Aiming to identify, enhance, and test supply chain vulnerabilities in the energy sector and cybersecurity response capabilities between public and private sectors, the U.S. Senate Committee on Energy & Natural Resources approved legislation that directs the Department of Energy (DoE) to create several new programs towards the development of “advanced cybersecurity applications and technologies” for the sector.[1]  The Energy Cybersecurity Act of 2019 (the Act) directs DoE to establish programs that identify supply chain vulnerabilities and expand Federal cooperation and coordination for responses to cyber threats.

If passed, the Act will require the DoE to:

  1. Establish a program to enhance advanced energy sector cybersecurity technologies and applications by leveraging electric grid architecture to assess potential risks to critical infrastructure and security preparedness. The DoE is instructed to advance the security of field devices and third-party control systems, evaluate whether the systems are implicated in the generation, transmission, and distribution of energy and determine best practices for forensic analysis of infected systems and secure communications.
  2. Establish a program to test and identify potential vulnerabilities to the energy sector, including supply chain components, which would allow DoE to oversee third-party testing of the energy sector’s cybersecurity measures and directs the agency to develop procurement guidelines for supply chain components.
  3. Establish a program that provides operational support to the energy sector for cybersecurity resilience. The Act notes that the program should enhance and test emergency response capabilities, expand cooperation between DoE and the intelligence community, enhance existing tools such as the Electricity Information Sharing and Analysis Center (E-ISAC), and provide technical assistance to small stakeholders to assess their cybersecurity.
  4. Develop an advanced energy security program that (1) identifies vulnerabilities and provides modeling to predict potential impacts to the energy sector; (2) develops physical and cybersecurity models; (3) conducts exercise to mitigate vulnerabilities; (4) researches electrical grid components that may be susceptible to cybersecurity threats; and (5) provides technical assistance to States and other entities that will promote the development of industry-wide standards and risk analyses. This program should evaluate how applications and technologies will mitigate vulnerabilities; for example, DoE should consider potential dependencies on other critical infrastructure and impacts from weather and fuel supply interruptions.
  5. In consultation with the Federal Energy Regulatory Commission (FERC), develop and conduct a study within 180 days of the bill’s enactment to evaluate management structures and funding mechanisms that will encourage industry stakeholders to participate in E-ISAC.

The Act authorizes appropriations for DoE to implement these programs.

Although the bill has been passed out of committee, it is unclear if and when the bill will be brought to the floor for a vote. If passed, the Act would take effect 90 days after enactment.

[1] S. 2333, Energy Cybersecurity Act of 2019, available at https://www.congress.gov/bill/116th-congress/senate-bill/2333.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Evan D. Wolff Evan D. Wolff

Evan D. Wolff is a partner in Crowell & Moring’s Washington, D.C. office, where he is co-chair of the firm’s Chambers USA-ranked Privacy & Cybersecurity Group and a member of the Government Contracts Group. Evan has a national reputation for his deep technical…

Evan D. Wolff is a partner in Crowell & Moring’s Washington, D.C. office, where he is co-chair of the firm’s Chambers USA-ranked Privacy & Cybersecurity Group and a member of the Government Contracts Group. Evan has a national reputation for his deep technical background and understanding of complex cybersecurity legal and policy issues. Calling upon his experiences as a scientist, program manager, and lawyer, Evan takes an innovative approach to developing blended legal, technical, and governance mechanisms to prepare companies with rapid and comprehensive responses to rapidly evolving cybersecurity risks and threats. Evan has conducted training and incident simulations, developed response plans, led privileged investigations, and advised on hundreds of data breaches where he works closely with forensic investigators. Evan also counsels businesses on both domestic and international privacy compliance matters, including the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA). He is also a Registered Practitioner under the Cybersecurity Maturity Model Certification (CMMC) framework.

Photo of Jeffrey L. Poston Jeffrey L. Poston

Jeff Poston is a partner in Crowell & Moring’s Washington, D.C. office, where he serves as co-chair of the firm’s Chambers USA-ranked Privacy & Cybersecurity Group and is a member of the Litigation Group. A seasoned trial lawyer with more than 25 years…

Jeff Poston is a partner in Crowell & Moring’s Washington, D.C. office, where he serves as co-chair of the firm’s Chambers USA-ranked Privacy & Cybersecurity Group and is a member of the Litigation Group. A seasoned trial lawyer with more than 25 years of experience leading investigations and litigation for corporate clients, Jeff counsels and defends clients in complex data protection matters involving class-actions and regulatory enforcement actions, as well as commercial disputes. Jeff also counsels businesses on both domestic and international privacy compliance matters, including the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

Photo of Kate M. Growley, CIPP/G, CIPP/US Kate M. Growley, CIPP/G, CIPP/US

Kate M. Growley (CIPP/US, CIPP/G) is a director in Crowell & Moring International’s Southeast Asia regional office. Drawing from over a decade of experience as a practicing attorney in the United States, Kate helps her clients navigate and shape the policy and regulatory…

Kate M. Growley (CIPP/US, CIPP/G) is a director in Crowell & Moring International’s Southeast Asia regional office. Drawing from over a decade of experience as a practicing attorney in the United States, Kate helps her clients navigate and shape the policy and regulatory environment for some of the most complex data issues facing multinational companies, including cybersecurity, privacy, and digital transformation. Kate has worked with clients across every major sector, with particular experience in technology, health care, manufacturing, and aerospace and defense. Kate is a Certified Information Privacy Professional (CIPP) in both the U.S. private and government sectors by the International Association of Privacy Professionals (IAPP). She is also a Registered Practitioner with the U.S. Cybersecurity Maturity Model Certification (CMMC) Cyber Accreditation Body (AB).

Photo of Maida Oringher Lerner Maida Oringher Lerner

Maida Lerner is senior counsel in Crowell & Moring’s Washington, D.C. office and a part of the firm’s Privacy & Cybersecurity, Government Contracts, and Environment & Natural Resources groups. Maida counsels a broad group of clients in a variety of sectors on cyber…

Maida Lerner is senior counsel in Crowell & Moring’s Washington, D.C. office and a part of the firm’s Privacy & Cybersecurity, Government Contracts, and Environment & Natural Resources groups. Maida counsels a broad group of clients in a variety of sectors on cyber and physical security compliance and risk management, homeland security, and administrative matters, including trade associations and companies in the pipeline, transportation, government contracts, education, health care, and manufacturing sectors.