Recent national policies and federal preparedness efforts have highlighted the importance of enhancing the resilience of the nation’s critical infrastructure, including the electricity grid. Presidential Policy Directive 21, issued in February 2013, established national policy on critical infrastructure security and resilience. The directive expanded the nation’s focus from protecting critical infrastructure against terrorism to protecting critical infrastructure and increasing its resilience against all hazards, including natural disasters, terrorism, and cyber incidents. In addition, the directive recognizes that proactive and coordinated efforts are necessary to strengthen and maintain critical infrastructure that is secure and resilient. It also identifies 16 critical infrastructure sectors, including the energy sector—which encompasses the electricity grid—and designates lead federal agencies to coordinate and prioritize security and resiliency activities in each sector. DOE was designated as the lead federal agency for the energy sector. Reflecting the shift in focus in Presidential Policy Directive 21, the December 2013 update to the National Infrastructure Protection Plan elevated security and resilience to be the primary aim of federal critical infrastructure planning efforts. The update established a set of broad national goals for critical infrastructure security and resilience and directed that each of the 16 critical infrastructure sectors update its sector-specific plan—a planning document that complements and tailors the application of the National Infrastructure Protection Plan to the specific characteristics and risks of each critical infrastructure sector. In response, DOE in 2015 led the development of an updated Energy Sector-Specific Plan to help guide and integrate efforts to improve the security and resilience of the energy sector’s critical infrastructure, including the electricity grid. The plan identified three federal priorities for enhancing the security and resilience of the grid: (1) developing and deploying tools and technologies to enhance awareness of potential disruptions, (2) planning and exercising coordinated responses to disruptive events, and (3) ensuring actionable intelligence on threats is communicated between government and industry in a time-sensitive manner. In addition, in 2016 the United States developed an action plan and issued a joint strategy with Canada for strengthening the security and resilience of the North American electricity grid. As table 1 shows, federal roles and responsibilities related to enhancing the resilience of the electricity grid are defined in policy and law, including Presidential Policy Directive 21 and certain provisions of the Fixing America’s Surface Transportation Act of 2015. States and industry also play key roles in enhancing the resilience of the electricity grid. States, through their public utility commissions, regulate retail electricity service and facility planning and siting. States also enact policies that can affect the resilience of the portion of the electricity grid that is within their borders. Industry owns and operates most of the electricity grid, so the actions that owners and operators take to protect and maintain their assets can contribute to grid resilience. In addition, owners and operators of the electricity grid are responsible for complying with mandatory reliability standards that can contribute to grid resilience. DOE, DHS, and FERC reported implementing 27 grid resiliency efforts since 2013 that supported a range of activities and that addressed multiple hazards and federal priorities for enhancing the resilience of the electricity grid. Agency officials reported a variety of results stemming from these efforts. In response to our questionnaire, DOE, DHS, and FERC officials reported implementing 27 efforts since 2013 that aimed at enhancing the resilience of the electricity grid. Of these 27 efforts, 12 were FERC regulatory efforts tied to the agency’s role in reviewing and approving mandatory reliability standards for the bulk power system. FERC officials also reported that the agency oversaw another effort in which it acted on a petition by a private company to provide regulatory findings related to the company’s plan to establish a subscription service for spare critical transmission equipment, including transformers. The remaining 14 efforts—11 implemented by DOE and 3 by DHS—were programmatic in nature. Federal funding for the DOE and DHS grid resiliency activities from fiscal year 2013 through fiscal year 2015 totaled approximately $240 million. The 27 efforts that DOE, DHS, and FERC officials reported implementing supported a range of activities, addressed a variety of potential threats and hazards, and addressed federal priorities for enhancing the resilience of the electricity grid (see app. II for more information on each effort). As table 2 shows, the reported federal grid resiliency efforts supported a range of activities, with the most prevalent being: emergency preparedness and response activities (e.g. providing coordination, planning, training, and exercise programs to prepare for potential disaster operations; providing situational awareness during an event; coordinating response efforts; and helping facilitate system restoration); research and development activities (e.g. pursuing tools, technologies, and demonstrations aimed at bringing new and innovative technologies to maturity and helping them transition to industry); modeling, analytics, and risk assessment activities (e.g. modeling, simulation, and analysis of electricity grid risks and vulnerabilities); and standard-setting activities (e.g. the development or approval of standards for industry). For example, DOE reported that its Strategic Transformer Reserve effort supported emergency preparedness and response activities through planning for the potential loss of large, high-power transformers by evaluating the feasibility of establishing a reserve of those transformers for use during an emergency. Similarly, FERC reported that its efforts supported emergency preparedness and response activities as well as activities to set standards by approving a reliability standard that requires owners and operators of the electricity grid to develop and implement procedures to mitigate the potential effects of geomagnetic disturbances on the bulk power system. In addition, DHS reported that its Recovery Transformer Program supported research and development activities by designing and demonstrating a type of rapidly deployable large, high- power transformer for use in the event of the unexpected loss of multiple large, high-power transformers. As table 3 shows, the agencies reported that their federal grid resiliency efforts addressed a range of threats and hazards, including cyberattacks (i.e. computer-related attacks); physical attacks (e.g. attacks on physical infrastructure such as targeted shooting of transformers or intentional downing of power lines); natural disasters (e.g. extreme weather events and geomagnetic disturbances); and operational accidents (e.g. unintentional equipment failures or operator error). For example, DOE and FERC reported implementing several grid resiliency efforts to address the threat of cyberattacks. DOE’s Electricity Subsector Cybersecurity Capability Maturity Model effort was a public-private partnership that developed a tool kit modeled on a common set of industry-vetted cybersecurity practices; the effort made this tool kit available to the electricity industry to help owners and operators evaluate, prioritize, and improve their cybersecurity capabilities. Similarly, of the 12 reliability standards FERC approved, several require owners and operators of the electricity grid to take actions to mitigate the threat posed by cyberattacks on the bulk power system. As table 4 shows, the reported federal grid resiliency efforts collectively addressed each of the three federal priorities for enhancing the security and resilience of the electricity grid that were identified in the 2015 Energy Sector-Specific Plan. For example, DHS’s Solar Storm Mitigation effort addressed the federal priority of developing and deploying tools and technologies to enhance awareness of potential disruptions; the effort addressed this priority by providing owners and operators of the electricity grid with advanced and actionable information about anticipated impacts of a solar storm. Similarly, DOE’s Cybersecurity Risk Information Sharing Program addressed the federal priority to ensure actionable intelligence on threats is communicated between government and industry in a time- sensitive manner; the effort addressed this priority by facilitating the timely sharing of unclassified and classified cybersecurity threat information and developing situational awareness tools to better identify, prioritize, and coordinate the protection of critical electricity infrastructure. In their questionnaire responses, agency officials reported a variety of results from both ongoing and completed federal grid resiliency efforts. As shown in the selected examples in table 5, these results included the development, and in some cases the deployment, of new technologies and analytical tools; the planning and exercising of coordinated responses to disruptive events; and improved coordination and information sharing between the federal government and industry related to potential cyberattacks and other threats or hazards to the electricity grid. We found that the 27 federal efforts to enhance the resilience of the electricity grid were fragmented across DOE, DHS, and FERC and overlapped to some degree, but we did not find any instances of duplication among these efforts. In their questionnaire responses, agency officials reported engaging in a number of activities and mechanisms to coordinate their efforts and avoid duplication. These activities and mechanisms include serving as members on formal coordinating bodies that bring together federal, state, and industry stakeholders in the energy sector to discuss resiliency issues on a regular basis; contributing to the development of federal plans and reviews that address grid resiliency gaps and priorities; and participating in direct coordination activities at the program level. According to our analysis of agency questionnaire responses, federal grid resiliency efforts were fragmented and overlapped to some degree, but none were duplicative. In addition, industry group representatives we interviewed did not identify any instances of duplication among federal grid resiliency efforts. Fragmentation. The 27 federal efforts to enhance the resilience of the electricity grid were fragmented in that they were implemented by three different agencies—DOE, DHS, and FERC—and addressed the same broad area of national need: enhancing the resilience of the electricity grid. We have previously reported that fragmentation has the potential to result in duplication of resources. For example, fragmentation can lead to technical or administrative functions being managed separately by individual agencies, when these functions could be shared among programs. However, we also have reported that fragmentation, by itself, is not an indication that unnecessary duplication of efforts or activities exists. There can be advantages to having multiple federal agencies involved in a broad area of national need; for example, agencies can tailor initiatives to suit their specific missions and needs, among other things. In the case of federal grid resiliency efforts, we found that DOE, DHS, and FERC generally have tailored their efforts to contribute to their specific missions and needs. For example, DOE’s 11 efforts related to its strategic goal to support a more secure and resilient U.S. energy infrastructure; DHS’s 3 efforts addressed its strategic priority to enhance critical infrastructure security and resilience by, among other things, promoting resilient critical infrastructure design; and FERC’s 13 efforts related to the agency’s roles in reviewing and approving reliability standards and regulating the interstate transmission of electricity. Moreover, fragmentation of federal grid resiliency efforts within agencies is limited—10 of the 11 DOE efforts, all 13 FERC efforts, and all 3 DHS efforts were implemented by one organization within each respective agency. Overlap. We found that 23 of the 27 federal grid resiliency efforts overlapped to some degree with at least one other effort in that they addressed similar goals. These overlaps included: 12 efforts with similar goals related to enhancing the cybersecurity of 4 with similar goals related to enhancing the resilience and availability of large, high-power transformers; 3 with similar goals related to enhancing the grid’s resilience to 2 with similar goals related to enhancing energy storage technology; 2 with similar goals related to enhancing the resilience of the grid’s distribution system. As figure 1 illustrates, we also found that all but one federal grid resiliency effort overlapped to some degree with at least one other effort by supporting similar types of activities to achieve their goals. Duplication. We did not find any instances of duplication among the 27 federal grid resiliency efforts because none of the efforts had the same goals or engaged in the same activities. For example, although 4 efforts overlapped in that they had similar goals related to enhancing the resilience of large, high-power transformers and improving their availability, those efforts were not duplicative because their goals were not the same. Specifically, DHS’s Recovery Transformer Program, begun in 2008 and completed in 2014, aimed to design and demonstrate a rapidly deployable large, high-power transformer that could be used to enable rapid recovery of the grid in the event of multiple large, high-power transformer failures. In contrast, DOE’s Transformer Resilience and Advanced Components Program, launched in 2016, is focused on ensuring the resilience of aging transformers and accelerating the development, demonstration, and deployment of next-generation transformer components. Furthermore, DOE’s Strategic Transformer Reserve effort is an analytical and planning activity with a goal of developing a plan for Congress related to establishing a strategic transformer reserve. Similarly, a fourth effort led by FERC was distinct from the other three efforts in that its goal was to act on a petition from a private company for regulatory findings related to the company’s plan to establish a subscription service for spare critical transmission equipment, including transformers. In their questionnaire responses, DOE, DHS, and FERC reported coordinating with each other on their federal grid resiliency efforts through a variety of activities and mechanisms. In particular, agency officials associated with all of the programmatic efforts that we identified as having overlapping characteristics (in that they supported similar goals and types of activities) reported coordinating with other federal agencies. Furthermore, many reported coordinating their efforts with states, and most also reported coordinating their efforts with industry. Coordination is important because, as we have previously reported, it can preserve scarce funds and enhance the overall effectiveness of federal efforts. We also have previously reported that coordination across programs may help address fragmentation, overlap, and duplication. We found that coordination activities and mechanisms among DOE, DHS, and FERC were consistent with key practices we have previously identified that can help enhance and sustain federal agency coordination, such as (1) defining and articulating a common outcome; (2) establishing joint strategies, which helps align activities, core processes, and resources to accomplish a common outcome; (3) leveraging resources, which helps obtain additional benefits that would not be available if agencies or offices were working separately; and (4) developing mechanisms to monitor, evaluate, and report on results. We analyzed and grouped into seven categories the various coordination activities and mechanisms that agency officials reported in their questionnaire responses. These categories and examples of specific activities are: Participating in formal coordinating bodies. Agency officials reported participating in several formally established coordinating bodies. In particular, DOE and DHS officials identified the Electricity Subsector Coordinating Council and the Energy Sector Government Coordinating Council as key mechanisms that help coordinate grid resiliency efforts across federal agencies and with states and industry stakeholders. According to the Electricity Subsector Coordinating Council’s charter, the council’s purpose includes coordinating activities and initiatives designed to improve the reliability and resilience of the electricity subsector, including the electricity grid, and serving as the principal liaison between the council’s membership and the Energy Sector Government Coordinating Council. The Energy Sector Government Coordinating Council is the government counterpart of the Electricity Subsector Coordinating Council, and its purpose is to enable interagency and cross-jurisdictional coordination on planning, implementing, and executing resilience programs for the nation’s critical energy infrastructure. Agency officials told us that federal grid resiliency efforts and their results are discussed at meetings of these two councils as a way to share information, coordinate efforts, and avoid duplication. We have previously found that federal programs that contribute to the same or similar results should collaborate to ensure that goals are consistent and, as appropriate, program efforts are mutually reinforcing. Contributing to federal planning efforts. Agency officials reported contributing to federal plans and reviews that addressed grid resiliency gaps and priorities. For example, DOE and DHS officials said they contributed to the development of the 2015 Quadrennial Energy Review, which, among other things, assessed the vulnerabilities of the electricity grid and recommended ways to enhance its resilience. Agency officials also told us that they collaborated on the development of the 2015 Energy Sector-Specific Plan, which identified three federal priorities for enhancing the security and resilience of the electricity grid. We have previously reported that it is important for collaborating agencies to establish strategies that work in concert with those of their partners or that are joint in nature, because such strategies help align the agencies’ activities to accomplish a common outcome. Maintaining a record of federal, state, and industry efforts. DOE officials reported that the agency maintains a record of federal-, state-, and industry-critical energy sector infrastructure programs and initiatives; this record includes federal grid resiliency efforts. Officials told us that they update the record, which was created in 2013, as new programs and initiatives are identified at meetings of the Electricity Subsector Coordinating Council and the Energy Sector Government Coordinating Council. DOE officials said that they use the record as an internal tool for tracking energy-sector programs and initiatives and as a means to share information about those efforts with federal, state, and industry stakeholders, as needed. We have previously found that it is important for federal agencies engaged in collaborative efforts to create the means to monitor and evaluate their efforts. Furthermore, we have concluded that developing and maintaining a record of federal efforts with similar goals can improve visibility over the full range of those efforts and reduce the potential for duplication. Participating in formal joint efforts. Some agency officials reported that their grid resiliency efforts were joint efforts with other federal agencies or industry partners. For example, DHS officials reported that both the Resilient Electric Grid Program and the Recovery Transformer Program were jointly funded by DHS and industry under formal agreements. Similarly, DOE officials reported that the Cybersecurity Risk Information Sharing Program was a formal joint effort of DOE, the federal intelligence community, and NERC. We have previously found that by leveraging partner resources, agencies can obtain additional benefits that would not be available if they worked separately. Soliciting input from stakeholders. Some agency officials reported formally soliciting input on their grid resiliency efforts from federal, state, and industry stakeholders. For example, FERC officials reported that they formally seek comments on proposed reliability standards and routinely receive comments from federal, state, and industry stakeholders. FERC officials said that the agency considers these comments when determining whether to approve a reliability standard and, as a result of these comments, in some cases directs NERC to make changes in proposed standards. Similarly, DOE officials responsible for the Strategic Transformer Reserve effort reported seeking input from relevant federal agencies—including DHS, the Department of Defense (DOD), and FERC—states, industry, and others as they developed their analysis. Sponsoring and participating in conferences, webinars, and workshops. Agency officials reported sponsoring and participating in conferences, webinars, and workshops that included discussions about grid resiliency priorities and how to address those priorities among federal, state, and industry stakeholders. For example, officials who implement DOE’s Electric Distribution Grid Resilience Research and Development Program reported that they held a workshop with stakeholders to define in greater detail research and development needs related to the distribution grid’s resilience. We have previously found that collaboration can help agencies define and articulate the common federal outcome. Coordinating directly through agency staff. Agency officials also reported that agency staff responsible for grid resiliency efforts pursued a number of informal activities to directly coordinate these efforts with related federal and industry efforts; these activities included periodic meetings, telephone calls, and e-mails to coordinate and share information. We have previously reported that frequent communication among collaborating agencies is a means to facilitate working across agency boundaries. We provided a draft copy of this report to DOD, DOE, DHS, and FERC for review and comment. DOE, DHS, and FERC provided technical comments, which we incorporated as appropriate. DOD indicated it had no comments on the report. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees; the Secretaries of Defense, Energy, and Homeland Security; the Chairman of FERC; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-3841 or ruscof@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs are on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. We identified 27 efforts across three agencies—the Department of Energy (DOE), the Department of Homeland Security (DHS), and the Federal Energy Regulatory Commission (FERC)—that aimed to enhance the resilience of the electricity grid. Tables 6, 7, and 8 provide descriptions of the efforts at each agency as agency officials reported in their responses to our questionnaire and as we identified in agency documents. Other key contributors to this report were Jon Ludwigson, Assistant Director; Stephanie Gaines; and David Marroni. Important contributions were also made by Ben Atwater, Antoinette Capaccio, Nancy Crothers, Laura Durland, Philip Farah, Cindy Gilbert, Brian Lepore, Dan Royer, Stephen Sanford, Marylynn Sergent, Maria Stattel, Barbara Timmerman, and Greg Wilshusen.

Summary: In light of increasing threats to the nation's electricity grid, national policies have stressed the importance of enhancing the grid's resilience—its ability to adapt to changing conditions; withstand potentially disruptive events, such as the loss of power lines; and, if disrupted, to rapidly recover. Most of the electricity grid is owned and operated by private industry, but the federal government has a significant role in promoting the grid's resilience. DOE is the lead agency for federal grid resiliency efforts and is responsible for coordinating with DHS and other relevant federal agencies on these efforts. GAO was asked to review federal efforts to enhance the resilience of the electricity grid. This report (1) identifies grid resiliency efforts implemented by federal agencies since 2013 and the results of these efforts and (2) examines the extent to which these efforts were fragmented, overlapping, or duplicative, and the extent to which agencies had coordinated the efforts. GAO reviewed relevant laws and guidance; identified a list of federal grid resiliency efforts; sent a questionnaire to officials at DOE, DHS, and FERC to collect information on each effort and its results; analyzed questionnaire responses and agency documents to assess whether federal efforts were fragmented, overlapping, or duplicative and how agencies coordinated those efforts; and interviewed agency officials and industry group representatives. This report contains no recommendations. DOE, DHS, and FERC provided technical comments, which GAO incorporated as appropriate. The Department of Energy (DOE), the Department of Homeland Security (DHS), and the Federal Energy Regulatory Commission (FERC) reported implementing 27 grid resiliency efforts since 2013 and identified a variety of results from these efforts. The efforts addressed a range of threats and hazards—including cyberattacks, physical attacks, and natural disasters—and supported different types of activities (see table). These efforts also addressed each of the three federal priorities for enhancing the security and resilience of the electricity grid: (1) developing and deploying tools and technologies to enhance awareness of potential disruptions, (2) planning and exercising coordinated responses to disruptive events, and (3) ensuring actionable intelligence on threats is communicated between government and industry in a time-sensitive manner. Agency officials reported a variety of results from these efforts, including the development of new technologies—such as a rapidly-deployable large, high-power transformer—and improved coordination and information sharing between the federal government and industry related to potential cyberattacks. Federal grid resiliency efforts were fragmented across DOE, DHS, and FERC and overlapped to some degree but were not duplicative. GAO found that the 27 efforts were fragmented in that they were implemented by three agencies and addressed the same broad area of national need: enhancing the resilience of the electricity grid. However, DOE, DHS, and FERC generally tailored their efforts to contribute to their specific missions. For example, DOE's 11 efforts related to its strategic goal to support a more secure and resilient U.S. energy infrastructure. GAO also found that the federal efforts overlapped to some degree but were not duplicative because none had the same goals or engaged in the same activities. For example, three DOE and DHS efforts addressed resiliency issues related to large, high-power transformers, but the goals were distinct—one effort focused on developing a rapidly deployable transformer to use in the event of multiple large, high-power transformer failures; another focused on developing next-generation transformer components with more resilient features; and a third focused on developing a plan for a national transformer reserve. Moreover, officials from all three agencies reported taking actions to coordinate federal grid resiliency efforts, such as serving on formal coordinating bodies that bring together federal, state, and industry stakeholders to discuss resiliency issues on a regular basis, and contributing to the development of federal plans that address grid resiliency gaps and priorities. GAO found that these actions were consistent with key practices for enhancing and sustaining federal agency coordination.