42 U.S.C. § 18725: Cybersecurity plan

to submit to the Secretary, prior to the issuance of the award or other funding, a cybersecurity plan that demonstrates the cybersecurity maturity of the recipient in the context of the project for which that award or other funding was provided; and establish a plan for maintaining and improving cybersecurity throughout the life of the proposed solution of the project. within the proposed solution of the project; and at the necessary external interfaces at the proposed solution boundaries; will perform ongoing evaluation of cybersecurity risks to address issues as the issues arise throughout the life of the proposed solution; will report known or suspected network or system compromises of the project to the Secretary; and will leverage applicable cybersecurity programs of the Department, including cyber vulnerability testing and security engineering evaluations. the Cybersecurity Capability Maturity Model of the Department (or a successor model); and the Framework for Improving Critical Infrastructure Cybersecurity of the National Institute of Standards and Technology; and any deviation from open standards; and the utilization of proprietary standards where the recipient determines that such deviation necessary. The Office of Cybersecurity, Energy Security, and Emergency Response of the Department shall review each cybersecurity plan submitted under subsection (a) to ensure integration with Department research, development, and demonstration programs. shall be exempt from disclosure under section 552(b)(3) of title 5 ; and shall not be made available by any Federal agency, State, political subdivision of a State, or Tribal authority pursuant to any Federal, State, political subdivision of a State, or Tribal law, respectively, requiring public disclosure of information or records.