Progress moving US oil and gas pipeline cybersecurity regulation and oversight from the TSA to the DOE? (HR 370)

Question

Politico's 2022-03-17 ‘TSA has screwed this up’: Pipeline cyber rules hitting major hurdles describes challenges to getting computer systems that control oil and gas pipelines to quickly meet requirements imposed by the Transportation Security Administration or TSA (of airport security fame) under the Biden administration.

The Biden administration has been scrambling to upgrade the digital security of U.S. critical infrastructure, from water utilities to power plants, amid heightened concerns about Russian cyberattacks stemming from the war in Ukraine. But few of the 16 critical infrastructure sectors have mandatory cyber standards, and many are regulated by agencies with little experience in this area. The TSA pipeline rules are an early test of the government’s ability to craft regulations that balance the security needed to keep out hackers with the flexibility needed to accommodate complex, idiosyncratic equipment.

Though the TSA is best known for airport security, it has a sprawling remit including mass transit systems, ports and pipelines.

Many of the TSA’s new requirements are based on protections for personal computers, not pipeline control systems, frustrating companies that aren’t sure how to comply with them. Other rules could require months or even years of painstaking upgrades that could interrupt pipeline operations. The result, companies and security experts say, is a confusing mess that has strained a once-harmonious partnership between the industry and its regulator.

It links to republicans-energycommerce.house.gov's 2021-05-18 blogpost Pipeline and LNG Cybersecurity is a Job for DOE — Not TSA. which links to a press release from same site six days earlier Energy and Commerce Committee Leaders Introduce Bipartisan Solutions to Enhance Cybersecurity for U.S. Energy Infrastructure which lists four legislative efforts, including the 116th Congress' H.R.370 - Pipeline and LNG Facility Cybersecurity Preparedness Act with a summary:

This bill requires the Department of Energy to implement a program to ensure the security, resiliency, and survivability of natural gas pipelines, hazardous liquid pipelines, and liquefied natural gas facilities.

Question: How are efforts progressing to move US oil and gas pipeline cybersecurity regulation and oversight from the TSA to the DOE?

I'm also curious about the likelihood that it will actually happen any time soon, and I think an examination of H.R.370 and related legislation may be indicative of this.

Answer 1

The bill was reintroduced as H.R. 3078 in the 117th Congress after H.R. 370 died in the 116th Congress.

It was referred to the subcommittee on Energy of the Energy and Commerce Committee, and then was given a committee markup in the Energy and Commerce Committee after subcommittee review on June 10, 2021 and reported to the full house where the Rules Committee has not given it a "rule" that assigned time for it to be debated by the full U.S. House.

The bill has bipartisan support, so it might conceivably be considered by the full house, or be included in some other omnibus bill at some point, before the 117th session of Congress ends.

Unsurprisingly, it hasn't garnished a lot of media or public attention.

Answer 2

H.R.370 died in the last Congress. The new bill for the 117th Congress is H.R.3078 - Pipeline and LNG Facility Cybersecurity Preparedness Act and was reported June 10, 2021; but has not been otherwise acted on.

govtrack reports,

Prognosis - 2% chance of being enacted according to Skopos Labs

I mention the following only for its reference to cybersecurity for pipelines.

On November 30, 2021, H.R.6084 - Energy Product Reliability Act was introduced in the House to address, among other issues, "cybersecurity, including protocols for the reporting of cybersecurity incidents" by creating an "Energy Product Reliability Organization" to "approve, by rule or order, a proposed energy product reliability standard". That bill, however, has no cosponsors, has no similar legislation in the Senate, is opposed by the American Gas Association (AGA) and the American Public Gas Association (APGA), and has not been reported favorably by the Subcommittee on Energy.