PROTECT the Grid Act

This bill directs the Secretary of Commerce to submit a report assessing national security risks to the U.S. electric grid from foreign adversary-controlled applications that can control high-wattage Internet-connected devices, and codifies a related executive order.

Sec. 3, Definitions: Defines key terms including 'foreign adversary' (as any covered nation under 10 U.S.C. 4872(f)), 'foreign adversary-controlled application' (a website, desktop app, mobile app, or augmented/immersive tech app operated by a covered entity), 'high-wattage IoT device' (any Internet-connected appliance consuming or controlling over 500 watts), and 'covered entity' (an entity subject to, operating for, or controlled by a foreign adversary).

Sec. 4, Report on national security risks: Requires the Secretary of Commerce, within 270 days of enactment, to submit a report to Senate and House committees assessing risks from foreign adversary-controlled applications that could attack critical infrastructure. The report must consider deployment of high-wattage IoT devices, risks from such applications in consumer products, potential impacts like frequency imbalances and cascading failures, and public input. It must include recommendations for mitigation, such as applying Executive Order 13873 to IoT devices, restricting federal procurement of consumer products with foreign adversary-controlled applications, certification or labeling requirements, and other proposals.

Sec. 5, Codification of Executive Order 13873: Enacts into law the provisions of Executive Order 13873 (relating to securing the information and communications technology and services supply chain) as in effect on the date of enactment, and requires the Archivist to publish its text as an appendix.