HR 1148 Introduced – Energy Cybersecurity Reporting

Last month, Rep Walberg (R,MI) introduced HR 1148, the Critical Electric Infrastructure Cybersecurity Incident Reporting Act. The bill would make DOE the designated agency to receive cybersecurity incident reports from critical electric infrastructure. It would also require DOE to publish regulations covering those reporting requirements. No spending is authorized in the bill.

An identical bill, HR 1160, was introduced three days later by Walberg. That version was considered by the Subcommittee on Energy, Climate, and Grid Security Markup of the House Energy, Climate, and Grid Security Committee on February 28^th, 2023. That bill was recommended to the full Committee by a voice vote.

There is no telling why identical pieces of legislation were introduced days apart by the same person. Probably some sort of administrative mix-up in Walberg’s office.

Review - HR 1160 Introduced – DOE Cybersecurity Reporting

Last week Rep Walberg (R,MI) introduced HR 1160, the Critical Electric Infrastructure Cybersecurity Incident Reporting Act. The bill would make DOE the designated agency to receive cybersecurity incident reports from critical electric infrastructure. It would also require DOE to publish regulations covering those reporting requirements. No spending is authorized in the bill.

The bill amends 16 USC 824o–1, Critical electric infrastructure security.

Moving Forward

As I reported earlier today, the Subcommittee on Energy, Climate, and Grid Security of the House Energy and Commerce Committee will hold a markup hearing that includes this bill. This indicates that the Committee leadership considers this an important bill. It is likely that there will be at least some level of bipartisan support for this bill. Moving this bill to the floor of the full House may be difficult because these reporting requirements conflict with the requirements of Cyber Incident Reporting for Critical Infrastructure Act of 2022 (Division Y of PL 117-103) that designate CISA as the agency to receive cybersecurity incident reports and sets a 72 hour reporting standard.

 

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-1160-introduced - subscription required.

Bills Introduced – 2-24-23

Yesterday, with the House meeting in pro forma session, there were 57 bills introduced. Two of those bills may receive additional attention in this blog:

HR 1160 To direct the Secretary of Energy to promulgate regulations to facilitate the timely submission of notifications regarding cybersecurity incidents and potential cybersecurity incidents with respect to critical electric infrastructure, and for other purposes. Walberg, Tim [Rep.-R-MI-5]

HR 1187 To modify the requirements for the registration of certain aircraft, and for other purposes. Lynch, Stephen F. [Rep.-D-MA-8]

I will be covering HR 1160.

I will be watching HR 1187 for language and definition that would specifically apply to unmanned aircraft systems. This could have nothing to do with UAS, but you cannot tell from this description.