← Back to Bills
H.R. 680House116th Congress (2019-2021)In Committee

Securing Energy Infrastructure Act

Sponsored by C. A. Dutch RuppersbergerRep. C. A. Dutch Ruppersberger (D-MD)
Introduced January 17, 2019

AI-Generated Summary

Updated April 14, 2026 at 12:38 AM UTC

The Securing Energy Infrastructure Act creates a two‑year pilot program to help identify and address cybersecurity weaknesses in the nation’s energy sector. The Department of Energy, working with national laboratories and voluntary energy companies, will test new ways to protect industrial control systems. A multi‑agency working group will develop a national strategy, and the program’s results must be reported to Congress. The bill also shields participating entities from liability and keeps shared information confidential.

Key Provisions

  • Defines “covered entities” as critical energy infrastructure identified under Executive Order 13636 and clarifies terms like “exploit” and “industrial control system.”
  • Directs the Energy Secretary to launch a two‑year pilot program within national labs, partnering with willing energy firms to find new security vulnerabilities and evaluate protective technologies for control systems, including analog, purpose‑built, and physical controls.
  • Requires the Secretary to form a working group of at least ten members from agencies such as DOE, DHS, the electric reliability corporation, the nuclear regulator, intelligence, defense, state energy agencies, academia, and the national labs to assess program technology and craft a cyber‑informed engineering strategy.
  • Mandates an interim report within 180 days of the first funding and a final report two years later, detailing program results, feasibility analyses, and working‑group findings.
  • Makes any information shared under the program confidential and exempt from FOIA and similar disclosure laws.
  • Provides liability protection for covered entities that voluntarily participate in the program, preventing lawsuits for those activities.
  • Specifies that the bill does not grant new regulatory authority to any federal agency.
  • Authorizes $10 million for the pilot program and $1.5 million for the working group and reporting activities, with funds available until spent.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

2 earlier actions
HouseCommittee Latest Action

Referred to the Subcommittee on Energy.

Energy Subcommittee

February 12, 2019

View full timeline
HouseIntro Referral

Introduced in House

January 17, 2019

HouseIntro Referral

Referred to the House Committee on Science, Space, and Technology.

Science, Space, and Technology Committee

January 17, 2019

HouseCommittee

Referred to the Subcommittee on Energy.

Energy Subcommittee

February 12, 2019

Bill Text

Latest available legislative text

Reading Mode
Latest
Raw Text PDF XML
Introduced in HouseIssued January 17, 2019

I

116th CONGRESS

1st Session

H. R. 680

IN THE HOUSE OF REPRESENTATIVES

January 17, 2019

Mr. Ruppersberger (for himself and Mr. Carter of Texas) introduced the following bill; which was referred to the Committee on Science, Space, and Technology

A BILL

To provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector.

1.

Short title

This Act may be cited as the Securing Energy Infrastructure Act.

2.

Definitions

In this Act:

(1)

Appropriate committee of Congress

The term appropriate committee of Congress means—

(A)

the Select Committee on Intelligence, the Committee on Homeland Security and Governmental Affairs, and the Committee on Energy and Natural Resources of the Senate; and

(B)

the Permanent Select Committee on Intelligence, the Committee on Homeland Security, and the Committee on Energy and Commerce of the House of Representatives.

(2)

Covered entity

The term covered entity means an entity identified pursuant to section 9(a) of Executive Order 13636 of February 12, 2013 (78 Fed. Reg. 11742), relating to identification of critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.

(3)

Exploit

The term exploit means a software tool designed to take advantage of a security vulnerability.

(4)

Industrial control system

(A)

In general

The term industrial control system means an operational technology used to measure, control, or manage industrial functions.

(B)

Inclusions

The term industrial control system includes supervisory control and data acquisition systems, distributed control systems, and programmable logic or embedded controllers.

(5)

National Laboratory

The term National Laboratory has the meaning given the term in section 2 of the Energy Policy Act of 2005 (42 U.S.C. 15801).

(6)

Program

The term Program means the pilot program established under section 3.

(7)

Secretary

The term Secretary means the Secretary of Energy.

(8)

Security vulnerability

The term security vulnerability means any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of a security control.

3.

Pilot program for securing energy infrastructure

Not later than 180 days after the date of enactment of this Act, the Secretary shall establish a 2-year control systems implementation pilot program within the National Laboratories for the purposes of—

(1)

partnering with covered entities in the energy sector (including critical component manufacturers in the supply chain) that voluntarily participate in the Program to identify new classes of security vulnerabilities of the covered entities; and

(2)

evaluating technology and standards, in partnership with covered entities, to isolate and defend industrial control systems of covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities, including—

(A)

analog and nondigital control systems;

(B)

purpose-built control systems; and

(C)

physical controls.

4.

Working group to evaluate program standards and develop strategy

(a)

Establishment

The Secretary shall establish a working group—

(1)

to evaluate the technology and standards used in the Program under section 3(2); and

(2)

to develop a national cyber-informed engineering strategy to isolate and defend covered entities from security vulnerabilities and exploits in the most critical systems of the covered entities.

(b)

Membership

The working group established under subsection (a) shall be composed of not fewer than 10 members, to be appointed by the Secretary, at least 1 member of which shall represent each of the following:

(1)

The Department of Energy.

(2)

The energy industry, including electric utilities and manufacturers recommended by the Energy Sector coordinating councils.

(3)
(A)

The Department of Homeland Security; or

(B)

the Industrial Control Systems Cyber Emergency Response Team.

(4)

The North American Electric Reliability Corporation.

(5)

The Nuclear Regulatory Commission.

(6)
(A)

The Office of the Director of National Intelligence; or

(B)

the intelligence community (as defined in section 3 of the National Security Act of 1947 (50 U.S.C. 3003)).

(7)
(A)

The Department of Defense; or

(B)

the Assistant Secretary of Defense for Homeland Security and America's Security Affairs.

(8)

A State or regional energy agency.

(9)

A national research body or academic institution.

(10)

The National Laboratories.

5.

Reports on the Program

(a)

Interim report

Not later than 180 days after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress an interim report that—

(1)

describes the results of the Program;

(2)

includes an analysis of the feasibility of each method studied under the Program; and

(3)

describes the results of the evaluations conducted by the working group established under section 4(a).

(b)

Final report

Not later than 2 years after the date on which funds are first disbursed under the Program, the Secretary shall submit to the appropriate committees of Congress a final report that—

(1)

describes the results of the Program;

(2)

includes an analysis of the feasibility of each method studied under the Program; and

(3)

describes the results of the evaluations conducted by the working group established under section 4(a).

6.

Exemption from disclosure

Information shared by or with the Federal Government or a State, Tribal, or local government under this Act shall be—

(1)

deemed to be voluntarily shared information;

(2)

exempt from disclosure under section 552 of title 5, United States Code, or any provision of any State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring the disclosure of information or records; and

(3)

withheld from the public, without discretion, under section 552(b)(3) of title 5, United States Code, or any provision of a State, Tribal, or local law requiring the disclosure of information or records.

7.

Protection from liability

(a)

In general

A cause of action against a covered entity for engaging in the voluntary activities authorized under section 3—

(1)

shall not lie or be maintained in any court; and

(2)

shall be promptly dismissed by the applicable court.

(b)

Voluntary activities

Nothing in this Act subjects any covered entity to liability for not engaging in the voluntary activities authorized under section 3.

8.

No new regulatory authority for Federal agencies

Nothing in this Act authorizes the Secretary or the head of any other department or agency of the Federal Government to issue new regulations.

9.

Authorization of appropriations

(a)

Pilot Program

There is authorized to be appropriated $10,000,000 to carry out section 3.

(b)

Working Group and Report

There is authorized to be appropriated $1,500,000 to carry out sections 4 and 5.

(c)

Availability

Amounts made available under subsections (a) and (b) shall remain available until expended.