ to      
,f$]al ag5cies = ! purposes ( c>ry+ out 
?is subsection %all be consid]$ critical
 electric infra/ructure in=mation &     

provid$ ! protections e/abli%$ 9 section
 #aj4  7#c7 ,cont5t ,! /udy %all-- 7,a7 
summ>ize cyb] incid5t data provid$ to ! 
,secret>y by relevant ,f$]al ag5cies &  
en]gy sector /akehold]s2  7,b7 analyze  
processes1 op]ational proc$ures1 & o!r  
factors common among cyb] attacks2  7,c7
 id5tify ! po9ts :]e human behavior     
play$ a critical role 9 ma9ta9+ or      
compromis+ ! security ( ! sy/em2  7,d7  
recomm5d-- 7i7 *anges to ! design (     
devices1 human-ma*9e int]faces1         
te*nologies1 & tools to optimize        
security t d n require a *ange 9 human  
behavior2  7ii7 *anges to processes or  
op]ational proc$ures t d n require a    
*ange 9 human behavior2 &  7iii7 tra9+  
te*niques to increase ! capacity (      
employees to actively id5tify1 prev5t1  
or neutralize ! impact ( cyb] attacks2 &
  7,e7 evaluate exi/+ eng9e]+ & te*nical
 design crit]ia & guidel9es t           
incorporate human factors rese>* f9d+s1 
& recomm5d crit]ia & guidel9es =        
indu/rial control sy/em cyb]security    

tools t c be us$ to develop procurem5t  
guidance1 includ+ guidance = al>ms1     
displays1 & lay\ts4  7#d7 ,consultation 
,9 conduct+ ! /udy1 ! ,secret>y %all    
consult ) electricity sector /akehold]s1
 pr(essionals ) exp]tise 9 human factors
 rese>*1 private sector indu/rial       
control sy/em v5dors1 & o!r relevant    
p>ties4  7#e7 ,report ,n lat] ?an #bd   
mon?s aft] ! date ( enactm5t ( ?is ,act1
 ! ,secret>y %all submit to ! ,committee
 on ,sci5ce1 ,space1 & ,te*nology ( !   
,h\se ( ,repres5tatives & ! ,committee  
on ,en]gy & ,natural ,res\rces ( !      
,s5ate a report on ! results ( ! /udy1  
includ+ ! f9d+s ( ! ,secret>y on ea* ( !
 items describ$ 9 p>agraph 7#c74  7b7   
,balanc+ risks1 security1 & mod]nization
 ( indu/rial sy/ems  7#a7 ,/udy ,!      
,secret>y1 9 collaboration ) ! ,national
 ,in/itute ( ,/&>ds & ,te*nology1 o!r   
,f$]al ag5cies1 & electricity sector    
/akehold]s1 %all exam9e ! risks         
associat$ ) increas+ p5etration (       
digital te*nologies 9 op]ational        

networks4  7#b7 ,cont5t ,! /udy %all--  
7,a7 evaluate ! relative qualitative    
risks & b5efits ( v>i\s design &        
ar*itecture options = electricity sector
 indu/rial control sy/ems1 includ+      
consid]ation (--  7i7 designs t include 
bo? digital & analog control devices &  
te*nologies2  7ii7 diff]5t communication
 te*nologies us$ to move in=mation &    
data betwe5 control sy/em devices1      
te*nologies1 & sy/em op]ators2  7iii7   
automat$ & human-9-!-loop devices &     
te*nologies2  7iv7 programmable v]sus   
nonprogrammable devices & te*nologies2 &
  7v7 increas$ r$undancy us+ dissimil>  
cyb]security te*nologies2  7,b7 recomm5d
 me?ods or metrics to docum5t *anges 9  
risks associat$ ) sy/em designs &       
ar*itectures2  7,c7 provide             
recomm5dations = rese>*1 developm5t1    
demon/ration1 & comm]cial application   
activities to address issues rais$ 9    
subp>agraphs 7,a7 & 7,b72 &  7,d7       
recomm5d guidance to m9imize ov]all     
sy/em risks4  7#c7 ,consultation ,9     

conduct+ ! /udy1 ! ,secret>y %all       
consult ) electricity sector /akehold]s1
 academic & private sector rese>*]s1    
private sector indu/rial control sy/em  
v5dors1 & o!r relevant p>ties4  7#d7    
,report ,n lat] ?an #bd mon?s aft] !    
date ( enactm5t ( ?is ,act1 ! ,secret>y 
%all submit to ! ,committee on ,sci5ce1 
,space1 & ,te*nology ( ! ,h\se (        
,repres5tatives & ! ,committee on ,en]gy
 & ,natural ,res\rces ( ! ,s5ate a      
report on ! results ( ! /udy1 includ+ ! 
f9d+s ( ! ,secret>y on ea* ( ! items    
describ$ 9 p>agraph 7#b74  #aj4         
,protection ( critical electric         
infra/ructure in=mation ,any ,f$]al     
ag5cy t produces in=mation or has       
in=mation made available to x 9 ! c\rse 
( c>ry+ out ?is ,act %all det]m9e :e!r  
to designate any su* in=mation z        
critical electric infra/ructure         
in=mation4 ,critical electric           
infra/ructure in=mation--  7#a7 %all be 
exempt f disclosure "u section          
#eeb7;b77#c7 ( title #e1 ,unit$ ,/ates  

,code2 &  7#b7 %all n be made available 
by any ,f$]al1 ,/ate1 political         
subdivision1 or tribal au?ority pursuant
 to any ,f$]al1 ,/ate1 political        
subdivision1 or tribal law requir+      
public disclosure ( in=mation or        
records4  #aa4 ,au?orization (          
appropriations ,!re are au?oriz$ to be  
appropriat$ to ! ,secret>y to c>ry out  
?is ,act-- 7#a7 #fe1jjj1jjj = fiscal ye>
 #bjah2  7#b7 #fh1bej1jjj = fiscal ye>  
#bjai2  7#c7 #ga1ffb1ejj = fiscal ye>   
#bjbj2  7#d7 #ge1bde1fbe = fiscal ye>   
#bjba2 &  7#e7 #gi1jjg1ijf = fiscal ye> 
#bjbb4