HR 5239 — Cyber Sense Act of 2018

5239 IntroducedReported in House (IH)](RH)] <DOC> 115thUnion CONGRESSCalendar 2dNo. Session H.

614 115th CONGRESS 2d Session H.

5239 To[Report requireNo. the Secretary of Energy to establish a voluntary Cyber Sense program to identify and promote cyber-secure products intended for use in the bulk-power system, and for other purposes.

115-794] To require the Secretary of Energy to establish a voluntary Cyber Sense program to identify and promote cyber-secure products intended for use in the bulk-power system, and for other purposes.

which was referred to the Committee on Energy and Commerce June 28, 2018 Reported with amendments, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed [Strike out all after the enacting clause and insert the part printed in italic] [For text of introduced bill, see copy of bill as introduced on March 9, 2018] _______________________________________________________________________ A BILL To require the Secretary of Energy to establish a voluntary Cyber Sense program to identify and promote cyber-secure products intended for use in the bulk-power system, and for other purposes.

(a) In General.--The Secretary of Energy shall establish a voluntary Cyber Sense program to identifytest andthe promotecybersecurity cyber-secureof products and technologies intended for use in the bulk-power system, as defined in section 215(a) of the Federal Power Act (16 U.S.C.

(b) Program Requirements.--In carrying out subsection (a), the Secretary of Energy shall-- (1) establish a testing process under the Cyber Sense testingprogram process to identifytest the cybersecurity of products and technologies intended for use in the bulk-power systemsystem, that are cyber-secure, including products relating to industrial control systems,systems and operational technologies, such as supervisory control and data acquisition systems;

(2) for products tested and identifiedtechnologies astested cyber-secure under the Cyber Sense program, establish and maintain cybersecurity vulnerability reporting processes and a related database;

(3) provide technical assistance to electric utilities, product manufacturers, and other electricity sector stakeholders to develop solutions to mitigate identified cybersecurity vulnerabilities in products tested and identifiedtechnologies astested cyber-secure under the Cyber Sense program;

(4) biennially review products tested and identifiedtechnologies astested cyber-secure under the Cyber Sense program for cybersecurity vulnerabilities and provide analysis with respect to how such products and technologies respond to and mitigate cyber threats;

(5) develop procurementguidance, guidancethat foris electricinformed utilitiesby foranalysis products tested and identifiedtesting asresults cyber-secure under the Cyber Sense program;program, for electric utilities for procurement of products and technologies;

(6) provide reasonable notice to the public, and solicit comments from the public, prior to establishing or revising the testing process under the Cyber Sense testingprogram; process;

(7) establishoversee procedurestesting forof disqualifying products that were tested and identifiedtechnologies as cyber-secure under the Cyber Sense program but that no longer meet the qualifications to be identified cyber-secure products under such program;

and (8) overseeconsider incentives to encourage the use of analysis and results of testing under the Cyber Sense testingprogram carriedin outthe bydesign thirdof parties;products and technologies for use in the bulk-power system.

and(c) (9)Disclosure considerof incentivesInformation.--Any cybersecurity vulnerability reported pursuant to encouragea process established under subsection (b)(2), the usedisclosure inof which the bulk-Secretary powerof systemEnergy reasonably foresees would cause harm to critical electric infrastructure (as defined in section 215A of productsthe testedFederal andPower identifiedAct), asshall cyber-securebe underdeemed to be critical electric infrastructure information for purposes of section 215A(d) of the CyberFederal SensePower program.Act.

(c)(d) DisclosureFederal ofGovernment Information.--AnyLiability.--Nothing cybersecurityin vulnerabilitythis reportedsection pursuantshall tobe theconstrued processto establishedauthorize under subsection (b)(2), the disclosurecommencement of whichan theaction Secretaryagainst ofthe EnergyUnited reasonablyStates foreseesGovernment wouldwith causerespect harm to criticalthe electrictesting infrastructure (as defined in section 215A of thea Federalproduct Poweror Act),technology shallunder be deemed to be critical electric infrastructure information for purposes of section 215A(d) of the FederalCyber PowerSense Act.program.

(d)Amend Federal Government Liability.--Nothing in this section shall be construed to authorize the commencementtitle ofso anas action against the United States Government with respect to theread: testing and identification of a product under the Cyber Sense program.

<all>``A bill to require the Secretary of Energy to establish a voluntary Cyber Sense program to test the cybersecurity of products and technologies intended for use in the bulk-power system, and for other purposes.''.

Union Calendar No.

614 115th CONGRESS 2d Session H.

R.

5239 [Report No.

115-794] _______________________________________________________________________ A BILL To require the Secretary of Energy to establish a voluntary Cyber Sense program to identify and promote cyber-secure products intended for use in the bulk-power system, and for other purposes.

_______________________________________________________________________ June 28, 2018 Reported with amendments, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed