42 U.S.C. § 18725: Cybersecurity plan

Summary

The Secretary may require anyone who gets money under this division to give a cybersecurity plan before funds are paid and to keep improving cybersecurity while the project runs. The plan must explain how the recipient will protect networks, systems, devices, apps, and interfaces inside the project and at its boundaries, how it will keep checking for and fixing risks, how it will report known or suspected breaches to the Secretary, and how it will use applicable Department cyber programs like vulnerability testing and security engineering reviews. Recipients should use open standards when they can, such as the Department’s Cybersecurity Capability Maturity Model (or its successor) and NIST’s Framework for Improving Critical Infrastructure Cybersecurity, and must note any departures or use of proprietary standards. The Department’s Office of Cybersecurity, Energy Security, and Emergency Response will review the plans to fit them with DOE programs. Information that the Secretary reasonably believes could harm the physical or cyber security of any electric utility or the bulk‑power system is exempt from public release under 5 U.S.C. 552(b)(3) and must not be disclosed under federal, state, or tribal public‑records laws.

Title 42, §18725

The Public Health and Welfare, Source: USLM XML via OLRC

(a)In general

The Secretary may require, as the Secretary determines appropriate, a recipient of any award or other funding under this division—

(1)to submit to the Secretary, prior to the issuance of the award or other funding, a cybersecurity plan that demonstrates the cybersecurity maturity of the recipient in the context of the project for which that award or other funding was provided; and

(2)establish a plan for maintaining and improving cybersecurity throughout the life of the proposed solution of the project.

(b)Contents of cybersecurity plan

A cybersecurity plan described in subsection (a) shall, at a minimum, describe how the recipient described in that subsection— (1)

(2)will perform ongoing evaluation of cybersecurity risks to address issues as the issues arise throughout the life of the proposed solution;

(3)will report known or suspected network or system compromises of the project to the Secretary; and

(4)will leverage applicable cybersecurity programs of the Department, including cyber vulnerability testing and security engineering evaluations.

(c)Additional guidance

Each recipient described in subsection (a) should—

(1)maximize the use of open guidance and standards, including, wherever possible—

(A)the Cybersecurity Capability Maturity Model of the Department (or a successor model); and

(B)the Framework for Improving Critical Infrastructure Cybersecurity of the National Institute of Standards and Technology; and

(2)document—

(A)any deviation from open standards; and

(B)the utilization of proprietary standards where the recipient determines that such deviation necessary.

(d)Coordination

The Office of Cybersecurity, Energy Security, and Emergency Response of the Department shall review each cybersecurity plan submitted under subsection (a) to ensure integration with Department research, development, and demonstration programs.

(e)Protection of information

Information provided to, or collected by, the Federal Government pursuant to this section the disclosure of which the Secretary reasonably foresees could be detrimental to the physical security or cybersecurity of any electric utility or the bulk-power system—

(1)shall be exempt from disclosure under section 552(b)(3) of title 5; and

(2)shall not be made available by any Federal agency, State, political subdivision of a State, or Tribal authority pursuant to any Federal, State, political subdivision of a State, or Tribal law, respectively, requiring public disclosure of information or records.

Notes & Related Subsidiaries

Editorial Notes

References in Text

This division, referred to in subsec. (a), is div. D of Pub. L. 117–58, Nov. 15, 2021, 135 Stat. 923, which enacted this chapter and enacted and amended numerous other sections and notes in the Code. For complete classification of div. D to the Code, see Tables.

Statutory Notes and Related Subsidiaries

Wage Rate RequirementsFor provisions relating to rates of wages to be paid to laborers and mechanics on projects for

Construction

, alteration, or repair work funded under div. D or an amendment by div. D of Pub. L. 117–58, including authority of Secretary of Labor, see section 18851 of this title.

§18725 Cybersecurity Plan