,i #aafth ,,congress #b;d ,session ,h4 ,r4 #egfj ,,in ,,the ,,house ,,of ,,representatives ,february #e1 #bjbj,mr4 ,bera 7for himself and ,mr4 ,weber of ,texas7 introduced the following bill2 which was referred to the ,committee on ,science1 ,space1 and ,technology1 and in addition to the ,committee on ,homeland ,security1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to provide for a comprehensive interdisciplinary research1 development1 and demonstration initiative to strengthen the capacity of the energy sector to prepare for and withstand cyber and physical attacks1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,grid ,security ,research and ,development ,act4 #b4 ,findings ,congress finds the following3 7#a7 ,the ,nation1 and every critical infrastructure sector1 depends on reliable electricity4 7#b7 ,intelligent electronic devices1 advanced analytics1 and information systems used across the energy sector are essential to maintaining reliable operation of the electric grid4 7#c7 ,the cybersecurity threat landscape is constantly changing and attacker capabilities are advancing rapidly1 requiring ongoing modifications1 advancements1 and investments in technologies and procedures to maintain security4 7#d7 ,it is in the national interest for ,federal agencies to invest in cybersecurity research that informs and facilitates private sector investment and use of advanced cybersecurity tools and procedures to protect information systems4 7#e7 ,the number of devices and systems connecting to the electric grid is increasing1 and integrating cybersecurity protections into information systems when they are built is more effective than modifying products after installation to meet cybersecurity goals4 7#f7 ,an understanding of human factors can be leveraged to understand the behavior of cyber threat actors1 develop strategies to counter threat actors1 improve cybersecurity training programs1 optimize the design of human-machine interfaces and cybersecurity tools1 and increase the capacity of the energy sector workforce to prevent unauthorized access to critical systems4 #c4 ,amendment to ,energy ,independence and ,security ,act of #bjjg ,title ,,xiii of the ,energy ,independence and ,security ,act of #bjjg 7#db ,u4,s4,c4 #agcha et seq47 is amended by adding at the end the following3 #acaj4 ,energy sector security research1 development1 and demonstration program 7a7 ,in general ,the ,secretary1 in coordination with appropriate ,federal agencies1 the ,electricity ,subsector ,coordinating ,council1 the ,electric ,reliability ,organization1 ,state1 tribal1 local1 and territorial governments1 the private sector1 and other relevant stakeholders1 shall carry out a research1 development1 and demonstration program to protect the electric grid and energy systems1 including assets connected to the distribution grid1 from cyber and physical attacks by increasing the cyber and physical security capabilities of the energy sector and accelerating the development of relevant technologies and tools4 7b7 ,department of energy ,as part of the initiative described in subsection 7a71 the ,secretary shall award research1 development1 and demonstration grants to-- 7#a7 identify cybersecurity risks to information systems within1 and impacting1 the electricity sector1 energy systems1 and energy infrastructure2 7#b7 develop methods and tools to rapidly detect cyber intrusions and cyber incidents1 including through the use of data and big data analytics techniques1 such as intrusion detection1 and security information and event management systems1 to validate and verify system behavior2 7#c7 assess emerging cybersecurity capabilities that could be applied to energy systems and develop technologies that integrate cybersecurity features and procedures into the design and development of existing and emerging grid technologies1 including renewable energy1 storage1 and demand-side management technologies2 7#d7 identify existing vulnerabilities in intelligent electronic devices1 advanced analytics systems1 and information systems2 7#e7 work with relevant entities to develop technologies or concepts that build or retrofit cybersecurity features and procedures into-- 7,a7 information and energy management system devices1 components1 software1 firmware1 and hardware1 including distributed control and management systems1 and building management systems2 7,b7 data storage systems1 data management systems1 and data analysis processes2 7,c7 automated- and manually-controlled devices and equipment for monitoring and stabilizing the electric grid2 7,d7 technologies used to synchronize time and develop guidance for operational contingency plans when time synchronization technologies1 are compromised2 7,e7 power system delivery and end user systems and devices that connect to the grid1 including-- 7i7 meters1 synchrophasors1 phasor measurement units1 and other sensors2 7ii7 distribution automation technologies1 smart inverters1 and other grid control technologies2 7iii7 distributed generation1 energy storage1 and other distributed energy technologies2 7iv7 demand response technologies2 7v7 home and building energy management and control systems2 7vi7 electric and plug-in hybrid vehicles and electric vehicle charging systems2 and 7vii7 other relevant devices1 software1 firmware1 and hardware2 and 7,f7 the supply chain of electric grid management system components2 7#f7 develop technologies that improve the physical security of information systems1 including remote assets2 7#g7 integrate human factors research into the design and development of advanced tools and processes for dynamic monitoring1 detection1 protection1 mitigation1 response1 and cyber situational awareness2 7#h7 evaluate and understand the potential consequences of practices used to maintain the cybersecurity of information systems and intelligent electronic devices2 7#i7 develop or expand the capabilities of existing cybersecurity test beds to simulate impacts of cyber attacks and combined cyber-physical attacks on information systems and electronic devices1 including by increasing access to existing and emerging test beds for cooperative utilities1 utilities owned by a political subdivision of a ,state1 such as municipally owned electric utilities1 and other relevant stakeholders2 and 7#aj7 develop technologies that reduce the cost of implementing effective cybersecurity technologies and tools1 including updates to these technologies and tools1 in the energy sector4 7c7 ,national science foundation ,the ,national ,science ,foundation1 in coordination with other ,federal agencies as appropriate1 shall through its cybersecurity research and development programs-- 7#a7 support basic research to advance knowledge1 applications1 technologies1 and tools to strengthen the cybersecurity of information systems1 including electric grid and energy systems1 including interdisciplinary research in-- 7,a7 evolutionary systems1 theories1 mathematics1 and models2 7,b7 economic and financial theories1 mathematics1 and models2 and 7,c7 big data analytical methods1 mathematics1 computer coding1 and algorithms2 and 7#b7 support cybersecurity education and training focused on information systems for the electric grid and energy workforce1 including through the ,advanced ,technological ,education program1 the ,cybercorps program1 graduate research fellowships1 and other appropriate programs4 7d7 ,department of homeland security science and technology directorate ,the ,science and ,technology ,directorate of the ,department of ,homeland ,security shall coordinate with the ,department of ,energy1 the private sector1 and other relevant stakeholders1 to research existing cybersecurity technologies and tools used in the defense industry in order to-- 7#a7 identify technologies and tools that may meet civilian energy sector cybersecurity needs2 7#b7 develop a research strategy that incorporates human factors research findings to guide the modification of defense industry cybersecurity tools for use in the civilian sector2 7#c7 develop a strategy to accelerate efforts to bring modified defense industry cybersecurity tools to the civilian market2 and 7#d7 carry out other activities the ,secretary of ,homeland ,security considers appropriate to meet the goals of this subsection4 #acaa4 ,grid resilience and emergency response 7a7 ,in general ,not later than #ahj days after the enactment of the ,grid ,security ,research and ,development ,act1 the ,secretary shall establish a research1 development1 and demonstration program to enhance resilience and strengthen emergency response and management pertaining to the energy sector4 7b7 ,grants ,the ,secretary shall award grants to eligible entities under subsection 7c7 on a competitive basis to conduct research and development with the purpose of improving the resilience and reliability of electric grid by-- 7#a7 developing methods to improve community and governmental preparation for and emergency response to large-area1 long-duration electricity interruptions1 including through the use of energy efficiency1 storage1 and distributed generation technologies2 7#b7 developing tools to help utilities and communities ensure the continuous delivery of electricity to critical facilities2 7#c7 developing tools to improve coordination between utilities and relevant ,federal agencies to enable communication1 information-sharing1 and situational awareness in the event of a physical or cyber-attack on the electric grid2 7#d7 developing technologies and capabilities to withstand and address the current and projected impact of the changing climate on energy sector infrastructure1 including extreme weather events and other natural disasters2 7#e7 developing technologies capable of early detection of deteriorating electrical equipment on the transmission and distribution grid1 including detection of spark ignition causing wildfires and risks of vegetation contact2 and 7#f7 assessing upgrades and additions needed to energy sector infrastructure due to projected changes in the energy generation mix and energy demand4 7c7 ,eligible entities ,the entities eligible to receive grants under this section include-- 7#a7 an institution of higher education2 7#b7 a nonprofit organization2 7#c7 a ,national ,laboratory2 7#d7 a unit of ,state1 local1 or tribal government2 7#e7 an electric utility or electric cooperative2 7#f7 a retail service provider of electricity2 7#g7 a private commercial entity2 7#h7 a partnership or consortium of #b or more entities described in subparagraphs 7#a7 through 7#g72 and 7#i7 any other entities the ,secretary deems appropriate4 7d7 ,relevant activities ,grants awarded under subsection 7b7 shall include funding for research and development activities related to the purpose described in subsection 7b71 such as-- 7#a7 development of technologies to use distributed energy resources1 such as solar photovoltaics1 energy storage systems1 electric vehicles1 and microgrids1 to improve grid and critical end-user resilience2 7#b7 analysis of non-technical barriers to greater integration and use of technologies on the distribution grid2 7#c7 analysis of past large-area1 long-duration electricity interruptions to identify common elements and best practices for electricity restoration1 mitigation1 and prevention of future disruptions2 7#d7 development of advanced monitoring1 analytics1 operation1 and controls of electricity grid systems to improve electric grid resilience2 7#e7 analysis of technologies1 methods1 and concepts that can improve community resilience and survivability of frequent or long-duration power outages2 7#f7 development of methodologies to maintain cybersecurity during restoration of energy sector infrastructure and operation2 7#g7 development of advanced power flow control systems and components to improve electric grid resilience2 and 7#h7 any other relevant activities determined by the ,secretary4 7e7 ,technical assistance 7#a7 ,in general ,the ,secretary shall provide technical assistance to eligible entities for the commercial application of technologies to improve the resilience of the electric grid and commercial application of technologies to help entities develop plans for preventing and recovering from various power outage scenarios at the local1 regional1 and ,state level4 7#b7 ,technical assistance program ,the commercial application technical assistance program established in paragraph 7#a7 shall include assistance to eligible entities for-- 7,a7 the commercial application of technologies developed from the grant program established in subsection 7b71 including cooperative utilities and utilities owned by a political subdivision of a ,state1 such as municipally owned electric utilities2 7,b7 the development of methods to strengthen or otherwise mitigate adverse impacts on electric grid infrastructure against natural hazards2 7,c7 the use of ,department data and modeling tools for various purposes2 and 7,d7 a resource assessment and analysis of future demand and distribution requirements1 including development of advanced grid architectures and risk analysis4 7#c7 ,eligible entities ,the entities eligible to receive technical assistance for commercial application of technologies under this section include-- 7,a7 representatives of all sectors of the electric power industry1 including electric utilities1 trade organizations1 and transmission and distribution system organizations1 owners1 and operators2 7,b7 ,state and local governments and regulatory authorities1 including public utility commissions2 7,c7 tribal and ,alaska ,native governmental entities2 7,d7 partnerships among entities under subparagraphs 7,a7 through 7,c72 7,e7 regional partnerships2 and 7,f7 any other entities the ,secretary deems appropriate4 7#d7 ,authority ,nothing in this section shall authorize the ,secretary to require any entity to adopt any model1 tool1 technology1 plan1 analysis1 or assessment4 #acab4 ,best practices and guidance documents for energy sector cybersecurity research 7a7 ,in general ,the ,secretary1 in coordination with appropriate ,federal agencies1 the ,electricity ,subsector ,coordinating ,council1 standards development organizations1 ,state1 tribal1 local1 and territorial governments1 the private sector1 public utility commissions1 and other relevant stakeholders1 shall coordinate the development of guidance documents for research1 development1 and demonstration activities to improve the cybersecurity capabilities of the energy sector through participating agencies4 ,as part of these activities1 the ,secretary shall-- 7#a7 facilitate stakeholder involvement to update-- 7,a7 the ,roadmap to ,achieve ,energy ,delivery ,systems ,cybersecurity2 7,b7 the ,cybersecurity ,procurement ,language for ,energy ,delivery ,systems1 including developing guidance for-- 7i7 contracting with third parties to conduct vulnerability testing for information systems used across the energy production1 delivery1 storage1 and end use systems2 7ii7 contracting with third parties that utilize transient devices to access information systems2 and 7iii7 managing supply chain risks2 and 7,c7 the ,electricity ,subsector ,cybersecurity ,capability ,maturity ,model1 including the development of metrics to measure changes in cybersecurity readiness2 and 7#b7 develop voluntary guidance to improve digital forensic analyses capabilities1 including-- 7,a7 developing standardized terminology and monitoring processes2 and 7,b7 utilizing human factors research to develop more effective procedures for logging incident events2 and 7#c7 work with the ,national ,science ,foundation1 ,department of ,homeland ,security1 and stakeholders to develop a mechanism to anonymize1 aggregate1 and share the testing results from cybersecurity test beds to facilitate technology improvements by public and private sector researchers4 7b7 ,best practices ,the ,secretary1 in collaboration with the ,director of the ,national ,institute of ,standards and ,technology and other appropriate ,federal agencies1 shall convene relevant stakeholders and facilitate the development of-- 7#a7 consensus-based best practices to improve cybersecurity for-- 7,a7 emerging energy technologies2 7,b7 distributed generation and storage technologies1 and other distributed energy resources2 7,c7 electric vehicles and electric vehicle charging stations2 and 7,d7 other technologies and devices that connect to the electric grid2 7#b7 recommended cybersecurity features and requirements that can be used by the private sector to design and build interoperable cybersecurity features into technologies that connect to the electric grid1 including networked devices and components on distribution systems2 and 7#c7 technical analysis that can be used by the private sector in developing best practices for test beds and test bed methodologies that will enable reproducible testing of cybersecurity protections for information systems1 electronic devices1 and other relevant components1 software1 and hardware across test beds4 7c7 ,regulatory authority ,none of the activities authorized in this section shall be construed to authorize regulatory actions4 ,additionally1 the voluntary standards developed under this section shall not duplicate or conflict with mandatory reliability standards4 #acac4 ,vulnerability testing and technical assistance to improve cybersecurity 7a7 ,in general ,the ,secretary shall-- 7#a7 coordinate with energy sector asset owners and operators1 leveraging the research facilities and expertise of the ,national ,laboratories1 to assist entities in developing testing capabilities by-- 7,a7 utilizing a range of methods to identify vulnerabilities in physical and cyber systems2 7,b7 developing cybersecurity risk assessment tools and providing analyses and recommendations to participating stakeholders2 and 7,c7 working with stakeholders to develop methods to share anonymized and aggregated test results to assist relevant stakeholders in the energy sector1 researchers1 and the private sector to advance cybersecurity efforts1 technologies1 and tools2 7#b7 collaborate with relevant stakeholders1 including public utility commissions1 to-- 7,a7 identify information1 research1 staff training1 and analytical tools needed to evaluate cybersecurity issues and challenges in the energy sector2 and 7,b7 facilitate the sharing of information and the development of tools identified under subparagraph 7,a72 and 7#c7 collaborate with tribal governments to identify information1 research1 and analysis tools needed by tribal governments to increase the cybersecurity of energy assets within their jurisdiction4 #acad4 ,education and workforce training research and standards 7a7 ,in general ,the ,secretary shall support the development of a cybersecurity workforce through a program that-- 7#a7 facilitates collaboration between undergraduate and graduate students1 researchers at the ,national ,laboratories1 and the private sector2 7#b7 prioritizes science and technology in areas relevant to the mission of the ,department of ,energy through the design and application of cybersecurity technologies2 7#c7 develops1 or facilitates private sector development of1 voluntary cybersecurity training and retraining standards1 lessons1 and recommendations for the energy sector that minimize duplication of cybersecurity compliance training programs2 and 7#d7 maintains a public database of cybersecurity education1 training1 and certification programs4 7b7 ,collaboration ,in carrying out the program authorized in subsection 7a71 the ,secretary shall leverage programs and activities carried out across the ,department of ,energy1 other relevant ,federal agencies1 institutions of higher education1 and other appropriate entities best suited to provide national leadership on cybersecurity-related issues4 #acae4 ,interagency coordination and strategic plan for energy sector cybersecurity research 7a7 ,duties ,the ,secretary1 in coordination with the ,energy ,sector ,government ,coordinating ,council1 shall-- 7#a7 review the most recent versions of the ,roadmap to ,achieve ,energy ,delivery ,systems ,cybersecurity and the ,multi-,year ,program ,plan for ,energy ,sector ,cybersecurity to identify crosscutting energy sector cybersecurity research needs and opportunities for collaboration among ,federal agencies and other relevant stakeholders2 7#b7 identify interdisciplinary research1 technology1 and tools that can be applied to cybersecurity challenges in the energy sector2 7#c7 identify technology transfer opportunities to accelerate the development and commercial application of novel cybersecurity technologies1 systems1 and processes in the energy sector2 and 7#d7 develop a coordinated ,interagency ,strategic ,plan for research to advance cybersecurity capabilities used in the energy sector that builds on the ,roadmap to ,achieve ,energy ,delivery ,systems in ,cybersecurity and the ,multi-,year ,program ,plan for ,energy ,sector ,cybersecurity4 7b7 ,interagency strategic plan 7#a7 ,submittal ,the ,interagency ,strategic ,plan developed under subsection 7a77#d7 shall be submitted to ,congress within #ab months after the date of enactment of the ,grid ,security ,research and ,development ,act4 7#b7 ,contents ,the ,interagency ,strategic ,plan shall include-- 7,a7 an analysis of how existing cybersecurity research efforts across the ,federal ,government are advancing the goals of the ,roadmap to ,achieve ,energy ,delivery ,systems ,cybersecurity and the ,multi-,year ,program ,plan for ,energy ,sector ,cybersecurity2 7,b7 recommendations for research areas that may advance the cybersecurity of the energy sector2 7,c7 an overview of existing and proposed public and private sector research efforts that address the topics outlined in paragraph 7#c72 and 7,d7 an overview of needed support for workforce training in cybersecurity for the energy sector4 7#c7 ,considerations ,in developing the ,interagency ,strategic ,plan1 the ,secretary1 in coordination with the ,energy ,sector ,government ,coordinating ,council1 shall consider-- 7,a7 opportunities for human factors research to improve the design and effectiveness of cybersecurity devices1 technologies1 tools1 processes1 and training programs2 7,b7 contributions of other disciplines to the development of innovative cybersecurity procedures1 devices1 components1 technologies1 and tools2 7,c7 opportunities for technology transfer programs to facilitate private sector development of cybersecurity procedures1 devices1 components1 technologies1 and tools for the energy sector2 7,d7 broader applications of the work done by relevant ,federal agencies to advance the cybersecurity of information systems and data analytics systems for the energy sector2 and 7,e7 activities called for in the ,federal cybersecurity research and development strategic plan required by section #bja7;a77#a7 of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gdca7;a77#a774 7c7 ,participation ,for the purposes of carrying out this section1 the ,energy ,sector ,government ,coordinating ,council shall include representatives from ,federal agencies with expertise in the energy sector1 information systems1 data analytics1 cyber physical systems1 engineering1 human factors research1 human-machine interfaces1 high performance computing1 big data and data analytics1 or other disciplines considered appropriate by the ,council ,chair4 #acaf4 ,report to ,congress 7a7 ,balancing risks1 increasing security1 and improving modernization 7#a7 ,study ,the ,secretary1 in collaboration with the ,national ,institute of ,standards and ,technology1 other ,federal agencies1 and energy sector stakeholders1 in order to provide recommendations for additional research1 development1 demonstration1 and commercial application activities1 shall-- 7,a7 analyze physical and cyber attacks on energy sector infrastructure and information systems and identify cost-effective opportunities to improve physical and cyber security2 and 7,b7 examine the risks associated with increasing penetration of digital technologies in grid networks1 particularly on the distribution grid4 7#b7 ,content ,the study shall-- 7,a7 analyze processes1 operational procedures1 and other factors common among cyber attacks2 7,b7 identify areas where human behavior plays a critical role in maintaining or compromising the security of a system2 7,c7 recommend-- 7i7 changes to the design of devices1 human-machine interfaces1 technologies1 tools1 processes1 or procedures to optimize security that do not require a change in human behavior2 and 7ii7 training techniques to increase the capacity of employees to actively identify1 prevent1 or neutralize the impact of cyber attacks2 7,d7 evaluate existing engineering and technical design criteria and guidelines that incorporate human factors research findings1 and recommend criteria and guidelines for cybersecurity tools that can be used to develop display systems for cybersecurity monitoring1 such as alarms1 user-friendly displays1 and layouts2 7,e7 evaluate the cybersecurity risks and benefits of various design and architecture options for energy sector systems1 networked grid systems and components1 and automation systems1 including consideration of-- 7i7 designs that include both digital and analog control devices and technologies2 7ii7 different communication technologies used to transfer information and data between control system devices1 technologies1 and system operators2 7iii7 automated and human-in-the-loop devices and technologies2 7iv7 programmable versus nonprogrammable devices and technologies2 7v7 increased redundancy using dissimilar cybersecurity technologies2 and 7vi7 grid architectures that use autonomous functions to limit control vulnerabilities2 and 7,f7 recommend methods or metrics to document changes in risks associated with system designs and architectures4 7#c7 ,consultation ,in conducting the study1 the ,secretary shall consult with energy sector stakeholders1 academic and private sector researchers1 the private sector1 and other relevant stakeholders4 7#d7 ,report ,not later than #bd months after the date of enactment of the ,grid ,security ,research and ,development ,act1 the ,secretary shall submit the study to the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives and the ,committee on ,energy and ,natural ,resources of the ,senate4 #acag4 ,definitions ,in this title3 7#a7 ,big data ,the term big data means datasets that require advanced analytical methods for their transformation into useful information4 7#b7 ,cybersecurity ,the term cybersecurity means protecting an information system or information that is stored on1 processed by1 or transiting an information system from a cybersecurity threat or security vulnerability4 7#c7 ,cybersecurity threat ,the term cybersecurity threat has the meaning given the term in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#d7 ,electricity subsector coordinating council ,the term ,electricity ,subsector ,coordinating ,council means the self-organized1 self-governed council consisting of senior industry representatives to serve as the principal liaison between the ,federal ,government and the electric power sector and to carry out the role of the ,sector ,coordinating ,council as established in the ,national ,infrastructure ,protection ,plan for the electricity subsector4 7#e7 ,energy sector government coordinating council ,the term ,energy ,sector ,government ,coordinating ,council means the council consisting of representatives from relevant ,federal ,government agencies to provide effective coordination of energy sector efforts to ensure a secure1 reliable1 and resilient energy infrastructure and to carry out the role of the ,government ,coordinating ,council as established in the ,national ,infrastructure ,protection ,plan for the energy sector4 7#f7 ,human factors research ,the term human factors research means research on human performance in social and physical environments1 and on the integration and interaction of humans with physical systems and computer hardware and software4 7#g7 ,human-machine interfaces ,the term human-machine interfaces means technologies that present information to an operator or user about the state of a process or system1 or accept human instructions to implement an action1 including visualization displays such as a graphical user interface4 7#h7 ,information system ,the term information system-- 7,a7 has the meaning given the term in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja72 and 7,b7 includes operational technology1 information technology1 and communications4 7#i7 ,national laboratory ,the term national laboratory has the meaning given the term in section #b of the ,energy ,policy ,act of #bjje 7#db ,u4,s4,c4 #aehja74 7#aj7 ,security vulnerability ,the term security vulnerability has the meaning given the term in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#aa7 ,transient devices ,the term transient devices means removable media1 including floppy disks1 compact disks1 ,,usb flash drives1 external hard drives1 mobile devices1 and other devices that utilize wireless connections4 #acah4 ,authorization of appropriations ,there are authorized to be appropriated to the ,secretary to carry out this title-- 7#a7 #aej1jjj1jjj for fiscal year #bjba2 7#b7 #aeg1ejj1jjj for fiscal year #bjbb2 7#c7 #afe1cge1jjj for fiscal year #bjbc2 7#d7 #agc1fde1jjj for fiscal year #bjbd2 and 7#e7 #ahb1cbe1jjj for fiscal year #bjbe4 4