PROTECT the Grid Act

Summary

Requires the Commerce Department, working with other federal officials, to assess and report within 270 days on national-security risks from apps controlled by foreign-adversary entities that can operate or control high-wattage Internet-connected appliances (devices over 500 watts). The report must describe risks to the electric grid, gather stakeholder input, and recommend mitigations such as applying existing supply-chain authorities to IoT devices, restricting federal procurement, and creating certification or labeling for such devices. Also converts a prior executive order on securing information and communications technology supply chains into permanent federal law as of enactment and directs the Archivist to publish that text with the Act.

• Requires Commerce to deliver a national-security risk report within 270 days on foreign-adversary-controlled apps that can operate high-wattage IoT appliances.
• Defines high-wattage IoT devices as internet-connected appliances that consume or control more than 500 watts.
• Specifies potential grid impacts to assess, including frequency imbalances, cascading failures, and blackouts from coordinated demand manipulation.
• Directs consideration of mitigation options such as applying existing supply-chain authorities to IoT, restricting federal procurement, and certification/labeling.
• Incorporates Executive Order 13873 (securing ICT supply chains) into federal law as of the Act's enactment.
• Expands the national-security lens to consumer devices and apps, explicitly targeting applications tied to foreign adversaries.
• Requires interagency coordination and public/stakeholder input as part of the assessment process.
• Targets software and applications as well as hardware—covering apps, websites, and affiliated entities that can control devices.
• Positions federal procurement policy as a lever to reduce exposure to covered foreign-adversary-controlled applications.