; (ii) changes to processes or operational procedures that do not require a change in human behavior; and (iii) training techniques to increase the capacity of employees to actively identify, prevent, or neutralize the impact of cyber attacks; and (E) evaluate existing engineering and technical design criteria and guidelines that incorporate human factors research findings, and recommend criteria and guidelines for industrial control system cybersecurity tools that can be used to develop procurement guidance, including guidance for alarms, displays, and layouts. (4) Consultation In conducting the study, the Secretary shall consult with electricity sector stakeholders, professionals with expertise in human factors research, private sector industrial control system vendors, and other relevant parties. (5) Report Not later than 24 months after the date of enactment of this Act, the Secretary shall submit to the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Energy and Natural Resources of the Senate a report on the results of the study, including the findings of the Secretary on each of the items described in paragraph (3). (b) Balancing risks, security, and modernization of industrial systems (1) Study The Secretary, in collaboration with the National Institute of Standards and Technology, other Federal agencies, and electricity sector stakeholders, shall examine the risks associated with increasing penetration of digital technologies in operational networks. (2) Content The study shall— (A) evaluate the relative qualitative risks and benefits of various design and architecture options for electricity sector industrial control systems, including consideration of— (i) designs that include both digital and analog control devices and technologies; (ii) different communication technologies used to move information and data between control system devices, technologies, and system operators; (iii) automated and human-in-the-loop devices and technologies