Bills Introduced – 07-11-19

Yesterday with both the House and Senate in session there were 64 bills introduced. Four of those bills may see additional coverage in this blog:

HR 3699 To codify the Transportation Security Administration's responsibility relating to securing pipelines against cybersecurity threats, acts of terrorism, and other nefarious acts that jeopardize the physical security or cybersecurity of pipelines, and for other purposes. Rep. Cleaver, Emanuel [D-MO-5]

HR 3710 To amend the Homeland Security Act of 2002 to provide for the remediation of cybersecurity vulnerabilities, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]

HR 3714 To amend title 18, United States Code, to reauthorize and expand the National Threat Assessment Center of the Department of Homeland Security. Rep. Deutch, Theodore E. [D-FL-22]

S 2095 A bill to provide for certain programs and developments in the Department of Energy concerning the cybersecurity and vulnerabilities of, and physical threat to, the electric grid, and for other purposes. Sen. Gardner, Cory [R-CO]

I will be watching HR 3710 and S 2095 for specific language referring to industrial control system security issues. For HR 3714 I will be watching for general cybersecurity language while hoping for ICS mentions.

TSA Pipeline Security ICR

The TSA published a 60-day advance notice of intent to file a new information collection request (ICR) with the Office of Management and Budget (OMB) to allow TSA to collect information during planned Pipeline Corporate Security Reviews (PCSR). According to the ICR the “The Pipeline Corporate Security Review is a new information collection request that will assess domain awareness, threat prevention, and security awareness at various pipeline sites across the nation” (74 FR 42086). Comments on the proposed ICR are requested by October 19th. TSA is not handling the request for comments through the Regulations.gov web site that DHS normally uses for such ICR’s and no docket number is provided in the Federal Register Notice. Comments can be mailed to:

Ginger LeMay PRA Officer Office of Information Technology Transportation Security Administration 601 South 12th Street Arlington, VA 20598-6011

TSA plans to establish the PCSR program to allow TSA ‘subject matter experts) to conduct pipeline site visits and collect information on ten subject areas from the owner/operator of the pipeline. Those subject areas would be:

(1) Management and oversight of the security plan, (2) Threat assessment, (3) Criticality, (4) Vulnerability assessment, (5) Credentialing, (6) Training, (7) Physical security countermeasures, (8) Information technology security, (9) Security exercises and drills, and (10) Incident management and communications.

TSA maintains that the information collection would only take place in face-to-face meetings at the owner/operator’s location. TSA plans on conducting twelve of these 8 hour meetings per year at a potential 2,200 locations. Based on this count they expect the collection to take 100 hours/year of agency time and be done at no cost to the owner/operators (eight hours of owner/operator time costs nothing?).