PROTECT Act of 2019

II Calendar No. 356 116TH CONGRESS 1ST SESSION S. 2556 To amend the Federal Power Act to provide energy cybersecurity investment incentives, to establish a grant and technical assistance program for cybersecurity investments, and for other purposes. IN THE SENATE OF THE UNITED STATES SEPTEMBER 26, 2019 Ms. MURKOWSKI (for herself, Mr. MANCHIN, Mr. RISCH, Ms. CANTWELL, and Mr. KING) introduced the following bill; which was read twice and re- ferred to the Committee on Energy and Natural Resources DECEMBER 17, 2019 Reported by Ms. MURKOWSKI, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To amend the Federal Power Act to provide energy cyberse- curity investment incentives, to establish a grant and technical assistance program for cybersecurity invest- ments, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 2 •S 2556 RS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Protecting Resources 2 On The Electric grid with Cybersecurity Technology Act 3 of 2019’’ or the ‘‘PROTECT Act of 2019’’. 4 SEC. 2. INCENTIVES FOR ADVANCED CYBERSECURITY 5 TECHNOLOGY INVESTMENT. 6 Part II of the Federal Power Act is amended by in- 7 serting after section 219 (16 U.S.C. 824s) the following: 8 ‘‘SEC. 219A. INCENTIVES FOR CYBERSECURITY INVEST- 9 MENTS. 10 ‘‘(a) DEFINITIONS.—In this section: 11 ‘‘(1) ADVANCED CYBERSECURITY TECH- 12 NOLOGY.—The term ‘advanced cybersecurity tech- 13 nology’ means any technology, operational capability, 14 or service, including computer hardware, software, 15 or a related asset, that enhances the security posture 16 of public utilities through improvements in the abil- 17 ity to protect against, detect, respond to, or recover 18 from a cybersecurity threat (as defined in section 19 102 of the Cybersecurity Act of 2015 (6 U.S.C. 20 1501)). 21 ‘‘(2) ADVANCED CYBERSECURITY TECHNOLOGY 22 INFORMATION.—The term ‘advanced cybersecurity 23 technology information’ means information relating 24 to advanced cybersecurity technology or proposed 25 advanced cybersecurity technology that is generated 26 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 3 •S 2556 RS by or provided to the Commission or another Fed- 1 eral agency. 2 ‘‘(b) STUDY.—Not later than 180 days after the date 3 of enactment of this section, the Commission, in consulta- 4 tion with the Secretary of Energy, the North American 5 Electric Reliability Corporation, the Electricity Subsector 6 Coordinating Council, and the National Association of 7 Regulatory Utility Commissioners, shall conduct a study 8 to identify incentive-based, including performance-based, 9 rate treatments for the transmission of electric energy 10 subject to the jurisdiction of the Commission that could 11 be used to encourage— 12 ‘‘(1) investment by public utilities in advanced 13 cybersecurity technology; and 14 ‘‘(2) participation by public utilities in cyberse- 15 curity threat information sharing programs. 16 ‘‘(c) INCENTIVE-BASED RATE TREATMENT.—Not 17 later than 1 year after the completion of the study under 18 subsection (b), the Commission shall establish, by rule, in- 19 centive-based, including performance-based, rate treat- 20 ments for the transmission of electric energy in interstate 21 commerce by public utilities for the purpose of benefitting 22 consumers by encouraging— 23 ‘‘(1) investments by public utilities in advanced 24 cybersecurity technology; and 25 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 4 •S 2556 RS ‘‘(2) participation by public utilities in cyberse- 1 curity threat information sharing programs. 2 ‘‘(d) FACTORS FOR CONSIDERATION.—In issuing the 3 rule pursuant to this section, the Commission may provide 4 additional incentives beyond those identified in subsection 5 (c) in any case in which the Commission determines that 6 an investment in advanced cybersecurity technology or in- 7 formation sharing program costs will reduce cybersecurity 8 risks to— 9 ‘‘(1) defense critical electric infrastructure (as 10 defined in section 215A(a)) and other facilities sub- 11 ject to the jurisdiction of the Commission that are 12 critical to public safety, national defense, or home- 13 land security, as determined by the Commission in 14 consultation with— 15 ‘‘(A) the Secretary of Energy; and 16 ‘‘(B) appropriate Federal agencies; and 17 ‘‘(2) facilities of small- or medium-sized public 18 utilities with limited cybersecurity resources, as de- 19 termined by the Commission. 20 ‘‘(e) RATEPAYER PROTECTION.—Any rate approved 21 under the rule issued pursuant to this section, including 22 any revisions to that rule, shall be subject to the require- 23 ments of sections 205 and 206 that all rates, charges, 24 terms, and conditions— 25 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 5 •S 2556 RS ‘‘(1) shall be just and reasonable; and 1 ‘‘(2) shall not be unduly discriminatory or pref- 2 erential. 3 ‘‘(f) SINGLE-ISSUE RATE FILINGS.—The Commis- 4 sion shall permit public utilities to apply for incentive- 5 based rate treatment under the rule issued under this sec- 6 tion on a single-issue basis by submitting to the Commis- 7 sion a tariff schedule under section 205 that permits re- 8 covery of costs and incentives over the depreciable life of 9 the applicable assets, without regard to changes in receipts 10 or other costs of the public utility. 11 ‘‘(g) PROTECTION OF INFORMATION.—Advanced cy- 12 bersecurity technology information that is provided to, 13 generated by, or collected by the Federal Government 14 under subsection (b), (c), or (f) shall be considered to be 15 critical electric infrastructure information under section 16 215A.’’. 17 SEC. 3. RURAL AND MUNICIPAL UTILITY ADVANCED CY- 18 BERSECURITY GRANT AND TECHNICAL AS- 19 SISTANCE PROGRAM. 20 (a) DEFINITIONS.—In this section: 21 (1) ADVANCED CYBERSECURITY TECH- 22 NOLOGY.—The term ‘‘advanced cybersecurity tech- 23 nology’’ means any technology, operational capa- 24 bility, or service, including computer hardware, soft- 25 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 6 •S 2556 RS ware, or a related asset, that enhances the security 1 posture of electric utilities through improvements in 2 the ability to protect against, detect, respond to, or 3 recover from a cybersecurity threat (as defined in 4 section 102 of the Cybersecurity Act of 2015 (6 5 U.S.C. 1501)). 6 (2) ELIGIBLE ENTITY.—The term ‘‘eligible enti- 7 ty’’ means— 8 (A) a rural electric cooperative; 9 (B) a utility owned by a political subdivi- 10 sion of a State, such as a municipally owned 11 electric utility; 12 (C) a utility owned by any agency, author- 13 ity, corporation, or instrumentality of one or 14 more political subdivisions of a State; and 15 (D) a not-for-profit entity that is in a part- 16 nership with not fewer than 6 entities described 17 in subparagraph (A), (B), or (C). 18 (3) PROGRAM.—The term ‘‘Program’’ means 19 the Rural and Municipal Utility Advanced Cyberse- 20 curity Grant and Technical Assistance Program es- 21 tablished under subsection (b). 22 (4) SECRETARY.—The term ‘‘Secretary’’ means 23 the Secretary of Energy. 24 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6401 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 7 •S 2556 RS (b) ESTABLISHMENT.—Not later than 180 days after 1 the date of enactment of this Act, the Secretary, in con- 2 sultation with the Federal Energy Regulatory Commis- 3 sion, the North American Electric Reliability Corporation, 4 and the Electricity Subsector Coordinating Council, shall 5 establish a program, to be known as the ‘‘Rural and Mu- 6 nicipal Utility Advanced Cybersecurity Grant and Tech- 7 nical Assistance Program’’, to provide grants and tech- 8 nical assistance to, and enter into cooperative agreements 9 with, eligible entities to protect against, detect, respond 10 to, and recover from cybersecurity threats. 11 (c) OBJECTIVES.—The objectives of the Program 12 shall be— 13 (1) to deploy advanced cybersecurity tech- 14 nologies for electric utility systems; and 15 (2) to increase the participation of eligible enti- 16 ties in cybersecurity threat information sharing pro- 17 grams. 18 (d) AWARDS.— 19 (1) IN GENERAL.—The Secretary— 20 (A) shall award grants and provide tech- 21 nical assistance under the Program to eligible 22 entities on a competitive basis; 23 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6401 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 8 •S 2556 RS (B) shall develop criteria and a formula for 1 awarding grants and providing technical assist- 2 ance under the Program; 3 (C) may enter into cooperative agreements 4 with eligible entities that can facilitate the ob- 5 jectives described in subsection (c); and 6 (D) shall establish a process to ensure that 7 all eligible entities are informed about and can 8 become aware of opportunities to receive grants 9 or technical assistance under the Program. 10 (2) PRIORITY FOR GRANTS AND TECHNICAL AS- 11 SISTANCE.—In awarding grants and providing tech- 12 nical assistance under the Program, the Secretary 13 shall give priority to an eligible entity that, as deter- 14 mined by the Secretary— 15 (A) has limited cybersecurity resources; 16 (B) owns assets critical to the reliability of 17 the bulk power system; or 18 (C) owns defense critical electric infra- 19 structure (as defined in section 215A(a) of the 20 Federal Power Act (16 U.S.C. 824o–1(a))). 21 (e) PROTECTION OF INFORMATION.—Information 22 provided to, or collected by, the Federal Government 23 under this section— 24 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6401 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 9 •S 2556 RS (1) shall be exempt from disclosure under sec- 1 tion 552(b)(3) of title 5, United States Code; and 2 (2) shall not be made available by any Federal 3 agency, State, political subdivision of a State, or 4 Tribal authority under any applicable law requiring 5 public disclosure of information or records. 6 (f) FUNDING.—There is authorized to be appro- 7 priated to carry out this section $50,000,000 for each of 8 fiscal years 2020 through 2024, to remain available until 9 expended. 10 SECTION 1. SHORT TITLE. 11 This Act may be cited as the ‘‘Protecting Resources On 12 The Electric grid with Cybersecurity Technology Act of 13 2019’’ or the ‘‘PROTECT Act of 2019’’. 14 SEC. 2. INCENTIVES FOR ADVANCED CYBERSECURITY 15 TECHNOLOGY INVESTMENT. 16 Part II of the Federal Power Act is amended by insert- 17 ing after section 219 (16 U.S.C. 824s) the following: 18 ‘‘SEC. 219A. INCENTIVES FOR CYBERSECURITY INVEST- 19 MENTS. 20 ‘‘(a) DEFINITIONS.—In this section: 21 ‘‘(1) ADVANCED CYBERSECURITY TECHNOLOGY.— 22 The term ‘advanced cybersecurity technology’ means 23 any technology, operational capability, or service, in- 24 cluding computer hardware, software, or a related 25 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 10 •S 2556 RS asset, that enhances the security posture of public 1 utilities through improvements in the ability to pro- 2 tect against, detect, respond to, or recover from a cy- 3 bersecurity threat (as defined in section 102 of the 4 Cybersecurity Act of 2015 (6 U.S.C. 1501)). 5 ‘‘(2) ADVANCED CYBERSECURITY TECHNOLOGY 6 INFORMATION.—The term ‘advanced cybersecurity 7 technology information’ means information relating 8 to advanced cybersecurity technology or proposed ad- 9 vanced cybersecurity technology that is generated by 10 or provided to the Commission or another Federal 11 agency. 12 ‘‘(b) STUDY.—Not later than 180 days after the date 13 of enactment of this section, the Commission, in consulta- 14 tion with the Secretary of Energy, the North American 15 Electric Reliability Corporation, the Electricity Subsector 16 Coordinating Council, and the National Association of Reg- 17 ulatory Utility Commissioners, shall conduct a study to 18 identify incentive-based, including performance-based, rate 19 treatments for the transmission and sale of electric energy 20 subject to the jurisdiction of the Commission that could be 21 used to encourage— 22 ‘‘(1) investment by public utilities in advanced 23 cybersecurity technology; and 24 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 11 •S 2556 RS ‘‘(2) participation by public utilities in cyberse- 1 curity threat information sharing programs. 2 ‘‘(c) INCENTIVE-BASED RATE TREATMENT.—Not later 3 than 1 year after the completion of the study under sub- 4 section (b), the Commission shall establish, by rule, incen- 5 tive-based, including performance-based, rate treatments for 6 the transmission of electric energy in interstate commerce 7 and the sale of electric energy at wholesale in interstate 8 commerce by public utilities for the purpose of benefitting 9 consumers by encouraging— 10 ‘‘(1) investments by public utilities in advanced 11 cybersecurity technology; and 12 ‘‘(2) participation by public utilities in cyberse- 13 curity threat information sharing programs. 14 ‘‘(d) FACTORS FOR CONSIDERATION.—In issuing a 15 rule pursuant to this section, the Commission may provide 16 additional incentives beyond those identified in subsection 17 (c) in any case in which the Commission determines that 18 an investment in advanced cybersecurity technology or in- 19 formation sharing program costs will reduce cybersecurity 20 risks to— 21 ‘‘(1) defense critical electric infrastructure (as 22 defined in section 215A(a)) and other facilities subject 23 to the jurisdiction of the Commission that are critical 24 to public safety, national defense, or homeland secu- 25 VerDate Sep 11 2014 21:36 Dec 18, 2019 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6203 E:\BILLS\S2556.RS S2556 kjohnson on DSK79L0C42 with BILLS 12 •S 2556 RS rity, as determined by the Commission in consulta- 1 tion with— 2 ‘‘(A) the Secretary of Energy; and 3 ‘‘(B) appropriate Federal agencies; and 4 ‘‘(2) faciliti [Text truncated for display. Full text available on Congress.gov.]