## 9 Limitations  
This study has some limitations in terms of what kind of attacks cannot be prevented by the governor, and potential new threats added to the grid. We assume system administrators follow and implement widespread security practices provided by the National Institute of Standards and Technology (NIST) [34; 44] to secure smart grid cyber systems and communication channels.  
**Attacks not Prevented.** The governor does not prevent Distributed Denial of Service (DDoS) attacks, false data injection attacks, and privacy attacks. An adversary can perform a DDoS attack on the communication infrastructure to prevent relevant load shedding commands to reach customers causing the frequency to drop beyond the under-frequency threshold. In the case of false data injection attacks, if an adversary modifies commands between DRAS governor to customers, the governor will not detect those changes since commands have already left the governor. If commands are modified anytime between PU to DRAS or from DRAS to DRAS governor, the governor will detect it. The question arises about what occurs when an attack occurs on the communication channel. For integrity attacks, security mechanisms (Hash Message Authentication Code (HMAC), digital signature) should be used to protect the data-in-transit and Secure Socket Layer (SSL)/Transport Layer Security (TLS) to protect the communication channel. These basic approaches to protect the network should be implemented in the system. For denial-of-service attacks, this is the limitation of this approach. If all the bandwidth is consumed by the attack traffic, it would be difficult for the governor system to perform its operation. If the governor system is not responsive due to an attack, then the system should fail-safe to a state in which cyber-physical commands cannot be exploited. For example, the system may halt all \"smart\" functionalities like DR and remote disconnect and fall back to traditional operations like load shedding. We understand that this fail-safe mechanism could be an attack path to halt smart functionalities, however, this case demonstrates the importance of protecting the governor system itself.  
**Potential Threats Added.** Potential threats are added when a governor is compromised by an adversary. There will be no point of verification, and all malicious commands will be executed in the system. The governor can be used to make a malicious request to PU. Moreover, a malicious governor can send incorrect information to the PU governor which will make use of this information in making further decisions for different areas. Therefore, we need to protect the governor from becoming compromised, and we describe some measures in Section 10.  
**General Limitations.** We used the WSCC IEEE 9-bus model to demonstrate attacks on the power system assuming attackers have already compromised the cyber system. The amplitude of the presented attacks may not reflect the real world scenarios but represents how attacks can be conducted on the physical system. Power engineers must simulate such scenarios with and without a governor considering the details of both cyber and power systems. Moreover, we do not consider power storage, such as batteries used by the utility, to satisfy demand in the case of generation loss in some areas.