Aiming to identify, enhance, and test supply chain vulnerabilities in the energy sector and cybersecurity response capabilities between public and private sectors, the U.S. Senate Committee on Energy & Natural Resources approved legislation that directs the Department of Energy (DoE) to create several new programs towards the development of “advanced cybersecurity applications and technologies” for the sector.[1]  The Energy Cybersecurity Act of 2019 (the Act) directs DoE to establish programs that identify supply chain vulnerabilities and expand Federal cooperation and coordination for responses to cyber threats.

If passed, the Act will require the DoE to:

  1. Establish a program to enhance advanced energy sector cybersecurity technologies and applications by leveraging electric grid architecture to assess potential risks to critical infrastructure and security preparedness. The DoE is instructed to advance the security of field devices and third-party control systems, evaluate whether the systems are implicated in the generation, transmission, and distribution of energy and determine best practices for forensic analysis of infected systems and secure communications.
  2. Establish a program to test and identify potential vulnerabilities to the energy sector, including supply chain components, which would allow DoE to oversee third-party testing of the energy sector’s cybersecurity measures and directs the agency to develop procurement guidelines for supply chain components.
  3. Establish a program that provides operational support to the energy sector for cybersecurity resilience. The Act notes that the program should enhance and test emergency response capabilities, expand cooperation between DoE and the intelligence community, enhance existing tools such as the Electricity Information Sharing and Analysis Center (E-ISAC), and provide technical assistance to small stakeholders to assess their cybersecurity.
  4. Develop an advanced energy security program that (1) identifies vulnerabilities and provides modeling to predict potential impacts to the energy sector; (2) develops physical and cybersecurity models; (3) conducts exercise to mitigate vulnerabilities; (4) researches electrical grid components that may be susceptible to cybersecurity threats; and (5) provides technical assistance to States and other entities that will promote the development of industry-wide standards and risk analyses. This program should evaluate how applications and technologies will mitigate vulnerabilities; for example, DoE should consider potential dependencies on other critical infrastructure and impacts from weather and fuel supply interruptions.
  5. In consultation with the Federal Energy Regulatory Commission (FERC), develop and conduct a study within 180 days of the bill’s enactment to evaluate management structures and funding mechanisms that will encourage industry stakeholders to participate in E-ISAC.

The Act authorizes appropriations for DoE to implement these programs.

Although the bill has been passed out of committee, it is unclear if and when the bill will be brought to the floor for a vote. If passed, the Act would take effect 90 days after enactment.

[1] S. 2333, Energy Cybersecurity Act of 2019, available at https://www.congress.gov/bill/116th-congress/senate-bill/2333.

Print:
EmailTweetLikeLinkedIn
Photo of Jeffrey L. Poston Jeffrey L. Poston

Jeff Poston is a partner in Crowell & Moring’s Washington, D.C. office, where he serves as a member of the Litigation Group and co-chair of the firm’s Chambers recognized Privacy & Cybersecurity Group. A seasoned trial lawyer with more than 25 years of…

Jeff Poston is a partner in Crowell & Moring’s Washington, D.C. office, where he serves as a member of the Litigation Group and co-chair of the firm’s Chambers recognized Privacy & Cybersecurity Group. A seasoned trial lawyer with more than 25 years of experience leading investigations and litigation for corporate clients, Jeff counsels and defends clients in complex data protection matters involving class-actions and
regulatory enforcement actions, as well as commercial disputes. Jeff also counsels businesses on both domestic and international privacy compliance matters, including the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

Photo of Tyler A. O'Connor Tyler A. O'Connor

Tyler O’Connor is an energy litigator in Crowell & Moring’s Washington, D.C. office, where he represents clients in the federal appellate and trial courts, arbitration, state court, and before the Department of Energy, Federal Energy Regulatory Commission, and the Department of Interior.
Tyler…

Tyler O’Connor is an energy litigator in Crowell & Moring’s Washington, D.C. office, where he represents clients in the federal appellate and trial courts, arbitration, state court, and before the Department of Energy, Federal Energy Regulatory Commission, and the Department of Interior.
Tyler represents energy industry clients in civil litigation, enforcement matters, and in disputes against the government.

Photo of Amber Mulcare Amber Mulcare

Amber Mulcare (CIPP-US) is an associate in Crowell & Moring’s Washington, D.C. office and a member of the firm’s Health Care and Privacy & Cybersecurity groups. She represents health insurance plans, health systems, major technology companies, government contractors, and other clients on a…

Amber Mulcare (CIPP-US) is an associate in Crowell & Moring’s Washington, D.C. office and a member of the firm’s Health Care and Privacy & Cybersecurity groups. She represents health insurance plans, health systems, major technology companies, government contractors, and other clients on a variety of digital health, privacy, and security matters.