Last night the Senate leadership finally came to an agreement on the substitute language that will be considered in the Senate for HR 3684. This was offered as amendment SA 2137 (pg S 5255) with an easier to read Committee Print available. The consideration process on the floor starts in earnest today and we will be seeing a number of amendments offered and considered.
Incorporating Existing Bills
As was expected, there are many cybersecurity provisions included in this bill. They include the incorporation of five bills that have been introduced in the House or Senate:
HR 2931 as §40121. Enhancing grid security through public-private partnerships.
HR 3138 as Division G, Subtitle B—State and Local Cybersecurity Improvement Act,
S 1316 as Division G, Subtitle A—Cyber Response and Recovery Act,
S 1400 as §40123. Incentives for advanced cybersecurity technology investment, and §40124. Rural and municipal utility advanced cybersecurity grant and technical assistance program,
S 2199 as §40122. Energy Cyber Sense program.
I have not had a chance to do a detailed comparison of the provisions in this amendment and the original bills to see if any changes have been made.
New Cybersecurity Provisions
The bill includes five sections that provide detailed cyber security requirements. They include:
§11510. Cybersecurity tool; cyber coordinator (pg 432),
§25022. GAO cybersecurity recommendations (pg 1182),
§40125. Enhanced grid security (pg 1403),
§40126. Cybersecurity plan (pg 1409),
§50113. Cybersecurity support for public water systems.
Section 11510 requires the Federal Highway Administration (FHA) to “develop a tool to assist transportation authorities in identifying, detecting, protecting against, responding to, and recovering from cyber incidents” {§11510(b)(1)}. It also requires FHA to establish a cyber coordinator that would “be responsible for and advising transportation authorities of cyber incidents” {§11510(c)(1)}.
Section 25022 would require DOT to implement the cybersecurity risk management recommendation found in the 2019 GAO report “Agencies Need to Fully Establish Risk Management Programs and Address Challenges”.
Section 40125 includes the following requirements:
Cybersecurity for the energy sector research, development, and demonstration program,
Energy sector operational support for cyberresilience program, and
Modeling and assessing energy infrastructure risk,
Section 40126 authorizes DOE to require grant recipients to submit a cybersecurity plan to DOE before receiving the grant monies. It does mandate what such a cybersecurity plan would include.
Section 50113 amends the Safe Drinking Water Act by adding a new §1420A, Cybersecurity support for public water systems. It includes provisions for the development of
A prioritization framework to identify public water systems that, if degraded or rendered inoperable due to an incident, would lead to significant impacts on the health and safety of the public, and
A technical cybersecurity support plan,
The bill also includes 27 instances of cybersecurity mentions in passing.
Other Amendments Proposed
The amendment process for this bill was actually started on Friday with four amendments submitted, none of which are of interest here. There were no amendments proposed on Saturday, but there seven other amendments submitted yesterday. Those include the following amendment of interest here:
SA 2134, Sen King (I,ME) adding the following to Division G, Title IV: Subtitle C—National Cyber Resilience Assistance Fund,
There will certainly be other amendments submitted in the coming days. The Democrats hope to finish the consideration of this bill by Friday so that the Senate can proceed with their scheduled Summer Recess, but there are reports that Sen Schumer is prepared to hold the Senate in session until the bill is passed.