HR5062-119

1. Short title This Act may be cited as the Pipeline Security Act.

2. Pipeline transportation and pipeline facilities security responsibilities Subtitle D of title XV of the Implementing Recommendations of the 9/11 Commission Act of 2007 (6 U.S.C. 1201 et seq.) is amended by adding at the end the following new section: The Administrator of the Transportation Security Administration shall maintain responsibility, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency of the Department, as appropriate, for securing pipeline transportation and pipeline facilities (as such terms are defined in section 60101 of title 49, United States Code) against cybersecurity threats (as such term is defined in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650)), acts of terrorism (as such term is defined in section 3077 of title 18, United States Code), and other security threats. In carrying out subsection (a), the Administrator of the Transportation Security Administration shall carry out the following: Ensure the development and updating, in consultation with relevant Federal, State, local, Tribal, and territorial entities and public and private sector stakeholders, as applicable, of guidelines, consistent with the National Institute of Standards and Technology Framework for Improvement of Critical Infrastructure Cybersecurity (and any update to such Framework) pursuant to section 2(c)(15) of the National Institute for Standards and Technology Act (15 U.S.C. 272(c)(15)), to improve the security of pipeline transportation and pipeline facilities against cybersecurity threats, acts of terrorism, and other security threats. Promulgate any additional security directives or regulations as the Administrator determines necessary to secure pipeline transportation or pipeline facilities. Share, as appropriate, with relevant Federal, State, local, Tribal, and territorial entities and public and private sector stakeholders, as applicable, the guidelines described in paragraph (1), security directives, and regulations and, as appropriate, intelligence and information, regarding cybersecurity threats, acts of terrorism, and other security threats to pipeline transportation and pipeline facilities. Assess and inspect, as appropriate, the implementation of such guidelines, security directives, and regulations, including the security policies, plans, practices, and training programs maintained by owners and operators of pipeline transportation and pipeline facilities, to provide recommendations or requirements for the improvement of the security of pipeline transportation and pipeline facilities against cybersecurity threats, acts of terrorism, and other security threats. Identify and rank the relative security risks to pipeline transportation and pipeline facilities. Inspect pipeline transportation and pipeline facilities, including such transportation or facilities, as the case may be, designated as critical by owners and operators of such transportation or facilities based on such guidelines, security directives, or regulations. Not later than one year after the date of the enactment of this subsection, the Administrator of the Transportation Security Administration shall convene at least one industry day to engage with relevant pipeline transportation and pipeline facilities stakeholders on matters related to the security of pipeline transportation and pipeline facilities. The Administrator of the Transportation Security Administration shall report to the Committee on Homeland Security of the House of Representatives and the Committee on Commerce, Science, and Transportation and the Committee on Homeland Security and Governmental Affairs of the Senate not less frequently than biennially on activities of the Administration to carry out responsibilities to secure pipeline transportation and pipeline facilities (as such terms are defined in section 60101 of title 49, United States Code), pursuant to section 1559 of the Implementing Recommendations of the 9/11 Commission Act of 2007, as added by subsection (a). Not later than 180 days after the date of the enactment of this Act, the Administrator of the Transportation Security Administration, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, as appropriate, shall develop a personnel strategy (in this subsection referred to as the strategy) for carrying out the Administrator’s responsibilities to secure pipeline transportation and pipeline facilities, pursuant to section 1559 of the Implementing Recommendations of the 9/11 Commission Act of 2007, as added by subsection (a). The strategy may take into consideration the most recently published versions of each of the following documents: The Transportation Security Administration National Strategy for Transportation Security. The Department of Homeland Security Cybersecurity Strategy. The Transportation Security Administration Cybersecurity Roadmap. The Department of Homeland Security Balanced Workforce Strategy. The Department of Homeland Security Quadrennial Homeland Security Review. Other relevant strategies or plans, as appropriate. The strategy shall include the following: An assessment of the cybersecurity expertise determined necessary by the Administrator of the Transportation Security Administration to secure pipeline transportation and pipeline facilities. A plan for expanding such expertise within the Transportation Security Administration. The strategy shall include an assessment of resources determined necessary by the Administrator of the Transportation Security Administration to carry out such strategy. Upon development of the strategy, the Administrator of the Transportation Security Administration shall provide to the Committee on Homeland Security of the House of Representatives and the Committee on Commerce, Science, and Transportation and the Committee on Homeland Security and Governmental Affairs of the Senate a copy of such strategy. Not later than two years after the date of the enactment of this Act, the Comptroller General of the United States shall conduct a review of the implementation of this Act. The table of contents in section 1(b) of the Implementing Recommendations of the 9/11 Commission Act of 2007 is amended by inserting after the item relating to section 1558 the following new item: 1559.Pipeline security(a)In generalThe Administrator of the Transportation Security Administration shall maintain responsibility, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency of the Department, as appropriate, for securing pipeline transportation and pipeline facilities (as such terms are defined in section 60101 of title 49, United States Code) against cybersecurity threats (as such term is defined in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650)), acts of terrorism (as such term is defined in section 3077 of title 18, United States Code), and other security threats.(b)Guidelines, directives, and regulationsIn carrying out subsection (a), the Administrator of the Transportation Security Administration shall carry out the following:(1)Ensure the development and updating, in consultation with relevant Federal, State, local, Tribal, and territorial entities and public and private sector stakeholders, as applicable, of guidelines, consistent with the National Institute of Standards and Technology Framework for Improvement of Critical Infrastructure Cybersecurity (and any update to such Framework) pursuant to section 2(c)(15) of the National Institute for Standards and Technology Act (15 U.S.C. 272(c)(15)), to improve the security of pipeline transportation and pipeline facilities against cybersecurity threats, acts of terrorism, and other security threats.(2)Promulgate any additional security directives or regulations as the Administrator determines necessary to secure pipeline transportation or pipeline facilities.(3)Share, as appropriate, with relevant Federal, State, local, Tribal, and territorial entities and public and private sector stakeholders, as applicable, the guidelines described in paragraph (1), security directives, and regulations and, as appropriate, intelligence and information, regarding cybersecurity threats, acts of terrorism, and other security threats to pipeline transportation and pipeline facilities.(4)Assess and inspect, as appropriate, the implementation of such guidelines, security directives, and regulations, including the security policies, plans, practices, and training programs maintained by owners and operators of pipeline transportation and pipeline facilities, to provide recommendations or requirements for the improvement of the security of pipeline transportation and pipeline facilities against cybersecurity threats, acts of terrorism, and other security threats.(5)Identify and rank the relative security risks to pipeline transportation and pipeline facilities.(6)Inspect pipeline transportation and pipeline facilities, including such transportation or facilities, as the case may be, designated as critical by owners and operators of such transportation or facilities based on such guidelines, security directives, or regulations.(c)Stakeholder engagementNot later than one year after the date of the enactment of this subsection, the Administrator of the Transportation Security Administration shall convene at least one industry day to engage with relevant pipeline transportation and pipeline facilities stakeholders on matters related to the security of pipeline transportation and pipeline facilities.. Sec. 1559. Pipeline security..

1559. Pipeline security The Administrator of the Transportation Security Administration shall maintain responsibility, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency of the Department, as appropriate, for securing pipeline transportation and pipeline facilities (as such terms are defined in section 60101 of title 49, United States Code) against cybersecurity threats (as such term is defined in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650)), acts of terrorism (as such term is defined in section 3077 of title 18, United States Code), and other security threats. In carrying out subsection (a), the Administrator of the Transportation Security Administration shall carry out the following: Ensure the development and updating, in consultation with relevant Federal, State, local, Tribal, and territorial entities and public and private sector stakeholders, as applicable, of guidelines, consistent with the National Institute of Standards and Technology Framework for Improvement of Critical Infrastructure Cybersecurity (and any update to such Framework) pursuant to section 2(c)(15) of the National Institute for Standards and Technology Act (15 U.S.C. 272(c)(15)), to improve the security of pipeline transportation and pipeline facilities against cybersecurity threats, acts of terrorism, and other security threats. Promulgate any additional security directives or regulations as the Administrator determines necessary to secure pipeline transportation or pipeline facilities. Share, as appropriate, with relevant Federal, State, local, Tribal, and territorial entities and public and private sector stakeholders, as applicable, the guidelines described in paragraph (1), security directives, and regulations and, as appropriate, intelligence and information, regarding cybersecurity threats, acts of terrorism, and other security threats to pipeline transportation and pipeline facilities. Assess and inspect, as appropriate, the implementation of such guidelines, security directives, and regulations, including the security policies, plans, practices, and training programs maintained by owners and operators of pipeline transportation and pipeline facilities, to provide recommendations or requirements for the improvement of the security of pipeline transportation and pipeline facilities against cybersecurity threats, acts of terrorism, and other security threats. Identify and rank the relative security risks to pipeline transportation and pipeline facilities. Inspect pipeline transportation and pipeline facilities, including such transportation or facilities, as the case may be, designated as critical by owners and operators of such transportation or facilities based on such guidelines, security directives, or regulations. Not later than one year after the date of the enactment of this subsection, the Administrator of the Transportation Security Administration shall convene at least one industry day to engage with relevant pipeline transportation and pipeline facilities stakeholders on matters related to the security of pipeline transportation and pipeline facilities.