§18722 Energy Cyber Sense Program

Summary

The Secretary of Energy must set up a voluntary Energy Cyber Sense program, working with the Secretary of Homeland Security and other federal agencies, to test the cybersecurity of products and technologies used in the energy sector, including those for the bulk-power system (as defined in 16 U.S.C. 824o(a)). bulk-power system — the term has the meaning given in 16 U.S.C. 824o(a). program — the voluntary Energy Cyber Sense program. The program must test products and technologies (including industrial control and operational tech like SCADA), keep a vulnerability reporting system and database tied to federal coordination, help utilities and manufacturers fix problems, review tested items every two years and report on how they handle cyber threats, make buying guidance, give public notice and seek comments before making or changing the testing process, run the tests, and consider incentives to encourage using test results in product design. Information that could harm physical security or cybersecurity must be exempt from disclosure under section 552(b)(3) of title 5 and must not be released under federal, state, or tribal public-record laws. The program does not allow suing the United States over testing done under it.