Consequently, the secure operation of both the power grid and pipelines are national priorities. While physical threats to the U.S. power grid and pipelines have long worried policymakers, cyber threats to the computer systems that operate this critical infrastructure are an increasing concern. Furthermore, with ever greater physical interdependency between electricity generators and the natural gas pipelines which supply their fuel, many in Congress recognize that grid and pipeline cybersecurity are intertwined. The Department of Energy (DOE) is the lead agency for the protection of electric power, oil, and natural gas infrastructure—cooperating with the Department of Homeland Security (DHS), the lead agency for pipelines. DOE's energy sector cybersecurity activities are led primarily by its Office of Electricity Delivery and Energy Reliability (OE). In 2015, the Fixing America's Surface Transportation Act (the FAST Act) provided the Secretary of Energy with additional authority to order measures to protect or restore the reliability of the power grid during a grid security emergency, including "a malicious act using electronic communication." The 115 th Congress is considering additional legislation to fund and expand DOE's cybersecurity programs, including appropriations in the Defense, Military Construction, Veterans Affairs, Legislative Branch, and Energy and Water Development National Security Appropriations Act, 2018 ( H.R. 3219 ) and the Energy and Water Development and Related Agencies Appropriations Act, 2018 ( S. 1609 ). The Energy and Natural Resources Act of 2017 (S. 1460) and the Enhancing State Energy Security Planning and Emergency Preparedness Act of 2017 ( H.R. 3050 ) would authorize additional DOE funding for cybersecurity research and assistance to states, respectively. OE Cybersecurity Program Structure

The OE's cybersecurity program for energy delivery systems is structured around three areas: (1) cybersecurity preparedness; (2) cyber incident response and recovery; and (3) research, development, and demonstration. It would establish a program for energy sector cybersecurity RD&D to be carried out by DOE, in consultation with other agencies, states, and the energy sector, for advanced applications to identify and mitigate cyber vulnerabilities. Given the ever-changing cybersecurity environment in the energy sector, Congress may continue to examine OE's cybersecurity resources to ensure that they are adequate and being deployed appropriately to address the most important energy delivery risks. With DOE-provided or independently provided information, Congress may have a more-informed basis for considering whether to adjust the provisions of the FAST Act or clarify, expand, or contract the authorizations it contains. Among its recommendations, the QER calls for assessment of natural gas and electricity infrastructure interdependencies to cybersecurity protection. How OE's cybersecurity programs and expertise in energy delivery systems could best be used to inform such analysis may be of interest to Congress. Congress may examine how OE's cybersecurity activities fit in, and coordinate with, the other various roles in energy cybersecurity for electricity, oil and natural gas pipelines, and other related energy infrastructure. In particular, Congress may examine how OE's RD&D programs and other work with the National Labs in electric power sector cybersecurity supports federal and private sector efforts in pipeline cybersecurity.
While physical threats to the U.S. power grid and pipelines have long worried policymakers, cyber threats to the computer systems that operate this critical infrastructure are an increasing concern. Cybersecurity risks against the power and pipeline sectors are similar, as both use similar control systems, and there appears to be a broad consensus that cyber threats to this infrastructure are on the rise. Furthermore, with ever-greater physical interdependency between electricity generators and the natural gas pipelines that supply their fuel, many in Congress recognize that grid and pipeline cybersecurity are intertwined. In 2015, the Fixing America's Surface Transportation Act (the FAST Act) provided the Secretary of Energy with new authority to protect or restore the power grid during a grid security emergency, including a cyber incident. Congress is considering additional legislation to fund and expand the Department of Energy's cybersecurity programs.
The Department of Energy (DOE) is the lead agency for the protection of electric power, oil, and natural gas infrastructure—cooperating with the Department of Homeland Security, the lead agency for pipelines. DOE's cybersecurity activities are led by its Office of Electricity Delivery and Energy Reliability (OE) and structured around three areas: (1) cybersecurity preparedness, (2) cyber incident response and recovery, and (3) research, development, and demonstration. Although nominally applicable to energy delivery systems across the electric power, oil and natural gas, and pipeline sectors, OE's cybersecurity activities to date appear to have been focused primarily on the grid. Publicly available examples of DOE-supported activities specifically focused on pipeline cybersecurity are limited. Rather, pipeline cybersecurity efforts appear to be included as part of broader national cybersecurity efforts.
Several bills potentially affecting DOE's cybersecurity activities for power grid and pipeline infrastructure have been introduced in the 115th Congress. These include the Defense, Military Construction, Veterans Affairs, Legislative Branch, and Energy and Water Development National Security Appropriations Act, 2018 (H.R. 3219) and the Energy and Water Development and Related Agencies Appropriations Act, 2018 (S. 1609), both of which would modestly increase funding for OE in FY2018. The Energy and Natural Resources Act of 2017 (S. 1460) would establish and fund a DOE program for energy sector cybersecurity research, development, and demonstration (RD&D) to be carried out for advanced applications to identify and mitigate cyber vulnerabilities. The Enhancing State Energy Security Planning and Emergency Preparedness Act of 2017 (H.R. 3050) would authorize DOE to provide financial and technical assistance to states for assessing cybersecurity threats to energy infrastructure.
As federal cybersecurity oversight and legislative debate continue, Congress may focus on several key issues. Given the ever-changing cybersecurity environment in the energy sector, Congress may continue to examine OE's cybersecurity resources to ensure that they are adequate and being deployed appropriately to address the most important energy delivery risks. Congress may also seek a more-informed basis for considering whether to adjust the provisions of the FAST Act or clarify the authorizations it contains. How OE's programs and expertise could best be used to inform analysis of electric power and natural gas infrastructure interdependency from a cybersecurity perspective may also be of interest to Congress. Finally, Congress may examine how OE's cybersecurity activities fit in, and coordinate with, the other various roles in energy cybersecurity for electricity, oil and natural gas pipelines. In particular, Congress may examine how OE's RD&D programs and work with the National Labs in electric power sector cybersecurity supports federal and private sector efforts in pipeline cybersecurity.