GRID Act

Amends the Federal Power Act to direct the Federal Energy Regulatory Commission (FERC) to issue rules or orders to protect critical electric infrastructure from cyber security vulnerabilities.

Authorizes FERC to issue such rules or orders without prior notice or hearing if it determines that a rule or order must be issued immediately to protect critical electric infrastructure from a cyber security vulnerability.

Directs FERC, before issuing a rule or order, to consult with specified entities and federal agencies regarding implementation of actions that will effectively address the identified cyber security vulnerabilities.

Requires the rule or order issued to address a cyber security vulnerability to expire on the effective date of a certain standard developed to address the cyber security vulnerability.

Empowers the Secretary of Energy to require, by order, with or without notice, persons subject to FERC jurisdiction to take such actions as the Secretary determines will best avert or mitigate an immediate cyber security threat.

Encourages the Secretary to consult and coordinate with officials in Canada and Mexico responsible for the protection of cyber security of the interconnected North American electricity grid.

Directs FERC to establish a mechanism that permits public utilities to recover prudently incurred costs required to implement immediate actions ordered by the Secretary under this Act.

States that any such expedited or emergency rules or orders issued without prior notice or hearing shall remain effective for not more than 90 days unless, during such 90-day period, FERC: (1) gives interested persons an opportunity to submit written data, views, or arguments (with or without opportunity for oral presentation); and (2) affirms, amends, or repeals the rule or order.

Applies this Act to any entity that owns, controls, or operates critical electric infrastructure. Excludes Alaska and Hawaii from the scope of this Act.

Directs the Secretary of Defense to prepare a comprehensive plan that identifies the emergency measures or actions to be taken to protect the reliability of the electric power supply of national defense facilities located in Alaska, Hawaii, and the Territory of Guam in the event of an imminent cybersecurity threat.

Directs the Secretary and FERC to: (1) prescribe regulations prohibiting disclosure of information obtained or developed in ensuring cyber security if such disclosure would be detrimental to the security of critical electric infrastructure; and (2) establish procedures governing the release of critical infrastructure information to enable to entities subject to this Act to implement rules or orders of FERC or the Secretary.

Written by the nonpartisan Congressional Research Service. All summary versions on Congress.gov