Critical Infrastructure Protection: Actions Needed to Address Significant Cybersecurity Risks Facing the Electric Grid
Released: 2019-09-25T00:00:00

Letter

Background

Grid Functions, Design, and Operations

The U.S. electric grid comprises three distinct functions: generation and storage, transmission, and distribution (see fig. 1).

Generation and Storage. Power plants generate electric power by converting energy from other forms—chemical, mechanical (hydroelectric or wind), thermal, radiant energy (solar), or nuclear— into electric power. Energy storage, such as batteries or pumped hydroelectric, can improve the operating capabilities of the grid while also regulating the quality and reliability of power.

Transmission. The power transmission system connects geographically distant power plants with areas where electric power is consumed. Substations are used to transmit electricity at varied voltages and generally contain a variety of equipment, including transformers, switches, relays, circuit breakers, and system operations instruments and controls.

Distribution. The distribution system carries electric power out of the transmission system to industrial, commercial, residential, and other consumers.

Three large electric grids, or interconnections, exist in the contiguous United States that collectively constitute the U.S. electric grid: the Eastern Interconnection, Western Interconnection, and Electric Reliability Council of Texas Interconnection (see fig. 2). These interconnections, which extend into parts of Canada and Mexico, operate independently with limited ability to move electric power between them; electric power is produced within an interconnection to meet demand in the same interconnection.

The grid is generally considered to be resilient. Historically, grid operators have been able to respond quickly to the adverse consequences of an incident—whether it is damage from a major hurricane or a falling tree—and quickly restore service. In some cases, electricity may be restored long before utilities fully recover from an incident. For example, in instances with physical damage to grid components, such as an event that damages many substations, it could take months or years to fully restore the equipment.

The electricity industry has refined its power restoration processes after decades of experience in responding to disaster-related events, but restoration from a cyber-related event may be more challenging. For example, disaster-related events—such as hurricanes—may involve significant lead time before the incident. This allows owners and operators to take preemptive measures to protect their systems, develop restoration plans, and activate personnel. In contrast, cyberattacks may occur without warning, leaving owners and operators no time to prepare for a response. In addition, cyberattacks could target and damage specific types of components or facilities across a dispersed geographic area. Responding to such an attack could be more difficult than to a localized disaster-related event since resources may be geographically distributed rather than concentrated in the same area.

Industrial Control Systems Support the Grid

Industrial control systems are typically network-based systems that monitor and control sensitive processes and physical functions, such as the opening and closing of circuit breakers on the grid. These systems support the control of electric power generation, transmission, and distribution. System operators—which are sometimes affiliated with a particular utility or sometimes independent and responsible for multiple utility areas—manage electricity flows through these systems.

Early industrial control systems operated in isolation, running proprietary control protocols using specialized hardware and software. In addition, many industrial control system components were in physically secured areas, and the components were not connected to IT systems or the internet.

However, industrial control systems are changing in ways that offer advantages to system operators but that also make them more vulnerable to cyberattacks. In particular, proprietary devices in these systems are being replaced by cheaper and more widely available devices that use traditional IT networking protocols—including those that support remote access. These newer devices can provide the system operator with more detailed data on the conditions of the transmission and distribution systems and with better tools to observe and manage the grid. Remote access capabilities in the devices can also make them easier to maintain. Further, industrial control systems are being designed and implemented using traditional IT computers and operating systems, which allow corporate business and industrial control system networks to be connected more easily.

Nonetheless, cyberattacks on industrial control systems supporting grid operations may require a degree of sophistication and knowledge beyond what is needed to conduct cyberattacks on IT systems. For example, industrial control systems often use operating systems and applications that may be considered unconventional to typical IT personnel.

Critical Infrastructure Protection Roles, Responsibilities, and Key Initiatives

Federal policy and public-private plans establish roles and responsibilities for the protection of critical infrastructure, including the electric grid.

Presidential Policy Directive 21, issued in February 2013, shifted the nation’s focus from protecting critical infrastructure against terrorism to protecting and securing critical infrastructure and increasing its resilience against all hazards, including natural disasters, terrorism, and cyber incidents. The directive identified 16 critical infrastructure sectors, such as the energy sector, which includes the grid. In addition, the directive identified energy and communications systems as uniquely critical because of the enabling functions they provide across all sectors.

The directive also outlined roles and responsibilities for protecting these sectors. For example:

The directive designated DOE as the sector-specific agency for the energy sector. According to the directive, DOE and other sector-specific agencies are responsible for, among other things, collaborating with critical infrastructure owners and operators, identifying vulnerabilities, and helping to mitigate incidents. In addition, the Fixing America’s Surface Transportation Act of 2015 codified DOE’s role as the sector-specific agency for the energy sector and gave DOE the authority to order emergency measures, following a Presidential declaration of a grid security emergency, to protect or restore the reliability of critical electric infrastructure. The Office of Cybersecurity, Energy Security, and Emergency Response is the lead for DOE’s energy sector cybersecurity efforts.

The directive called for DHS to coordinate the overall federal effort to promote the security and resilience of the nation’s critical infrastructure. Within DHS, the Cybersecurity and Infrastructure Security Agency’s National Cybersecurity and Communications Integration Center is the lead for cyber and physical infrastructure security. Private-sector critical infrastructure owners and operators are encouraged, but not required, to report cybersecurity incidents to the center.

The directive emphasized that critical infrastructure owners and operators are uniquely positioned to manage risks to their individual operations and assets and to determine effective strategies to make them more secure and resilient.

The National Infrastructure Protection Plan, updated by DHS in December 2013, among other things, further integrates critical infrastructure protection efforts between government and private sectors. It describes a voluntary partnership model as the primary means of coordinating government and private-sector efforts to protect critical infrastructure. As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for the security programs of their respective sectors.

The plan also called for each sector to have a government coordinating council, consisting of representatives from various levels of government, and many sectors have a coordinating council consisting of owner-operators of these critical assets or members of their respective trade associations. For example, the Energy Sector Government Coordinating Council has been established (comprising the electricity subsector, as well as the oil and natural gas subsectors), and an Electricity Subsector Coordinating Council has been established to represent electricity asset owners and operators.

Cybersecurity, issued in 2013, among other things, addresses the need to improve cybersecurity through information sharing and collaboratively developing and implementing risk-based standards. It called for NIST to lead the development of a framework to reduce cybersecurity risks to critical infrastructure. It also called for sector- specific agencies to develop mechanisms to encourage adoption of the framework. NIST issued its Cybersecurity Framework in 2014 and updated it in April 2018. The framework provides a set of cybersecurity activities, desired outcomes, and applicable references that are common across all critical infrastructure sectors, including the energy sector.

The executive branch has taken steps toward outlining a federal strategy for confronting cyber threats—including those facing critical infrastructure such as the grid. For example:

Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, issued in May 2017, required federal agencies to take a variety of actions aimed at improving the cybersecurity of federal networks and critical infrastructure. Among other things, the order required DOE and DHS to assess the potential scope and duration of a prolonged power outage associated with a significant cyber incident, the readiness of the United States to manage the consequences of such an incident, and any gaps or shortcomings in assets or capabilities required to mitigate the consequences of such an incident.

The National Cyber Strategy, issued in September 2018, builds upon Executive Order 13800 and describes actions that federal agencies and the administration are to take to, among other things, secure critical infrastructure. For example, one of the strategy’s seven goals is protecting critical infrastructure. To achieve this goal, the strategy outlines a number of priority actions, such as prioritizing risk- reduction across seven key areas, including energy and power.

The DHS Cybersecurity Strategy was released in May 2018 with the intent of providing the department with a framework to execute cybersecurity responsibilities during the next 5 years. The plan outlines seven goals the department plans to accomplish in support of its mission related to managing national cybersecurity risks. For example, for the goal of protecting critical infrastructure, the plan outlines a number of objectives and sub-objectives, such as expanding and improving the sharing of cyber threat indicators, defensive measures, and other cybersecurity information.

In our 2018 and 2019 updates on government high-risk areas, we reported that these executive branch strategy documents did not include key elements of desirable characteristics that can enhance the usefulness of a national strategy as guidance for decision makers in allocating resources, defining policies, and helping to ensure accountability.

Electric Grid Cybersecurity Regulation

Federal and state authorities play key roles in regulating the reliability of the grid, which can be impaired by cybersecurity attacks. FERC is the federal regulator of interstate transmission of electricity with responsibility to review and approve standards to provide for the reliable operation of the bulk power system. In addition, FERC oversees NERC, which is the federally designated U.S. electric reliability organization. NERC is responsible for conducting reliability assessments and enforcing mandatory standards to ensure the reliability of the bulk power system—a term that refers to (1) facilities and control systems necessary for operating the electric transmission network and (2) the output from certain generation facilities needed for reliability. NERC develops reliability standards collaboratively through a deliberative process involving utilities and others in the electricity industry. NERC then sends the standards to FERC, which can either approve them or remand them to NERC for revision.

These reliability standards include critical infrastructure protection standards for protecting electric utility-critical and cyber-critical assets from cyberattacks. FERC has approved 11 such cybersecurity standards, 10 of which are currently enforced.

The standards call for organizations to classify their cyber systems as low-, medium-, or high-impact based on the adverse impact that loss, compromise, or misuse of those systems could have on the reliable operation of the bulk electric system. The classifications are made based on criteria and associated thresholds for, among others, generation resources and transmission substation operations. In turn, the standards apply differently to cyber systems based on whether they are classified as low-, medium-, or high-impact systems. For example:

Low-impact systems. Systems that affect net aggregate generation capacity of less than 1,500 megawatts at one power plant location within a single interconnection are classified as low-impact systems and are subject to the requirements in two of the 11 cybersecurity standards.

Medium-impact systems. Systems that similarly affect net aggregate generation capacity of at least 1,500 megawatts are classified as medium-impact systems and are subject to requirements in the full set of cybersecurity standards.

High-impact systems. Systems that are used by and located at certain control centers are classified as high-impact systems and are subject to the full set of cybersecurity standards. The standards generally require organizations to implement similar controls for medium- and high-impact systems, with more stringent variations of certain controls for high-impact systems.

As of December 2017, at most about 20 percent of the nation’s generation capacity comes from power plants with medium-impact systems and therefore is subject to requirements in the full set of cybersecurity standards.

Both NERC and FERC have authority to enforce reliability standards. In addition, FERC has the authority to oversee NERC’s enforcement of the FERC-approved reliability standards.

Cyber incident reporting is also an important part of federal and nonfederal regulatory efforts. Federal law requires grid owners and operators to report bulk power system incidents to DOE when certain criteria are met, such as a cyber event that causes interruptions of electrical system operations or that could potentially affect power system reliability. In addition, FERC-approved reliability standards require certain registered grid owners and operators to report cybersecurity incidents—that is, cybersecurity events that have compromised or disrupted one or more reliability tasks—to NERC.

State regulators generally oversee the reliability of distribution systems, and cybersecurity regulations related to the distribution grid may vary across states. In 2017, the National Association of Regulatory Utility Commissioners released an updated version of its cybersecurity primer for state utility regulators that aims to provide guidance to state regulators. The primer highlights the NIST Cybersecurity Framework as well as the FERC-approved cybersecurity standards as helpful tools for utilities and state regulators.

The Grid Faces Significant Cybersecurity Risks and Challenges

The U.S. electric grid faces significant cybersecurity risks—that is, threats, vulnerabilities, and impacts—and grid owners and operators face significant challenges in addressing these risks. Threat actors are becoming increasingly capable of carrying out attacks on the grid. At the same time, the grid is becoming more vulnerable to attacks. With respect to the potential impacts of the threats and vulnerabilities, U.S. cybersecurity incidents reportedly have not caused a domestic power outage. In addition, federal agencies have performed three assessments of the potential impacts that cyberattacks could have on the grid, but the potential scale of any associated outages is uncertain due to limitations in the assessments. As grid owners and operators attempt to address cybersecurity risks, they face a number of challenges, such as difficulties in hiring a sufficient cybersecurity workforce and limited public-private information sharing.

Various Cyber Threat Actors Are Increasingly Capable of Attacking the Grid

A variety of threat actors pose significant cybersecurity threats to the electric grid, and many of these threat actors are becoming increasingly adept at carrying out attacks on industrial control systems, such as those supporting grid operations. Relatedly, the skill needed to attack industrial control systems is decreasing, as tools for exploiting industrial control system vulnerabilities become more available.

According to the 2019 Worldwide Threat Assessment of the U.S. Intelligence Community, nations, criminal groups, and terrorists pose the most significant cyber threats to U.S. critical infrastructure. In addition, hackers and hacktivists, as well as insiders, pose significant cyber threats to the grid, according to officials and representatives of key federal and nonfederal entities whom we interviewed.

Nations

Nations, including nation-state, state-sponsored, and state-sanctioned groups or programs, use cyber tools as part of their information-gathering and espionage activities. According to the 2019 Worldwide Threat Assessment, China and Russia pose the greatest cyberattack threats; of particular concern, they possess the ability to launch cyberattacks that could cause localized, temporary disruptive effects on critical infrastructure. For example, the assessment states that China has the ability to disrupt a natural gas pipeline for days to weeks (which could in turn disrupt grid operations), and Russia has the ability to disrupt an electrical distribution network for at least a few hours. The assessment also states that Russia is mapping U.S. critical infrastructure with the long-term goal of being able to cause substantial damage. Separately, DHS and the Federal Bureau of Investigation have described Russian activities as an intrusion campaign by actors on U.S. government entities and critical infrastructure organizations.

In addition, a nation-state has successfully demonstrated its capability to disrupt the grid of another country. Specifically, according to the Office of the Director of National Intelligence, in December 2015 a state-sponsored actor conducted a cyberattack on the Ukrainian power grid that systematically disconnected substations, resulting in a power outage that lasted 3 hours.

Officials and representatives of key federal and nonfederal entities we interviewed identified nations as the most capable threat actor but also noted that nations may not take action to disrupt the U.S. grid. For example, representatives from two utilities stated that nation-state actors are of the most concern because they have the resources to persist in their operations. However, officials from Los Alamos National Laboratory explained that nation-states may choose not to sponsor an attack because they could be easily identified. In addition, a representative from one of the utilities that we met with stated that nation-states may not pursue a cyberattack on the U.S. grid because they may be concerned about the potential response by the United States. Federal officials we interviewed noted that nation-states may be interested in gathering information about U.S. critical infrastructure with the intent of conducting a cyberattack at a later date.

Criminal Groups

Criminal groups, including organized crime organizations, seek to use cyberattacks for monetary gain. According to the 2019 Worldwide Threat Assessment, financially motivated cyber criminals will likely expand their targets in the United States in the next few years, and their actions could disrupt critical infrastructure in non-energy sectors.

The intelligence community does not identify criminal groups as a threat specifically to the energy sector, but these groups could still have a large impact on the grid. For example, criminal organizations often use ransomware—malicious software used to deny access to IT systems or data—to hold systems or data hostage until a ransom is paid. Criminal groups have not used ransomware to target industrial control systems, but ransomware has been used to infect IT systems tied to industrial control systems. For example, the Center for Internet Security reported in March 2019 that the LockerGoga ransomware disrupted industrial and manufacturing firms’ networks, including a Norwegian aluminum company, which had to temporarily move to manual production. According to DHS’s Industrial Control Systems Computer Emergency Response Team, ransomware continues to be a major threat to both IT and industrial control systems that support the grid.

In addition, officials and representatives of key federal and nonfederal entities we interviewed suggested that nations could hire criminal groups to achieve their objectives. For example, an official from the National Renewable Energy Laboratory stated that criminal groups could be leveraged by other threat actors that have different incentives, such as nations focused on intelligence-gathering operations.

Terrorists

Terrorists seek to destroy, incapacitate, or exploit critical infrastructures in order to threaten national security, inflict mass casualties, weaken the economy, and damage public morale and confidence. Terrorist groups may be highly motivated to disrupt or damage the grid, but they do not currently have the sophisticated tools or skill necessary to execute a cyberattack that could cause a widespread outage or significantly damage the power system, according to the 2019 Worldwide Threat Assessment. However, terrorist groups could cause disruptive effects, such as defacing websites or executing denial-of-service attacks against poorly protected networks.

Hackers and Hacktivists

Hackers break into networks for a challenge, revenge, stalking, or monetary gain, among other reasons. By contrast, hacktivists are ideologically motivated and use cyber exploits to further political goals, such as free speech or to make a point. Hackers and hacktivists no longer need a great amount of skill to compromise IT systems because they can download commonly available attack tools.

Officials and representatives of key federal and nonfederal entities we interviewed told us that hackers and hacktivists may have less capability to do harm than the most significant threat actors identified by the intelligence community, but they still pose a threat to the grid. For example, officials from the National Energy Technology Laboratory explained that while hacktivists generally are less capable than nations, their intent to inflict harm or to damage operations is typically more immediate than nations’ longer-term goals. In addition, representatives from nonfederal entities stated that hacktivists may be capable of causing problems for electric utilities and systems supporting the delivery of power.

Insiders

Insiders are entities (e.g., employees, contractors, vendors) with authorized access to an information system or enterprise who have the potential to cause harm through destruction, disclosure, modification of data, or denial of service. Such destruction can occur wittingly or unwittingly. For example, in 2009, a disgruntled former IT employee of a Texas power plant allegedly disrupted the company’s energy forecast system when the company failed to deactivate the employee’s account access and confiscate his company-issued laptop after firing him two days earlier.

By contrast, in another case in 2009, contractors were reported to have unwittingly introduced malware on a uranium enrichment facility’s workstations in Iran. Specifically, the attackers introduced malware on the contractor’s business network. The malware then reportedly spread to universal serial bus (USB) devices that were used to transfer information between the contractors’ business IT network and the uranium enrichment facility’s workstations.

Officials and representatives of key federal and nonfederal entities that we interviewed stated that while the threat posed by insiders varies, they could cause damaging effects. For example, Sandia National Laboratories officials explained that insiders could include knowledgeable employees with privileged access to critical systems or contractors with limited system knowledge. Further, representatives from another nonfederal entity explained that insider threats are a concern because of the economically valuable information they could steal.

The Grid Is Becoming More Vulnerable to Cyberattacks

The electric grid is becoming more vulnerable to cyberattacks via (1) industrial control systems, (2) consumer Internet of Things (IoT) devices connected to the grid’s distribution network, and (3) the global positioning system (GPS).

Industrial Control Systems

As previously noted, cheaper and more widely available devices that use traditional IT networking protocols are being integrated into industrial control systems. The use of these protocols, as well as traditional IT computers and operating systems, has led to a larger cyberattack surface—the different points in a network where attackers can try to enter or extract information—for the grid’s systems.

In particular, many industrial control system devices include remote access capabilities, and industrial control systems are increasingly connected to corporate business networks.

Remote access capabilities. Vendors are increasingly including remote access capabilities, including modems and wireless networking, as part of industrial control system devices. These capabilities are susceptible to exploitation by malicious actors. For example, malicious actors could scan a range of potential telephone numbers common to an area or published on a company website to find open modem connections to these devices (referred to as “war dialing”). In addition, malicious actors could scan for unsecured wireless networks connected to industrial control system devices while in close proximity to the devices (referred to as “war driving”).

If implemented effectively, modern cybersecurity practices often protect against techniques used to remotely access industrial control system devices, and only allow trusted connections. However, to circumvent these practices, a malicious actor could, for example, compromise a vendor’s network—which is often trusted by owners and operators—and use the trusted connection to remotely connect to industrial control system devices.

Connections to corporate business networks. Industrial control systems, which were once largely isolated from the internet and business IT systems, are increasingly connected in modern energy systems, allowing cyberattacks to originate in business IT systems and migrate to industrial control systems. For example, malicious nation-state actors used spear phishing emails to deploy malware on business IT networks in the 2015 attack on Ukrainian electricity utilities. After gaining initial access to the business IT networks, the attackers reportedly used a variety of techniques to migrate to the industrial control system networks of the utilities.

Moreover, even if industrial control systems are not physically connected to business IT systems, malicious actors can exploit the use of removable media between the two networks. For example, as previously mentioned, contractors were reported to have unwittingly introduced malware on uranium enrichment facility workstations in Iran by using USB devices that were infected with the malware on the contractors’ business IT network to transfer information to the uranium enrichment facility’s workstations.

Figure 3 illustrates how malicious actors could leverage this increasing attack surface to compromise industrial control systems.

Compounding the risk associated with the increased attack surface, many legacy industrial control systems were not designed with cybersecurity protections because they were not intended to be connected to networks, such as the internet. For example, many legacy devices are not able to authenticate commands to ensure that they have been sent from a valid user and may not be capable of running modern encryption protocols. In addition, some legacy devices do not have the capability to log commands sent to the devices, making it more difficult to detect malicious activity.

Additionally, even in the case of more modern devices, the safety and efficiency goals of the grid and the supporting industrial control systems can conflict with the goal of security in the design and operation of industrial control systems. According to an Idaho National Laboratory analysis, grid owners and operators may not always be able to identify industrial control system vulnerabilities in a timely manner. Vulnerability scanning is often used in IT systems to validate proper system configuration and to identify any vulnerabilities that may be present. However, conventional IT vulnerability scanning can disable or shut down energy delivery systems, and testing may not always detect vulnerabilities deep within industrial control system software.

Further, even if owners and operators are able to identify industrial control system cybersecurity vulnerabilities, they may not be able to address those vulnerabilities in a timely manner because certain industrial control system devices may have high availability requirements to support grid operations. These devices typically need to be taken offline to apply patches to fix cybersecurity vulnerabilities. In addition, grid owners and operators need to rigorously test the patches before applying them. Security patches are typically tested by vendors, but they can degrade or alter the functionality of industrial control systems, which can have serious consequences for grid operations.

Consequently, there is increased risk that malicious actors may be able to exploit vulnerabilities in industrial control system devices before patches can be applied. According to DHS, the number of vulnerability advisories for industrial control systems devices has steadily increased, from 17 advisories in 2010 to 223 advisories in 2018 (see fig. 4).

Moreover, supply chains for industrial control systems can introduce vulnerabilities that could be exploited for a cyberattack. For example, there is a potential for manufacturers and developers to—wittingly or unwittingly—include unauthorized code or malware in industrial control system devices and systems that provides a back door into the equipment or that allows the program to “call home” once installed. Further, manufacturers and software developers create their products in many different locations around the world, thus making them potentially susceptible to foreign-based threats. For example, a capable nation-state could gather useful information on the types of equipment used at a particular utility with the intent to undermine security controls at a later time.

In addition, manufacturers and developers have made sensitive information publicly available regarding the operation of their hardware and software. For example, manufacturers and developers have published vendor manuals, which include information such as default passwords and operating instructions. These manuals often appear on the internet and can aid malicious actors in conducting cyberattacks on industrial control systems.

Consumer IoT Devices Connected to the Grid

Researchers and federal agencies have recently identified concerns about the potential introduction of cyber vulnerabilities to the grid through the connection of consumer IoT devices to the grid’s distribution network. For example, university researchers in 2018 used large, real-world grid models to simulate the feasibility and impact on the grid of a coordinated cyberattack on smart home appliances. Specifically, the researchers found that malicious threat actors could compromise a large number of high-wattage IoT devices (e.g., air conditioners and heaters) and turn them into a botnet—a network of devices infected with malicious software and controlled as a group without the owners’ knowledge.

The malicious actors could then use the botnet to launch a coordinated attack aimed at manipulating the demand across distribution grids. For example, according to the researchers, one such attack could involve synchronously switching on all of the compromised devices. Such an attack could disrupt the balance of power generation and consumption and ultimately cause an outage.

An official from the National Renewable Energy Laboratory explained that the likelihood of attacks on the distribution network using IoT devices is low but could increase in the future. In particular, the official explained that the wattage needed to create a significant disruption in the balance of supply and demand would require a botnet of tens of thousands of smart appliances. Botnets of this size have been created, but the laboratory official explained that it would be very difficult to manipulate all of those devices to turn on at precisely the same time. However, the official cautioned that such an attack could become more plausible in the future as additional high-wattage systems and devices, such as building energy management systems and electric vehicles, are connected to the internet.

Global Positioning System Vulnerability

The grid is dependent on GPS timing to monitor and control generation, transmission, and distribution functions. According to DOE, the GPS signal is susceptible to exploitation by malicious actors. For example, a malicious actor could inject a counterfeit GPS signal (known as GPS spoofing) that could result in disruptions to grid operations.

U.S. Cybersecurity Incidents Reportedly Have Not Caused Power Outages, and the Potential Impacts from a Cyberattack Are Uncertain

According to the three entities responsible for collecting information on cybersecurity incidents that affect the electric grid—DHS, DOE, and NERC—none of the cybersecurity incidents reported in the United States have disrupted the reliability or availability of the grid, and none have resulted in a power outage.

Even though cyber incidents involving the grid reportedly have not caused power outages in the United States, cyberattacks on foreign industrial control systems have resulted in power outages. For example, in December 2015, malicious actors linked by Ukrainian officials to the Russian government conducted cyberattacks on three Ukrainian power distribution operators, resulting in a loss of power for about 225,000 customers. GAO did not find evidence that these attacks physically damaged grid components, but cyberattacks on industrial control systems in other sectors demonstrates that this is possible. For example, in 2014, malicious cyber actors compromised industrial control systems and caused failures that led to massive damage to a blast furnace at a German steel mill.

Further, federal agencies have performed three assessments of the potential impacts of cyberattacks on the industrial control systems supporting the grid. Specifically, DOE and FERC have conducted three assessments of the potential impact of cyberattacks on the grid at the scale of multiple system operators through the scale of an interconnection. The two DOE assessments—which according to DOE officials are early drafts and have not gone through intra-agency review— focused on the impact of a cyberattack within a single interconnection and produced varying reports of the potential scale of power outages that could result from a cyberattack. The remaining assessment—which FERC conducted in 2013—reviewed the impact of a cyber or physical attack on all three interconnections and concluded that an attack could result in a widespread blackout spanning the contiguous United States. Table 1 below describes the three assessments.

However, because of limitations in the three federal assessments, the scale of any power outages that may result from a cyberattack is uncertain. In particular:

Federal agencies have conducted one study—FERC’s 2013 study— that assesses the potential impact of a coordinated attack in each of the three interconnections. However, in 2015, DOE officials raised concerns about the scenario and related assumptions used in that study that called into question the findings. Specifically, at that time, DOE officials reported that they found several of the scenario’s assumptions highly unlikely, including peak capabilities at all targeted generation stations at the time of an attack and the loss of all safety systems designed to prevent the consequences described in the analysis. Further, DOE officials reported that they found the study’s scenarios even more unlikely to result in a total loss of power or any other consequence that could be reasonably expected to result in damage to national security.

The 2017 assessment conducted by DOE’s Argonne National Laboratory was limited in scope to a six-state region. In addition, the assessment focused on a single cyberattack scenario and noted that many other grid cyberattack methods and outcomes were possible.

The 2017, 2018, and 2019 editions of DOE’s draft Electricity Subsector Risk Characterization Study have significant methodological limitations. Specifically, officials from Lawrence Livermore National Laboratory who were contracted to perform the analyses cautioned that they used a reduced model of the Western Interconnection as it existed around 1980 and emphasized that their methodology should not be used to predict the behavior of the actual bulk power system. For example, those researchers told us that their selected model of the Western Interconnection had less than a quarter of its actual capacity in 2018.

The DOE official responsible for the studies said that the assumption for the worst-case scenario was from that official’s professional judgement, not a documented analysis. Later, officials at Sandia National Laboratories told us that the worst-case scenario in the DOE draft study was a point solution used as a proof of concept, that the study was not of a high level of rigor, and that the assumptions may not represent a vulnerability in the actual bulk power system. Further, the DOE methodology assumed that all assets removed from service were treated equally; accordingly, the researchers did not distinguish the loss of specific assets (such as a substation or transmission line) in the calculation of attack difficulty and likelihood.

Because of these limitations, some of the draft studies’ conclusions may not be realistic. For example, one of DOE’s major conclusions in the 2017 Risk Characterization Study—that a cyberattack may result in a relatively small loss of load in the United States about 8 times per year—may not be plausible because there have not been any reported cyberattacks that have caused an outage in the United States. In addition, the three draft DOE studies have widely varying conclusions on the likelihood of cyberattacks across the selected range of loss of load. For example, the 2018 draft study concluded that a cyberattack resulting in a more substantial loss of load had an average likelihood of occurring nearly once every 10 years, while the 2019 draft study concluded that such an attack would occur about once every 100 years. According to a DOE official, there is no documentation of the technical basis for the significant changes in the assessment outcomes between the 2017 and 2018 draft studies and between the 2018 and 2019 draft studies. In addition, DOE officials told us that all three studies are early drafts and have not gone through intra-agency review.

Moreover, none of the federal assessments reviewed the risk associated with a cyberattack involving a botnet of high-wattage consumer IoT devices. As previously mentioned, university researchers demonstrated that malicious actors could use a botnet of IoT devices to launch a coordinated attack aimed at manipulating the demand on distribution systems across the grid. A federal official we interviewed agreed that such an attack could occur and could disrupt grid distribution systems— especially as additional high-wattage systems become connected to the internet—but they said it is unclear what impact, if any, such attacks could have on the reliability of the bulk power system.

Grid Entities Reported Facing Challenges in Addressing Cybersecurity Risks

Officials and representatives of key federal and nonfederal entities we interviewed generally identified five significant challenges grid owners and operators face in addressing cybersecurity risks: (1) difficulties in hiring a sufficient cybersecurity workforce, (2) limited public-private information sharing of classified information, (3) limited resources to invest in cybersecurity protections, (4) reliance on other critical infrastructure that may be vulnerable to cyberattacks, and (5) uncertainties about how to implement cybersecurity standards and guidance.

Hiring a Sufficient Cybersecurity Workforce

Officials and representatives of key federal and nonfederal entities we interviewed identified difficulties in hiring a sufficient cybersecurity workforce as a significant challenge to addressing cybersecurity risks to the grid. For example, a representative of a nonfederal entity told us that there are a limited number of trained cybersecurity personnel interested in working in the energy sector. The representative added that there are a large number of vacancies for cybersecurity positions and that they are difficult to fill due to the limited amount of available talent and organizational resource constraints, such as providing salaries that are competitive with other sectors. A laboratory official commented that larger grid entities are able to attract the majority of skilled cybersecurity professionals, leaving smaller entities with less skilled personnel. Further, an asset owner explained that training personnel so that they have sufficient cybersecurity knowledge and skills is difficult, and the requisite knowledge of industrial control systems further complicates training these personnel.

DOE has also identified difficulties in hiring a sufficient cybersecurity workforce as a challenge. Specifically, according to DOE’s Assessment of Electricity Disruption Incident Response Capabilities, the electricity subsector continues to face challenges in recruiting and maintaining experts with strong knowledge of cybersecurity practices as well as knowledge of industrial control systems supporting the grid.

Limited Public-Private Sharing of Classified Information

Officials and representatives of key federal and nonfederal entities we interviewed identified limited public-private sharing of classified information, including the sharing of threat intelligence, as a significant challenge to addressing cybersecurity risks to the grid. For example, a laboratory official told us that many grid owners and operators do not have security clearances. Consequently, the official explained, deeming information on certain cybersecurity threats to the grid to be “classified” leaves many utilities without the awareness to address those threats to the grid. The official added that when details are removed from classified threat intelligence in order to develop an unclassified alert, that alert often lacks the specific information utilities need to address the threat.

Asset owners told us that, even for those grid owners and operators who are permitted to initiate the clearance process, it can take an extended period of time to complete the associated adjudication to obtain that clearance. In addition, two asset owners noted that, even after clearances have been received and fully adjudicated, it is often difficult to obtain access to secure locations to review classified information.

DOE has also identified limited public-private information sharing as a challenge. Specifically, according to DOE’s Assessment of Electricity Disruption Incident Response Capabilities, the bidirectional flow of information and intelligence between industry and government has been highlighted by stakeholders as a continued challenge for the electricity subsector. The assessment explains that the sharing of information is impeded by the slow adoption of automated capabilities and the difficultly of sharing classified information between government and industry— particularly in real time during an incident.

Limited Resources to Invest in Cybersecurity Protections

Officials and representatives of key federal and nonfederal entities identified limited resources for cybersecurity protections as a challenge to addressing cybersecurity risks to the grid. In particular, most of the asset owners that we met with stated that it can be costly to implement required cybersecurity protections. In addition, officials and representatives of key federal and nonfederal entities that we spoke with explained that costs— including those for cybersecurity protections—must be recovered through electric rates to customers. As a result, a laboratory official explained that many utilities prioritize cybersecurity protections that are the most cost- effective over protections that may be needed to address risks.

Reliance on Other Critical Infrastructure That May Be Vulnerable to Cyberattacks

Officials and representatives of key federal nonfederal entities we interviewed identified the grid’s reliance on other critical infrastructure (e.g., natural gas pipelines) that may be vulnerable to cyberattacks as a challenge to addressing cybersecurity risks to the grid. For example, a representative of a nonfederal entity stated that the electricity subsector inherits cybersecurity risks from other critical infrastructures, since the electricity subsector relies on those critical infrastructures for its own operations. As such, that representative added that it is difficult to holistically determine how vulnerable the grid may be to a cyberattack. In addition, as previously mentioned, according to the 2019 Worldwide Threat Assessment, China has the ability to disrupt a natural gas pipeline for days to weeks.

Uncertainties about Implementation of Cybersecurity Standards and Guidance

Officials and representatives of key federal and nonfederal entities we interviewed identified uncertainties about how to implement cybersecurity standards and guidance as a challenge to addressing cybersecurity risks to the grid. In particular, several representatives noted that these uncertainties have led their organizations to devote additional resources to implementing the standards and guidance. For example, one asset owner explained that FERC-approved cybersecurity standards do not always include details that are needed to understand how they apply to that owner’s environment. In addition, another asset owner stated that significant time and effort is required to understand the standards and how they might be implemented.

Federal Agencies Have Performed a Variety of Activities Aimed at Addressing Grid Cybersecurity Risks

DOE, DHS, and other federal agencies have performed a variety of critical infrastructure protection activities aimed at addressing grid cybersecurity risks, including implementing programs that help protect grid systems from cybersecurity threats and vulnerabilities. In addition, FERC has performed a variety of regulatory activities aimed at addressing grid cybersecurity risks, such as approving mandatory cybersecurity standards for the bulk power system.

DOE, DHS, and Other Agencies Have Undertaken Critical Infrastructure Protection Activities Aimed at Addressing Grid Cybersecurity Risks

DOE, DHS, and other federal agencies have performed a variety of critical infrastructure protection activities aimed at addressing grid cybersecurity risks. These activities generally align with the functions in the NIST Cybersecurity Framework, which include (1) protecting systems to mitigate cybersecurity threats and vulnerabilities; (2) identifying cybersecurity threats and vulnerabilities and detecting potential cybersecurity incidents; and (3) responding to and recovering from such incidents.

Protecting systems to mitigate cybersecurity threats and vulnerabilities Federal agencies assist grid asset owners and operators in implementing protections that mitigate cybersecurity risks by providing capabilities aimed at preventing cybersecurity intrusions and offering training and guidance on cybersecurity practices. For example, DHS’s Enhanced Cybersecurity Services program provides intrusion-prevention capabilities to U.S.-based entities and to state, local, tribal, and territorial organizations. To carry out this voluntary program, DHS provides classified and unclassified threat information to designated commercial service providers. These providers use the information to block access to (1) specific malicious internet addresses and (2) email with specific malicious criteria.

NIST, DHS, and DOE also provide cybersecurity training and guidance. For example, NIST has developed numerous special publications on cybersecurity protections for IT and industrial control systems, such as the previously mentioned Cybersecurity Framework and its Guide to Industrial Control Systems. In addition, DHS provides in-person and online training on leading cybersecurity practices for industrial control systems through its National Cybersecurity and Communications Integration Center.

Lastly, DHS has taken initial steps to help grid entities manage supply chain cybersecurity risks. For example, in July 2018 DHS created a public-private partnership, known as the Supply Chain Risk Management Task Force. The task force aims to examine risks to the global information and communications technology supply chain and develop consensus recommendations to manage such risks.

Identifying cybersecurity threats and vulnerabilities and detecting potential cybersecurity incidents Federal agencies help grid entities identify cybersecurity risks and detect incidents by providing threat and vulnerability information, performing risk assessments, performing forensic analysis, and conducting research. For example, DOE piloted and launched the Cybersecurity Risk Information Sharing Program, which is now managed by the Electricity Information Sharing and Analysis Center. It provides a voluntary, bi-directional public- private IT data sharing and analysis platform. Using both classified and unclassified sources, DOE’s Pacific Northwest National Laboratory analyzes the information to (1) identify threat patterns and attack indicators, and (2) deliver alerts to owners and operators. In addition, DHS’s Automated Indicator Sharing program provides a server housed at each participant’s location that can be used to exchange threat indicators with the department’s National Cybersecurity and Communications Integration Center. Further, the center provides asset owners with alerts, advisories, and situational reports, including information on threats, vulnerabilities, or activity that could affect IT or industrial control system networks.

DOE and DHS also offer services aimed at helping grid owners and operators assess cybersecurity risks and perform forensic analysis. For example, DOE has an evaluation tool known as the Electricity Cybersecurity Capability Maturity Model that aims to help the electricity industry evaluate, prioritize, and improve its cybersecurity capabilities. In addition, DHS offers technical assessments through its National Cybersecurity and Assessment and Technical Services Team that can help identify vulnerabilities and simulate a malicious adversary. Further, DHS can review potential cybersecurity incident artifacts, such as malware, phishing emails, and network logs, at its National Cybersecurity and Communications Integration Center to determine the existence or extent of a cybersecurity threat or incident.

Moreover, DOE’s Cybersecurity for Energy Delivery Systems program sponsors grid cybersecurity research through DOE’s national laboratories. For example:

Oak Ridge National Laboratory has conducted research on mechanisms that could help critical infrastructure entities better detect vulnerabilities in software used in industrial control systems.

Four national laboratories have engaged in a project that aims to improve the capability of grid entities to collect and analyze data from their industrial control system networks and detect cybersecurity incidents.

Oak Ridge National Laboratory and Pacific Northwest National Laboratory have a joint project to develop mechanisms for more quickly detecting and eradicating malware on industrial control systems.

Responding to and recovering from cybersecurity incidents Federal agencies have developed policies, strategies, and plans to define their roles and responsibilities for responding to and recovering from grid cybersecurity incidents. In particular, DHS has responsibility for leading the federal effort to mitigate or lessen the impact of such incidents, the Department of Justice has responsibility for the federal law enforcement response to the threats, and DOE has authority, in designated emergencies, to impose measures to restore the reliability of critical electric infrastructure. DOE is also responsible for coordinating the energy sector-specific response with DHS and the Department of Justice.

Federal agencies have also taken steps to help prepare asset owners for cyber response and recovery efforts. For instance, DHS has worked with nonfederal entities to simulate response and recovery efforts to a cyberattack through exercises such as Cyber Storm. In addition, DOE, in conjunction with the National Association of State Energy Officials, has conducted regional energy assurance exercises. These exercises aim to promote state and local preparedness and resilience for future energy emergencies stemming from a cyber incident.

FERC Has Performed Regulatory Activities Aimed at Addressing Grid Cybersecurity Risks

FERC has performed a variety of regulatory activities aimed at addressing grid cybersecurity risks. These activities include (1) approving mandatory cybersecurity standards for the bulk power system, (2) enforcing regulatory requirements through imposition of civil penalties, (3) auditing the performance of the electric reliability organization—NERC— and its regional entities, and (4) auditing bulk power entities for compliance with the mandatory cybersecurity standards.

Approve mandatory cybersecurity standards. FERC has approved mandatory reliability standards relating to cybersecurity protections. For example, in October 2018, FERC approved a new standard to bolster supply chain risk management protections for the nation’s bulk electric system. This new standard, which will become enforceable in July 2020, is intended to augment existing standards that aim to mitigate cybersecurity risks associated with the supply chain for grid- related cyber systems.

Enforce regulatory requirements through imposition of civil penalties. FERC has referred violations of its approved cybersecurity standards to NERC to impose penalties on the bulk power entities that committed the violations. For example, such a notification occurred in January 2019 when NERC assessed a $10 million penalty based on 127 violations of the cybersecurity standards made by an undisclosed entity.

Audit the performance of the electric reliability organization. FERC has audited NERC’s performance as the electric reliability organization. In this audit, which it completed in 2012, FERC evaluated NERC’s budget formulation, administration, and execution. With respect to cybersecurity, FERC recommended that NERC (1) assess its existing staffing levels to ensure adequate resources to accomplish critical infrastructure protection work related to cybersecurity and (2) devote greater resources to carrying out its oversight duties. In 2013, FERC closed these recommendations after reviewing NERC’s plans for evaluating its staffing levels and its commitment to add resources in its business plan. According to FERC officials, FERC continues to monitor the level of resources NERC devotes to cybersecurity oversight through its annual review of NERC’s budget

Audit bulk power entities for compliance with standards. FERC has audited bulk power entities’ compliance with its approved cybersecurity standards. From 2016 through 2018, FERC conducted its own independent audits of eight bulk power entities for compliance with those standards and produced public lessons learned reports based on the results. According to FERC officials, the agency plans to conduct four such audits every fiscal year starting in fiscal year 2019 and to continue producing annual lessons learned reports based on the results. In addition, since the first of the cybersecurity standards became enforceable in 2009, FERC has observed eight NERC regional entity-led audits a year—one in each NERC region—focused on bulk power entity compliance with those standards.

DOE Has Not Fully Defined a Strategy to Address Grid Cybersecurity Risks and Challenges

National strategies are critical tools used to help address longstanding and emerging issues that affect national security and economic stability. In 2004, we identified a set of desirable characteristics for effective national strategies. These characteristics include:

Purpose, scope, and methodology. Addresses why the strategy was produced, the scope of its coverage, and the process by which it was developed.

Problem definition and risk assessment. Addresses the particular national problems, assesses the risks to critical assets and operations—including the threats to, and vulnerabilities of, critical operations—and discusses the quality of data available regarding the risk assessment.

Goals, subordinate objectives, activities, and performance measures. Addresses what the strategy is trying to achieve; steps to achieve those results; and the priorities, milestones, and performance measures that include measurable targets to gauge results and help ensure accountability.

Discussion of needed resources and investments. Addresses what the strategy will cost and the types of resources and investments needed.

Organizational roles, responsibilities, and coordination.

Addresses who will implement the strategy, what their roles will be, and mechanisms to coordinate their efforts.

As previously noted, the executive branch has taken steps toward outlining a federal strategy for confronting cyber threats—including threats to critical infrastructure such as the grid. In addition, as the sector- specific agency, DOE has led the development of approaches to implement the federal cybersecurity strategy for the energy sector, including the grid. Table 2 identifies and describes these approaches— specifically, two agency plans and an assessment—for addressing grid cybersecurity risks and challenges.

The two plans and the assessment do not fully address all of the key characteristics needed for a national strategy. Collectively, the plans and assessment fully address one characteristic—purpose, scope, and methodology—and partially address the other four characteristics of a national strategy (see table 3).

Purpose, scope, and methodology The plans and assessment fully address the characteristic of outlining their purpose, scope, and methodology. For example, the Energy Sector- Specific Plan explains that it was produced to help integrate and guide the sector’s continuing effort to improve the security and resilience of critical infrastructure. In addition, the plan explains that DOE worked closely with the Energy Sector Coordinating Council and the Energy Sector Government Coordinating Council, among others, to develop the plan.

Problem definition and risk assessment The plans and the assessment partially address the characteristic of defining the problem and performing a risk assessment. Each defines the problems that it was intended to address and assesses cybersecurity risks to the grid. For example, DOE’s Assessment of Electricity Disruption Incident Response Capabilities states that it was developed in response to Executive Order 13800’s requirement that DOE examine the potential scope and duration of a prolonged power outage associated with a significant cyber incident. In addition, as previously mentioned, the assessment describes the potential range of load loss resulting from four cyberattack scenarios.

However, the discussion of the quality of data available regarding DOE’s assessment is inaccurate. According to the assessment, the potential range of load loss resulting from four cyberattack scenarios was based on rigorous modeling and analysis from multiple DOE national laboratory experts. However, these results were based on the 2017 Electricity Subsector Risk Characterization Study, which as previously described, has significant limitations affecting the quality of data.

In addition, neither the plans nor the assessment fully analyzed the cybersecurity risks and challenges to the grid. In particular, none of them analyzed the threat of, and vulnerabilities to, a cyberattack spanning all three interconnections. In addition, the initiatives did not assess the vulnerability of the grid to a cyberattack involving high-wattage consumer IoT devices connected to the grid’s distribution system.

Goals, subordinate objectives, activities and performance measures The two plans partially address the characteristic of outlining goals, subordinate objectives, activities, priorities, milestones, and performance measures. Both plans outline the goals, objectives, and activities for addressing cybersecurity risks facing the electric grid. For example, the Energy Sector-Specific Plan describes five goals for the energy sector and three related priorities for the electricity subsector. However, the plans’ goals, objectives, and activities do not fully address the cybersecurity risks to the grid. For example, neither plan includes goals and activities that address the vulnerability of the grid to a cyberattack involving high-wattage consumer IoT devices connected to the grid’s distribution system. Further, in light of the previously identified gaps in the analysis of cybersecurity risks and challenges, the plans’ goals, objectives, and activities are likely not commensurate with grid cybersecurity risks and challenges.

Moreover, only one of the plans—DOE’s Multiyear Plan for Energy Sector Cybersecurity—includes milestones and performance measures for achieving the goals, objectives, and activities. Additionally, this plan does not include performance measures with measurable targets for all objectives, including those aimed at providing timely cyber threat briefings to energy sector partners and developing cyber incident response processes and procedures.

The two plans partially address the characteristic of describing resource and investment needs. Specifically, although the plans identify many resources and investments needed to achieve their goals and objectives, they do not fully identify resource and investment needs. For example, one of the objectives of DOE’s Multiyear Plan for Energy Sector Cybersecurity is to establish a coordinated national cyber incident response capability for the energy sector. However, the plan does not describe the resources or investments needed to meet this objective. This is of particular concern because, as previously mentioned, the Fixing America’s Surface Transportation Act of 2015 authorized DOE to order emergency measures, following a Presidential declaration of a grid security emergency, to protect or restore the reliability of critical electric infrastructure.

In addition, the plans do not describe specific investment costs associated with carrying them out. For example, DOE’s Multiyear Plan for Energy Sector Cybersecurity describes the need to develop a laboratory for identifying and analyzing cybersecurity vulnerabilities to energy delivery systems. However, the plan does not identify the specific costs associated with this investment. Further, given the previously discussed gaps in risk analysis, goals, and objectives, it is unclear to what extent the identified resources and investment needs are sufficient to address electric grid cybersecurity risks and challenges.

Roles, responsibilities, and coordination The two plans partially address the characteristic of describing roles, responsibilities, and coordination mechanisms for carrying out the goals, objectives, and activities. Specifically, the plans describe mechanisms for coordinating but do not always identify organizations responsible for achieving the goals, objectives, and activities. For example, DOE’s Multiyear Plan for Energy Sector Cybersecurity states that the department will partner with DOE’s national laboratories to carry out several activities in the plan. However, the plan does not indicate which of the 10 national laboratories DOE will partner with for each activity.

In a written response, DOE explained that executive branch documents that outline the broader federal strategy for confronting cyber threats— such as the National Cyber Strategy and the DHS Cybersecurity Strategy—address the key characteristics of a national strategy not addressed in DOE’s plans and assessment. In addition, DOE stated that the department’s plans and assessment for addressing risks and challenges facing the grid support and fit within the context of that broader cybersecurity framework while allowing the agency flexibility to accomplish its goals.

Although the broader executive branch strategy documents on confronting cyber threats provide a framework for addressing critical infrastructure cybersecurity risks and challenges, they do not address the specific risks and challenges facing the electric grid. In addition, as previously mentioned, we have reported that these broader executive branch strategy documents also do not include key characteristics of a national strategy. Until DOE ensures it has a plan aimed at implementing the federal cybersecurity strategy relating to the grid that addresses all of the key characteristics of a national strategy—including a full assessment of cybersecurity risks—the guidance the plan provides decision makers in allocating resources to address risks and challenges will likely be limited.

FERC-Approved Standards Do Not Fully Address Grid Cybersecurity Risks

FERC has not ensured that its approved grid cybersecurity standards fully address leading federal guidance for improving critical infrastructure cybersecurity—specifically, the NIST Cybersecurity Framework. In addition, FERC has not evaluated the risk of a coordinated cyberattack on geographically distributed targets in approving the threshold for which grid cyber systems must comply with requirements in the full set of grid cybersecurity standards.

FERC-Approved Standards Do Not Fully Address Leading Federal Guidance for Improving Critical Infrastructure Cybersecurity

The NIST Cybersecurity Framework provides a set of cybersecurity activities, desired outcomes, and applicable references that are common across all critical infrastructure sectors. The framework also states that while it is not exhaustive, it is capable of being extended, allowing organizations, sectors, and other entities to use references that are most appropriate to enable them to manage their cybersecurity risk. NIST recommends that organizations use the Cybersecurity Framework functions, categories, and subcategories to identify the key controls needed to meet their security objectives (see Table 4 for the functions and categories).

To promote widespread adoption of the framework, Executive Order 13636 called for sector-specific agencies to develop mechanisms to encourage the framework’s adoption. In addition, the order called for regulatory agencies to review the framework and determine if current cybersecurity regulatory requirements are sufficient given current and projected risks.

However, the FERC-approved cybersecurity standards do not fully address the NIST Cybersecurity Framework’s five functions and associated categories and subcategories. More specifically, the cybersecurity standards substantially address two of the five functions and partially address the remaining three functions. Table 5 depicts the extent to which these standards address the framework’s five functions and 23 categories. (Appendix II contains more detailed information regarding the extent to which the standards address the framework’s 108 subcategories.)

Legend: ●—Fully address: the standards address all of the related subcategories. ◕—Substantially address: the standards address at least two-thirds, but not all, of the related subcategories. ◑—Partially address: the standards address at least one-third, but less than two-thirds, of the related subcategories. ◔—Minimally address: the standards address less than one-third of the related subcategories.○—Do not address: the standards do not address any of the related subcategories.

As shown in table 5, the FERC-approved cybersecurity standards either fully address or substantially address eight of the 23 categories. For example:

The standards fully address the identity management, authentication, and access control category by fully addressing seven associated subcategories. For instance, the standards fully address the subcategories for credentials to be issued, managed, verified, revoked, and audited for authorized devices, users, and processes; network integrity to be protected; and physical access to assets to be managed and protected.

The standards fully address the response planning category by fully addressing the associated subcategory—a response plan is to be executed during or after an incident.

Conversely, the FERC-approved cybersecurity standards partially address or do not address the remaining 15 of 23 categories. For example:

The standards partially address the category for supply chain risk management. In particular, the standards fully address associated subcategories for establishing supply chain risk management processes, security measures in contracts with suppliers and third- party partners, and evaluations of suppliers and third-party partners to ensure they meet their contractual obligations. However, the standards do not address subcategories for response and recovery planning and testing with suppliers and third-party providers, and for using the supply chain risk management process to identify, prioritize, and assess suppliers and third-party partners.

The standards do not address the three subcategories associated with the risk management strategy category. Specifically, the standards do not call for risk management processes to be established, organizational risk tolerance to be determined, or for the risk tolerance to be informed by the organization’s role in critical infrastructure and sector-specific risk analysis.

In a written response, FERC officials said that the agency did not conduct an assessment to determine how the leading practices identified in the NIST Cybersecurity Framework could be applied to the cybersecurity standards. In addition, FERC officials stated that, while the Commission uses the NIST Cybersecurity Framework as a resource and its approved standards incorporate certain facets of the framework, there is not a one- on-one alignment because the NIST Cybersecurity Framework is not industry specific. According to FERC officials, the framework addresses certain issues outside FERC’s jurisdiction. For example, FERC officials stated that the Commission does not have authority to directly impose obligations on suppliers, vendors, or entities outside its jurisdiction that provide products or services to electric industry stakeholders.

However, full implementation of the NIST Cybersecurity Framework does not require regulatory agencies to impose obligations on entities over which the regulatory agencies do not have authority. Framework categories and subcategories that reference suppliers and vendors call for the organization responsible for implementing the framework to establish and implement processes for managing cybersecurity risks relating to those suppliers and vendors.

In addition, in a written response, NERC officials disagreed with our assessment and stated that a separate comparison by NERC subject matter experts found substantially more overlap between the FERC- approved cybersecurity standards and the NIST Cybersecurity Framework. Moreover, NERC officials said that the intended purpose of the standards differs from the framework’s voluntary nature, and that NERC must ensure all mandatory standards are auditable and implemented by electric utilities nationwide. The officials noted the importance of the NIST Cybersecurity Framework and emphasized that NERC has considered the framework in developing and updating grid cybersecurity standards. However, we believe our analysis accurately reflects the extent that the FERC-approved standards address the NIST Cybersecurity Framework.

Without a full consideration of how the FERC-approved cybersecurity standards address NIST’s Cybersecurity Framework, there is increased risk that bulk power entities will not fully implement leading cybersecurity practices intended to help critical infrastructure entities address cybersecurity risks.

FERC Has Not Evaluated the Risk of Geographically Distributed Cyberattacks in Approving the Threshold for Required Compliance with All Cybersecurity Standards

As previously mentioned, FERC requires cyber systems affecting a generation capacity of 1,500 megawatts or more to comply with requirements in the full set of approved cybersecurity standards since the loss, compromise, or misuse of those systems could have a medium to high impact on the reliable operation of the bulk electric system. FERC approved the 1,500-megawatt threshold based on the results of a NERC analysis. Specifically, NERC staff selected a threshold value based on the loss of one large electric grid asset from a single disruptive event and assumed a loss of power could be compensated, in part, by power from a neighboring region.

However, the analysis did not evaluate the potential risk of a coordinated cyberattack on geographically distributed targets. A coordinated cyberattack could cause multiple power plants, transmission lines, or related grid components in different regions to disconnect from the grid. Such a cyberattack could target, for example, a combination of low- impact systems, each affecting a generation capacity below 1,500 megawatts that, in aggregate, might present a significant risk to the grid.

FERC officials told us that the agency considered but did not evaluate the potential impact of a coordinated cyberattack on geographically distributed targets at the time it approved the threshold because the agency did not have the information it needed to develop a credible threat scenario. FERC officials said they anticipate that a future update to the approved cybersecurity standards may require the collection of relevant data on suspicious cyber activity that could inform a threat scenario for evaluating the potential impact of a coordinated cyberattack on geographically distributed targets. Further, NERC officials told us that, while NERC has not determined that a modification of the 1,500 megawatt threshold is warranted at this time, they continue to monitor the risk of a coordinated cyberattack against multiple low-impact systems and acknowledged that the FERC-approved standards must adapt with the evolving understanding of cyber threats.

In addition, NERC officials explained in a written response that the intent of the 1,500-megawatt threshold is to ensure that industrial control systems with vulnerabilities that are attributable to a common cause (e.g., cybersecurity vulnerabilities in common hardware or software) that could result in the loss of 1,500 megawatts or more of generation capacity are adequately protected. Those officials added that NERC encourages entities to disaggregate their industrial control systems so that individual systems operate and maintain less than 1,500 megawatts of generation capacity. NERC officials noted that the systems associated with the disaggregated generation capacity are very diverse and are therefore less likely to provide any large single point of failure. NERC officials further explained that this disaggregation minimizes the risk to the grid by requiring a malicious actor to conduct a cyberattack on more facilities to achieve a similar loss of power.

However, encouraging grid entities to design industrial control systems so that individual systems operate and maintain less than 1,500 megawatts of generation capacity could still leave the grid vulnerable to a cyberattack on those systems. For example, although a malicious actor may need to attack more systems that fall under the threshold at multiple locations to achieve the attacker’s objective for loss of power (when compared with systems that meet or exceed the threshold), the difficulty of carrying out an attack on additional systems could be less significant if the attacker identifies and exploits vulnerabilities common across the systems. In addition, as previously mentioned, systems that fall under the 1,500- megawatt threshold are not required to follow all of the requirements of the FERC-approved cybersecurity standards; as such, there is increased risk that important security controls have not been implemented for these systems.

According to federal standards for internal control, management should identify, analyze, and respond to risks related to achieving organizational objectives. For example, management comprehensively identifies risks that affect its objectives and analyzes the identified risks to estimate their significance, which provides a basis for responding to the risks.

Without information on the risk of a coordinated cyberattack on geographically distributed targets, FERC does not have assurance that its approved threshold for mandatory compliance with all cybersecurity standards adequately responds to that risk and sufficiently provides for the reliable operation of the grid.

Conclusions

The U.S. electric grid faces an increasing array of cybersecurity risks, as well as significant challenges to addressing those risks. To their credit, federal agencies have performed a variety of critical infrastructure protection and regulatory activities aimed at addressing those risks. In particular, DOE has developed plans and an assessment aimed at implementing the federal strategy for confronting the cyber threats facing the grid. However, those documents do not fully address all of the key characteristics needed to implement a national strategy, including a full assessment of cybersecurity risks to the grid. Until DOE ensures it has a plan that does, the guidance the plan provides decision makers in allocating resources to address grid cybersecurity risks and challenges will likely be limited.

Additionally, FERC has approved mandatory cybersecurity standards for bulk power entities, but those standards address some but not all of the leading cybersecurity practices identified in NIST’s Cybersecurity Framework. Without a full consideration of how the FERC-approved cybersecurity standards address NIST’s Cybersecurity Framework, there is increased risk that bulk power entities will not fully implement leading cybersecurity practices needed to address current and projected risks.

Finally, the threshold for which entities must comply with requirements in the full set of FERC-approved standards is based on the results of an analysis that did not evaluate the potential risk of a coordinated cyberattack on geographically distributed targets. Without information on the risk of such an attack—particularly one that might target low-impact systems that are subject to fewer requirements but in aggregate could affect the grid—FERC does not have assurance that its approved threshold for mandatory compliance adequately responds to that risk and sufficiently provides for the reliable operation of the electric grid.

Recommendations for Executive Action

We are making a total of three recommendations—one to DOE and two to FERC. Specifically:

The Secretary of Energy, in coordination with DHS and other relevant stakeholders, should develop a plan aimed at implementing the federal cybersecurity strategy for the electric grid and ensure that the plan addresses the key characteristics of a national strategy, including a full assessment of cybersecurity risks to the grid. (Recommendation 1)

FERC should consider our assessment and determine whether to direct NERC to adopt any changes to its cybersecurity standards to ensure those standards more fully address the NIST Cybersecurity framework and address current and projected risks. (Recommendation 2)

FERC should (1) evaluate the potential risk of a coordinated cyberattack on geographically distributed targets and, (2) based on the results of that evaluation, determine whether to direct NERC to make any changes to the threshold for mandatory compliance with requirements in the full set of cybersecurity standards. (Recommendation 3)

Agency Comments, Third-Party Views, and Our Evaluation

We provided a draft of this report for review and comment to DOE and FERC—the two agencies to which we made recommendations—as well as DHS, the Department of Commerce (on behalf of NIST), and NERC. DOE and FERC agreed with our recommendations, DHS and the Department of Commerce stated that they had no comments, and NERC disagreed with one of our findings.

DOE and FERC agreed with our recommendations. In its written comments, reproduced in appendix III, DOE concurred with our recommendation and stated that it is working through an interagency process to develop a National Cyber Strategy Implementation Plan that will consider DOE’s Multiyear Plan for Energy Sector Cybersecurity. In its written comments, reproduced in appendix IV, FERC stated that our recommendations were constructive and that it would take steps to implement them. DOE and FERC also provided technical comments, which we incorporated as appropriate.

In its written comments, reproduced in appendix V, NERC stated that it disagreed with our conclusion that the FERC-approved cybersecurity standards do not fully address the NIST Cybersecurity Framework. NERC recognized the importance of the NIST Cybersecurity Framework and emphasized that NERC has considered the framework in developing and updating its grid cybersecurity standards. However, NERC stated that a separate analysis by NERC subject matter experts found substantially more overlap between the standards and the framework than our analysis. In addition, NERC cited a 2011 GAO report that found that the FERC-approved standards, in combination with NERC supplementary guidance, mostly addressed the information security controls in certain NIST guidance at that time.

We reviewed NERC’s analysis comparing the FERC-approved cybersecurity standards to the NIST Cybersecurity Framework and continue to believe our analysis accurately reflects the extent to which the standards address the framework. Further, in this report we assessed the extent to which the FERC-approved standards addressed the NIST Cybersecurity Framework, which is more recent and broader guidance than the NIST guidance that we examined in our 2011 report.

In its comments, NERC also stated it has not determined that any changes are needed to the threshold for mandatory compliance with the full set of cybersecurity standards at this time, but it agrees with the concern that low-impact systems may be more vulnerable to a cyberattack and will continue to evaluate whether the current threshold is appropriate given evolving cybersecurity risks. For example, NERC explained that it is studying cybersecurity supply chain risks, including those associated with low-impact assets not currently subject to its supply chain standards. We believe that this effort could help to better position electric grid entities to address supply chain cybersecurity risks.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Secretaries of Commerce, Energy, and Homeland Security, the Chairman of FERC, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please contact Frank Rusco at (202) 512-3841 or ruscof@gao.gov, and Nick Marinos at (202) 512-9342 or marinosn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe the cybersecurity risks and challenges facing the electric grid, (2) describe federal efforts to address grid cybersecurity risks, (3) assess the extent to which the Department of Energy (DOE) has a defined strategy for addressing grid cybersecurity risks and challenges, and (4) assess the extent to which Federal Energy Regulatory Commission (FERC)-approved cybersecurity standards address grid cybersecurity risks.

To address our first objective, we developed a list of cyber actors that could pose a threat to the grid, identified vulnerable components and processes that could be exploited, reviewed the potential impact of cyberattacks on the grid, and identified key cybersecurity challenges facing the grid. To develop the list of cyber threat actors, we reviewed our prior work on cyber-based threats facing the grid as well as the threats identified by the 2019 Worldwide Threat Assessment of the U.S. Intelligence Community. In addition, we interviewed officials or representatives from the following key federal and nonfederal entities to confirm, add, or remove cyber threat actors identified in our prior work based on their potential impact on grid operations:

Federal agencies. We interviewed officials from DOE, the Department of Homeland Security (DHS), FERC, and the National Institute of Standards and Technology (NIST).

Nonfederal regulatory organizations. We interviewed representatives of the North American Electric Reliability Corporation (NERC).

Grid owners and operators. We interviewed five grid owners and operators. To select these grid owners and operators, we reviewed a membership list of the Electricity Subsector Coordinating Council as of May 2018, divided that list into three categories—investor-owned, municipal, and cooperative utilities—and then randomly selected entities from each of those three categories to interview. The views of the grid owners and operators we selected are not generalizable to the population of utilities in the United States but provide valuable insight into the cybersecurity risks and challenges grid owners and operators face.

National associations. We interviewed representatives of national associations that represent various types of asset owners, entities with regulatory or state interests, and those with grid cybersecurity interests generally. Specifically, we interviewed representatives from the American Public Power Association, Edison Electric Institute, Electric Power Research Institute, Independent System Operator/Regional Transmission Operator Coordinating Council, National Rural Electric Cooperative Association, National Association of Regulatory Utility Commissioners, National Association of State Energy Officials, and North American Transmission Forum Association. The views of the association representatives are not generalizable to the industry but provide valuable insight into the cybersecurity risks and challenges facing the grid.

To identify grid cybersecurity vulnerabilities, we reviewed reports developed by key federal and nonfederal entities and others related to grid vulnerabilities and met with the key federal and nonfederal entities to understand the scale and complexity of these vulnerabilities. We also compiled DHS-provided advisories from 2010 through 2018 related to industrial control system devices. We then summarized information from the DHS website to determine how many DHS issued per year.

With respect to the potential impact of cyberattacks, we reviewed cybersecurity incidents reported to DOE, DHS, and NERC from 2014 through 2018. We also asked these agencies for information on any cybersecurity incidents that occurred prior to 2014 or after 2018 that affected the reliability or availability of the grid. In addition, we reviewed federal reports on cyberattacks that caused power outages in foreign countries and a report developed by the German government regarding a cyberattack on industrial control systems that damaged a German steel mill. Further, we reviewed federal studies assessing the potential for widespread power outages resulting from cyberattacks, and we met with federal officials to discuss the methodologies used to perform these studies. Finally, to identify key cybersecurity challenges facing the grid, we reviewed our prior reports on such challenges as well as federal and industry reports recommended by entities we met with. We also asked the key federal and nonfederal entities to identify challenges facing grid entities in addressing cybersecurity risks, and we compiled the challenges they most often cited.

To address the second objective, we identified critical infrastructure protection and regulatory actions that federal agencies are taking to address grid cybersecurity risks by reviewing federal strategies, plans, and reports describing activities that have been conducted or that are under way and by interviewing the key federal and nonfederal entities to obtain additional details on these activities. We also reviewed FERC- approved cybersecurity standards for the bulk power system. We then categorized critical infrastructure protection activities using the functions in NIST’s Framework for Improving Critical Infrastructure Cybersecurity (commonly referred to as NIST’s Cybersecurity Framework).

For our third objective, we reviewed two DOE-led plans and one assessment aimed at implementing the federal cybersecurity strategy for the energy sector, including the grid. We then compared those plans and assessment with leading practices identified by GAO on key characteristics for a national strategy. In doing so, we assessed each characteristic as follows: fully addresses—the plan or assessment addresses all aspects of the characteristic, partially addresses—the plan or assessment addresses some but not all of the characteristic, or does not address—the plan or assessment does not address any aspects of the characteristic.

We also provided our analysis to DOE officials to review, comment, and provide additional information.

For our fourth objective, we compared the FERC-approved cybersecurity standards with leading federal practices for addressing critical infrastructure cybersecurity risks identified in NIST’s Cybersecurity Framework. Specifically, a GAO analyst compared the FERC-approved cybersecurity standards with the subcategories in the Cybersecurity Framework, and another GAO analyst reviewed and confirmed the results of that analysis. We then summarized the results of these assessments for each of the framework’s five functions, 23 categories, and 108 subcategories as follows: fully address—the standards address all of the related subcategories; substantially address—the standards address at least two-thirds, but not all, of the related subcategories; partially address—the standards address at least one-third, but less than two-thirds, of the related subcategories; minimally address—the standards address less than one-third of the do not address—the standards do not address any of the related subcategories.

We also provided our analysis to FERC and NERC officials to review, comment, and provide additional information.

We also examined the applicability of the FERC-approved cybersecurity standards to non-nuclear power plants and reviewed FERC and NERC information on the analytical basis for that threshold. To calculate the number and aggregate capacity of plants that met the 1,500-megawatt threshold for complying with all FERC-approved cybersecurity standards, we used data from Form EIA-860, “Annual Electric Generator Report,” which includes U.S. plants with generators having nameplate capacity of 1 megawatt or greater. As a proxy for the net real power capability specified in the standards, we selected the generator’s net summer generating capacity. To calculate a total capacity for each individual power plant, we combined the data on the capacity of each plant’s individual operating electric power generators. We then filtered these data to identify plants whose primary purpose is generating electricity for sale as reported on the Form EIA-860. Ultimately, we compared the number and capacity of non-nuclear plants exceeding the 1,500-megawatt threshold to the total number and total U.S. capacity for plants.

We used U.S. Energy Information Administration (EIA) data to estimate the number and capacity of non-nuclear plants exceeding the 1,500- megawatt threshold. To assess the reliability of these data, we reviewed EIA documentation, discussed the quality of the data with EIA officials, and electronically tested the data set for missing data, outliers, or obvious errors. Based on this assessment, we determined that the EIA data were sufficiently reliable for our purposes.

We conducted this performance audit from January 2018 to August 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Assessment of the Extent FERC-Approved Cybersecurity Standards Address the NIST Cybersecurity Framework

The table below provides additional detail on our assessment of the extent to which Federal Energy Regulatory Commission (FERC)- approved cybersecurity standards address the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity’s (commonly known as the NIST Cybersecurity Framework) 23 categories and 108 subcategories.

ID.AM-1: Physical devices and systems within the organization are inventoried.

ID.AM-2: Software platforms and applications within the organization are inventoried.

ID.AM-3: Organizational communication and data flows are mapped.

ID.AM-4: External information systems are catalogued.

ID.AM-5: Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value.

ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, and partners) are established.

ID.BE-1: The organization’s role in the supply chain is identified and communicated.

ID.BE-2: The organization’s place in critical infrastructure and its industry sector is identified and communicated.

ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated.

ID.BE-4: Dependencies and critical functions for delivery of critical services are established.

ID.BE-5: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations).

ID.GV-1: Organizational information security cybersecurity policy is established and communicated.

ID.GV-2: Cybersecurity roles and responsibilities are coordinated and aligned with internal roles and external partners.

ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed.

ID.GV-4: Governance and risk management processes address cybersecurity risks.

ID.RA-1: Asset vulnerabilities are identified and documented.

ID.RA-2: Cyber threat intelligence is received from information-sharing forums and sources.

ID.RA-3: Threats, both internal and external, are identified and documented.

ID.RA-4: Potential business impacts and likelihoods are identified.

ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk.

ID.RA-6: Risk responses are identified and prioritized.

Risk Management Strategy (ID.RM): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.

ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders.

ID.RM-2: Organizational risk tolerance is determined and clearly expressed.

ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector-specific risk analysis.

Supply Chain Risk Management (ID.SC): The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has established and implemented the processes to identify, assess, and manage supply chain risks.

ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders.

ID.SC-2: Suppliers and third-party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process.

ID.SC-3: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.

ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.

ID.SC-5: Response and recovery planning and testing are conducted with suppliers and third-party providers.

Identity Management Authentication and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.

PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.

PR.AC-2: Physical access to assets is managed and protected.

PR.AC-3: Remote access is managed.

PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.

PR.AC-5: Network integrity is protected (e.g. network segregation and network segmentation).

PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions.

PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).

Awareness and Training (PR.AT): The organization’s personnel and partners are provided cybersecurity awareness education and are adequately trained to perform their information security-related cybersecurity duties and responsibilities consistent with related policies, procedures, and agreements.

PR.AT-1: All users are informed and trained.

PR.AT-2: Privileged users understand their roles and responsibilities.

PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, and partners) understand their roles and responsibilities.

PR.AT-4: Senior executives understand their roles and responsibilities.

PR.AT-5: Physical and information security cybersecurity personnel understand their roles and responsibilities.

PR.DS-1: Data-at-rest is protected.

PR.DS-2: Data-in-transit is protected.

PR.DS-3: Assets are formally managed throughout removal, transfers, and disposition.

PR.DS-4: Adequate capacity to ensure availability is maintained.

PR.DS-5: Protections against data leaks are implemented.

PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity.

PR.DS-7: The development and testing environment(s) are separate from the production environment.

PR.DS-8: Integrity checking mechanisms are used to verify hardware integrity.

PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).

PR.IP-2: A System Development Life Cycle to manage systems is implemented.

PR.IP-3: Configuration change control processes are in place.

PR.IP-4: Backups of information are conducted, maintained, and tested periodically.

PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met.

PR.IP-6: Data are destroyed according to policy.

PR.IP-7: Protection processes are continuously improved.

PR.IP-8: Effectiveness of protection technologies is shared with appropriate parties.

PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed.

PR.IP-10: Response and recovery plans are tested.

PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning and personnel screening).

PR.IP-12: A vulnerability management plan is developed and implemented.

Maintenance (PR.MA): Maintenance and repairs of industrial control and information system components are performed consistent with policies and procedures.

PR.MA-1: Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools.

PR.MA-2: Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.

PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.

PR.PT-2: Removable media is protected and its use restricted according to policy.

PR.PT-3: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.

PR.PT-4: Communications and control networks are protected.

PR.PT-5: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.

Anomalies and Events (DE.AE): Anomalous activity is detected and the potential impact of events is understood.

DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed.

DE.AE-2: Detected events are analyzed to understand attack targets and methods.

DE.AE-3: Event data are aggregated, collected, and correlated from multiple sources and sensors.

DE.AE-4: Impact of events is determined.

DE.AE-5: Incident alert thresholds are established.

Security Continuous Monitoring (DE.CM): The information system and assets are monitored at discrete intervals to identify cybersecurity events and verify the effectiveness of protective measures.

DE.CM-1: The network is monitored to detect potential cybersecurity events.

DE.CM-2: The physical environment is monitored to detect potential cybersecurity events.

DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events.

DE.CM-4: Malicious code is detected.

DE.CM-5: Unauthorized mobile code is detected.

DE.CM-6: External service provider activity is monitored to detect potential cybersecurity events.

DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed.

DE.CM-8: Vulnerability scans are performed.

Detection Processes (DE.DP): Detection processes and procedures are maintained and tested to ensure awareness of anomalous events.

DE.DP-1: Roles and responsibilities for detection are well defined to ensure accountability.

DE.DP-2: Detection activities comply with all applicable requirements.

DE.DP-3: Detection processes are tested.

DE.DP-4: Event detection information is communicated to appropriate parties.

DE.DP-5: Detection processes are continuously improved.

Response Planning (RS.RP): Response processes and procedures are executed and maintained, to ensure response to detected cybersecurity events.

RS.RP-1: Response plan is executed during or after an event.

RS.CO-1: Personnel know their roles and order of operations when a response is needed.

RS.CO-2: Incidents are reported consistent with established criteria.

RS.CO-3: Information is shared consistent with response plans.

RS.CO-4: Coordination with stakeholders occurs consistent with response plans.

RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness.

Analysis (RS.AN): Analysis is conducted to ensure effective response and support recovery activities.

RS.AN-1: Notifications from detection systems are investigated.

RS.AN-2: The impact of the incident is understood.

RS.AN-3: Forensics are performed.

RS.AN-4: Incidents are categorized consistent with response plans.

RS-AN-5: Processes are established to receive, analyze, and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers).

RS.MI-1: Incidents are contained.

RS.MI-2: Incidents are mitigated.

RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks.

Improvements (RS.IM): Organizational response activities are improved by incorporating lessons learned from current and previous detection/response activities.

RS.IM-1: Response plans incorporate lessons learned.

RS.IM-2: Response strategies are updated.

Recovery Planning (RC.RP): Recovery processes and procedures are executed and maintained to ensure timely restoration of systems or assets affected by cybersecurity events.

RC.RP-1: Recovery plan is executed during or after a cybersecurity event.

Improvements (RC.IM): Recovery planning and processes are improved by incorporating lessons learned into future activities.

RC.IM-1: Recovery plans incorporate lessons learned.

RC.IM-2: Recovery strategies are updated.

RC.CO-1: Public relations are managed.

RC.CO-2: Reputation after an event is repaired.

RC.CO-3: Recovery activities are communicated to internal and external stakeholders as well as to executive and management teams.

Legend: ●—Fully address: the standards address all of the related subcategories. ◕—Substantially address: the standards address at least two-thirds, but not all, of the related subcategories. ◑—Partially address: the standards address at least one-third, but less than two-thirds, of the related subcategories. ◔—Minimally address: the standards address less than one-third of the related subcategories.○—Do not address: the standards do not address any of the related subcategories.

Appendix IV: Comments from the Federal Energy Regulatory Commission

Appendix V: Comments from the North American Electric Reliability Corporation

Appendix VI: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the contact named above, Kaelin Kuhn (Assistant Director), David Marroni (Assistant Director), Andrew Moore (Analyst in Charge), Dino Papanastasiou (Analyst in Charge), David Aja, Christopher Businsky, Kendall Childers, Travis Conley, Rebecca Eyler, Philip Farah, Jonathan Felbinger, Quindi Franco, Wil Gerard, Cindy Gilbert, Mike Gilmore, Andrew Howard, Paul Kazemersky, Lisa Maine, Carlo Mozo, Cynthia Norris, Sukhjoot Singh, Adam Vodraska, and Jarrod West made key contributions to this report.