DHS, DOE and FERC have taken various actions to address electromagnetic risks to the electric grid, and these actions generally fall into four categories: (1) standards, guidelines, tools and demonstration projects; (2) research reports; (3) strategy development and planning; and (4) training and outreach. Additionally, some of the actions DHS and DOE have taken generally aligned with recommendations made by the EMP Commission. Because federal agencies generally do not own electric grid infrastructure, federal actions to address GMD risks are more indirect through such things as developing standards and guidelines, and conducting research that could benefit electric grid owners and operators. Federal agencies have also been involved in strategy development and planning, as well as training and outreach efforts, as a means of preparing federal officials and others to respond to both EMP and GMD events, and enhancing knowledge about electromagnetic risks. For example, DHS’s Science and Technology Directorate (S&T) led the design and development of a prototype transformer that can be more easily transported to another location to help restore electric power in a timelier manner. DHS has also participated in various training and outreach events to enhance understanding of EMP and GMD events. DOE’s primary efforts include supporting research to enhance the understanding of the potential impacts to the electric grid from electromagnetic events. More detailed information on key federal agencies’ actions taken since 2008 to address electromagnetic risks can be found in Appendix II of our March 2016 report. Although DHS and DOE did not report that any of their actions were taken in response to the EMP Commission recommendations, some actions taken by both agencies have aligned with some of the recommendations. Specifically, of the seven recommendations made by the EMP Commission related to the electric grid, some of the actions that DHS and DOE took aligned with four of them: conducting research to better understand the interdependencies of critical infrastructures, addressing the vulnerability of control systems to an EMP attack; identifying responsibilities for responding to an EMP attack; and utilizing industry and other governmental institutions to assure the most cost-effective outcomes. For example, with respect to the recommendation on conducting research to better understand interdependencies of critical infrastructures, DHS’s Sector Resilience Report: Electric Power Delivery includes some assessment of how various critical infrastructures— including the energy, communications, and transportation sectors, among others—are interdependent in maintaining operations. For more detailed information regarding how identified federal actions align with these seven EMP Commission recommendations, see Appendix III of our March 2016 report. In our March 2016 report, we found that DHS had not clearly identified internal roles and responsibilities for addressing electromagnetic risks to the electric grid or communicated these to external federal and industry partners. While multiple DHS components and offices, including the National Protection and Programs Directorate (NPPD), the Federal Emergency Management Agency (FEMA), and S&T, had each conducted independent activities addressing electromagnetic risks to the electric grid, none had been tasked with lead responsibility for coordinating related activities within the department or with federal and industry stakeholders. As a result, during the course of our review for our March 2016 report, we experienced ongoing challenges in identifying applicable DHS personnel and related departmental actions. For example, NPPD officials had difficulty identifying their specific roles and activities addressing electromagnetic risks to the electric grid, including efforts to collect or synthesize available risk information to provide input into department-wide risk assessments. Furthermore, industry representatives and other federal officials told us it is not clear who within DHS is responsible for addressing electromagnetic risks. The 2008 EMP Commission report recommended that DHS make clear its authority and responsibilities, as well as delineate the functioning interfaces with other governmental institutions, regarding EMP response efforts. We concluded that designating internal roles and responsibilities within DHS regarding electromagnetic risks and communicating these to federal and industry partners could provide additional awareness of related activities and help ensure more effective and coordinated engagement with other federal agencies and industry stakeholders, and could help reduce the risk of potential duplication, overlap, or fragmentation within the department or across federal agencies. In our March 2016 report, we recommended DHS designate roles and responsibilities within the department for addressing electromagnetic risks and communicate these to federal and industry partners. DHS concurred with our recommendation and reported that their Office of Policy is coordinating across the department to identify and document applicable roles and responsibilities regarding electromagnetic issues to ensure full mission coverage while minimizing potential overlap or redundancy and expects to complete this effort by December 2016. These actions, if implemented effectively, should address the intent of our recommendation. In our March 2016 report, we found that DHS and DOE had not taken actions to identify key electrical infrastructure assets as required given their respective critical infrastructure responsibilities under the NIPP. The NIPP explicitly states that to manage critical infrastructure risk effectively, partners must identify the assets, systems, and networks that are essential to their continued operation, considering associated dependencies and interdependencies of other infrastructure sectors. The 2008 EMP Commission report also recommended that DHS and DOE prioritize nodes that are critical for the rapid recovery of other key sectors that rely upon electricity to function, including those assets that must remain in service or be restored within hours of an EMP attack. Neither DHS nor DOE reported any specific actions taken to identify critical electrical infrastructure as part of risk management efforts for the energy sector, including any systematic review of a 2013 FERC analysis of critical substations, or any further collaboration to determine the key elements of criticality that they believe should be considered when evaluating the vast array of infrastructure assets constituting the U.S. electric grid. The extensive size and scope of the electric power system necessitates collaboration among partners to ensure all individual expertise is effectively leveraged. As a result, we recommended in our March 2016 report that DHS and DOE direct responsible officials to review FERC’s electrical infrastructure analysis and collaborate to determine whether further assessment is needed to adequately identify critical electric infrastructure assets. DHS and DOE each concurred with our recommendation. DHS reported that NPPD is to collaborate with FERC to identify critical electrical infrastructure assets beginning with the evaluation of critical substations identified by FERC, and will explore elements of criticality that might not have been considered by FERC, in coordination with DOE. DOE stated that its Office of Electricity Delivery and Energy Reliability will review FERC’s electrical infrastructure analysis and will work with FERC and DHS to identify any additional elements of criticality and determine if further assessment is needed. Both DHS and DOE expect to complete these efforts by March 2017. These actions should address the intent of our recommendation. We found in March 2016 that although DHS components had independently conducted some efforts to assess electromagnetic risks, the department had not fully leveraged available risk information or conducted a comprehensive analysis of these risks. Within the Office of Policy, there is recognition that “space weather” and “power grid failure” are significant risk events, which DHS officials have determined pose great risk to the security of the nation. However, DHS officials were unable to provide detailed information about the specific risk inputs— namely threat, vulnerability, and consequence information—that were used to assess how electromagnetic events compared to other risk events, or how these inputs were used to inform DHS’s applicable risk- management priorities. Further, officials within NPPD were unable to identify any specific actions taken or plans to systematically collect or analyze risk information regarding electromagnetic impacts to the electric grid as part of department-wide risk assessment efforts. According to the NIPP, to assess risk effectively, critical infrastructure partners—including owners and operators, sector councils, and government agencies—need timely, reliable, and actionable information regarding threats, vulnerabilities, and consequences. Additionally, the electric grid remains vulnerable to other potential threats, such as physical and cyberattacks. We concluded that better collection of threat, vulnerability, and consequence information through existing DHS programs and strengthened collaboration with federal partners could help DHS better assess the relative risk ranking of electromagnetic events versus other risks and help inform asset protection priorities. Moreover, according to subject-matter experts, the impact to the electric grid from electromagnetic threats may vary substantially by location, network and operating characteristics, and other factors. For example, key reports on GMD indicate that high-voltage transformers located at higher latitudes in the United States are likely subject to increased potential for adverse impacts from GMD events than those at lower latitudes. Further collection of information on sector interdependencies could also help DHS to assess the potential economic consequences associated with long-term power outages and provide information to help assess the cost- effectiveness of various mitigation strategies. In our March 2016 report, we recommended that DHS’s NPPD and Office of Infrastructure Protection (IP) work with other federal and industry partners to collect and analyze key inputs on threat, vulnerability, and consequences related to electromagnetic risks. DHS concurred with our recommendation and reported that the department has initiated efforts to assess electromagnetic risk and help determine priorities. For example, DHS stated the Department has a joint study with DOE underway that will analyze the hazard environments, impacts, and consequences of different sources of EMP and GMD on the electric grid to determine events of concern and potential means of mitigation. DHS expects to implement these efforts by December 2016 and if implemented effectively, should address the intent of our recommendation. We also found in March 2016 that key federal agencies, including DHS and DOE, as well as industry partners had not established a fully coordinated approach to identifying and implementing risk management activities to address EMP risks. According to the NIPP Risk Management Framework, such activities include identifying and prioritizing research and development efforts, and evaluating potential mitigation options, including the cost-effectiveness of specific protective equipment. The publication of the National Space Weather Action Plan in October 2015 identified many key federal activities in these areas regarding the GMD risk; however, no similar efforts had been proposed regarding EMP risks to the electric grid. DHS officials stated an EMP attack generally remains a lower risk priority compared to other risk events with higher probability such as natural disasters or cyberattacks. DOE officials also noted resource limitations and competing priorities as the key driver for not pursuing additional risk management activities specifically related to EMP events. However, we found that even if an EMP attack is not determined to be among the highest resource priorities for DHS and DOE relative to other risk events, there are opportunities for enhanced collaboration among federal agencies and industry stakeholders to address identified gaps and help ensure that limited resources are more effectively coordinated and prioritized. For example, recent reports issued by DOE and a leading research organization for the electric industry identified gaps in the information available regarding likely EMP impacts to modern grid technologies and electronic control systems. They noted that such information remains important for developing applicable protective guidelines and equipment design specifications. In our March 2016 report, we recommended that DHS and DOE engage with federal partners and industry stakeholders to identify and implement key EMP research and development priorities, including opportunities for further testing and evaluation of potential EMP protection and mitigation options. DHS and DOE concurred with our recommendation and each identified actions to convene applicable stakeholders to jointly determine mitigation options and conduct further testing and evaluation. DHS stated S&T will work with DOE and the Electricity Subsector Coordinating Council to develop a joint government and industry approach to identify options for mitigating the consequences of an EMP event. DHS expects to implement this effort by September 2016. In addition, DOE stated it is working with the Electric Power Research Institute to develop an EMP Strategy that is scheduled for completion by August 31, 2016, and the strategy is to be followed by a more detailed action plan identifying research and development priorities and specific opportunities to test and evaluate EMP mitigation and protection measures. If implemented effectively, DHS and DOE’s actions should address the intent of our recommendation. We will continue to monitor DHS and DOE actions taken to address our March 2016 recommendations and have also recently initiated two additional reviews. One is evaluating the electromagnetic event preparedness of U.S. electricity providers and the other is a technical assessment of protective equipment designed to mitigate the potential impacts of a GMD on electrical infrastructure. We expect these projects to be completed by mid-2017. Chairman Perry, Ranking Member Watson Coleman, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you or your staff members have any questions concerning this testimony, please contact Chris Currie, Director, Homeland Security and Justice at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions include Dawn Hoff, Assistant Director; Chuck Bausell, Kendall Childers, Josh Diosomito, Ryan Lambert, Tom Lombardi, Steven Putansu, John Rastler, and Cody Raysinger. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: This testimony summarizes the information contained in GAO's March 2016 report, entitled Critical Infrastructure Protection: Federal Agencies Have Taken Actions to Address Electromagnetic Risks, but Opportunities Exist to Further Assess Risks and Strengthen Collaboration , GAO-16-243 . Key federal agencies have taken various actions to address electromagnetic risks to the electric grid, and some actions align with the recommendations made in 2008 by the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack (EMP Commission). Since 2008, the Department of Homeland Security (DHS), the Department of Energy (DOE), and the Federal Energy Regulatory Commission (FERC) have taken actions such as establishing industry standards and federal guidelines, and completing EMP-related research reports. GAO found that their actions aligned with some of the EMP Commission recommendations related to the electric grid. For example, DHS developed EMP protection guidelines to help federal agencies and industry identify options for safeguarding critical communication equipment and control systems from an EMP attack. Further, agency actions and EMP Commission recommendations generally align with DHS and DOE critical infrastructure responsibilities, such as assessing risks and identifying key assets. Additional opportunities exist to enhance federal efforts to address electromagnetic risks to the electric grid. Specifically, DHS has not identified internal roles and responsibilities for addressing electromagnetic risks, which has led to limited awareness of related activities within the department and reduced opportunity for coordination with external partners. Doing so could provide additional awareness of related activities and help ensure more effective collaboration with other federal agencies and industry stakeholders. Moreover, although DHS components have independently conducted some efforts to assess electromagnetic risks, DHS has not fully leveraged opportunities to collect key risk inputs—namely threat, vulnerability, and consequence information—to inform comprehensive risk assessments of electromagnetic events. Within DHS, there is recognition that space weather and power grid failure are significant risk events, which DHS officials have determined pose great risk to the security of the nation. Better collection of risk inputs, including additional leveraging of information available from stakeholders, could help to further inform DHS assessment of these risks. DHS and DOE also did not report taking any actions to identify critical electrical infrastructure assets, as called for in the National Infrastructure Protection Plan. Although FERC conducted a related effort in 2013, DHS and DOE were not involved and have unique knowledge and expertise that could be utilized to better ensure that key assets are adequately identified and all applicable elements of criticality are considered. Finally, DHS and DOE, in conjunction with industry, have not established a coordinated approach to identifying and implementing key risk management activities to address EMP risks. Such activities include identifying and prioritizing key research and development efforts, and evaluating potential mitigation options, including the cost-effectiveness of specific protective equipment. Enhanced coordination to determine key research priorities could help address some identified research gaps and may help alleviate concerns voiced by industry regarding the costs and potential adverse consequences on grid reliability that may be caused by implementation of such equipment.