In the United States, it is generally taken for granted that the electricity needed to power the U.S. economy is available on demand and will always be available to power our machines and devices. However, in recent years, new threats have materialized as new vulnerabilities have come to light, and a number of major concerns have emerged about the resilience and security of the nation's electric power system. In particular, the cybersecurity of the electricity grid has been a focus of recent efforts to protect the integrity of the electric power system. Power flows on the nation's electricity grid are remotely controlled by a combination of older, legacy systems and newer control technologies. Many of these legacy technologies are analog in design and were not originally connected to the Internet (although many are equipped with radio or other communications capabilities). But as the grid is modernized, the new "intelligent" technologies replacing them use advanced two-way communications and other digital advantages that likely will be optimized by Internet connectivity. While these advances will improve the efficiency and performance of the grid, they also potentially increase the vulnerability of the grid to cyberattacks. Cybersecurity is today, and will continue to be, a major issue and focus area for the electric power sector. The energy sector (i.e., electricity, natural gas, and petroleum) is one of 16 critical infrastructure sectors designated by the Department of Homeland Security. Incidents of reported cyber intrusions and attacks aimed at undermining the U.S. grid appear to be increasing. While parts of the electric power subsector have mandatory and enforceable cyber and physical security standards, some have argued that minimum, consensus-based standards are not enough to secure the system. Further, the electric grid is not isolated from attacks on other critical infrastructure sectors on which it depends (i.e., the natural gas subsector, water, and transportation), and mandatory and enforceable cybersecurity standards apply to only a few of the 16 critical infrastructure sectors. This report will discuss the current state of electric sector cybersecurity, surveying existing regulations and proposed efforts to improve cybersecurity in the wake of recently reported threats and potential vulnerabilities. The report will focus on the bulk power system under authority of the Federal Energy Regulatory Commission (FERC), which Congress directed to establish mandatory and enforceable reliability standards. Many cybersecurity standards and actions are in response to cyber events. As such, basic compliance with standards by electric utility companies may not be enough to achieve effective cybersecurity protections. Areas for possible further congressional consideration or action will be highlighted in this report. The electric utility business encompasses the process of generating electricity and sending power to the ultimate user. The electrical grid is the name given to the machinery and power lines that enable power to be sent from the power plant to the ultimate user of electricity. As seen in Figure 1 , this generally requires an infrastructure made up of generating stations (where the power is produced), step-up transformers and transmission lines (whereby transformers increase the voltage so that the electricity can be sent over very long distances), and step-down transformers and distribution lines (whereby the voltage can be lowered allowing the electricity to be sent to businesses and homes to power machinery and devices). Depending on the regulatory regime in place, these system elements may be controlled by companies under state jurisdiction or entities under federal jurisdiction (such as regional transmission organizations or federal power marketing administrations). Controlling and monitoring the various parts of the grid are industrial control (IC) systems, some of which are connected to the Internet. Other IC systems are not Internet-connected, and still rely on local area networks (LANs) or similar systems for control and reporting. The following paragraphs discuss these IC systems and potential vulnerabilities to intrusion and cyberattack. The grid relies on a number of electronic devices, switches and circuit breakers to regulate and report on the flow of electricity at different parts of the system. Together, these pieces of mechanical and automated equipment constitute the grid's IC systems, managing power plant controls, transformer yard and power bus functions, transmission system, and distribution substations. The IC system essentially operates in a "control loop" in which sensors continually check key components, with variable responses against control variables in order to ensure that the system is functioning as designed. If responses show a disturbance resulting in operation of the system outside normal operating parameters, then the system adjusts actuators to bring the system back to process norms, or sends alerts to human-machine interfaces (HMIs) to reconfigure the system or adjust operations in the control algorithms. Diagnostics and maintenance utilities are built into the system to "prevent, identify and recover from abnormal operation or failures." One IC system used to control remote operations of the power grid is the Supervisory Control and Data Acquisition (SCADA) system. SCADA systems are highly distributed systems used to control geographically dispersed assets, often scattered over thousands of square kilometers, where centralized data acquisition and control are critical to system operation ... A SCADA control center performs centralized monitoring and control for field sites over long-distance communications networks, including monitoring alarms and processing status data. Based on information received from remote stations, automated or operator-driven supervisory commands can be pushed to remote station control devices, which are often referred to as field devices. Field devices control local operations such as opening and closing valves and breakers, collecting data from sensor systems, and monitoring the local environment for alarm conditions. SCADA systems have been in use at least since the 1970s, and were adopted at a time when the focus of system design was on function and reliability. An example of a basic SCADA network is shown in Figure 2 . Historically, these systems consisted of remote terminal units which were often connected to a mainframe computer via telephone lines or radio connections. They were not typically connected to centralized networks. Utilities typically operated separate control systems created just to operate power plants and related infrastructure. Over time, modification of SCADA systems has resulted in connection of many of these older, legacy systems to the Internet. However, many of these legacy SCADA systems were not designed with security features, allowing other potential pathways for a cyberattack. As a result, these systems may be vulnerable to intrusion through data reporting pathways, or attacks (for example) using a thumb drive to download malware like the Stuxnet worm. However, some of these earlier designs and configurations may not be as vulnerable to an Internet-launched cyberattack. The security issue, for old and new systems, then becomes both how they are connected to the utility's other systems, and what levels of security exist to detect and deter potential intrusions. Distributed control systems (DCSs) are used in power plant settings where process control requires feedback to maintain process conditions automatically about a desired set point. DCSs generally use several Programmable Logic Controllers (PLCs) to establish process tolerances. PLCs are typically microprocessor- or computer-based devices that are used extensively to control industrial equipment or processes. Communications over DCS or PLC networks need to be more reliable and function at higher speeds "compared to the long-distance communication systems used by SCADA systems" because of the process control functions of DCSs. The electric grid of the United States has been called an "engineering marvel," but it is a system which in many places is becoming an "aging marvel." America relies on an aging electrical grid and pipeline distribution systems, some of which originated in the 1880s. Investment in power transmission has increased since 2005, but ongoing permitting issues, weather events, and limited maintenance have contributed to an increasing number of failures and power interruptions. While demand for electricity has remained level, the availability of energy in the form of electricity, natural gas, and oil will become a greater challenge after 2020 as the population increases. Although about 17,000 miles of additional high-voltage transmission lines and significant oil and gas pipelines are planned over the next five years, permitting and siting issues threaten their completion. In recognition of the need to deploy new technologies, Congress indicated its support for grid modernization in the Energy Independence and Security Act of 2007 (EISA) ( P.L. 110-140 ). Specifically, Section 1301 of the act states: It is the policy of the United States to support the modernization of the Nation's electricity transmission and distribution system to maintain a reliable and secure electricity infrastructure that can meet future demand growth ... which together characterize a Smart Grid... The "Smart Grid" refers to the evolving electric power network as new information technology (IT) systems and communications capabilities are incorporated. EISA Section 1301 further states that aspects characterizing a Smart Grid include Increased use of digital information and controls technology to improve reliability, security, and efficiency of the electric grid. Dynamic optimization of grid operations and resources, with full cybersecurity. Deployment of ''smart'' technologies (real-time, automated, interactive technologies that optimize the physical operation of appliances and consumer devices) for metering, communications concerning grid operations and status, and distribution automation. Figure 3 provides a conceptual illustration of what a Smart Grid network may look like. The many disparate elements and user systems also emphasize the need for secure communications pathways required for Smart Grid operation. Smart Grid networks are also potentially better able to integrate the intermittent energy from renewable electricity technologies (i.e., renewable electricity systems such as distributed solar photovoltaic [PV] and wind), distributed generation, demand response, and consumer energy efficiency programs. While the potential of the Smart Grid to revolutionize the ways power is generated and used is great, so too are the potential cybersecurity risks. Additional Smart Grid components may add to the ability to control power flows and enhance the efficiency of grid operations, they also potentially increase the susceptibility of the grid to cyberattack. Smart Grid components are built around microprocessor and other hardware devices whose basic functions are controlled by software programming. These devices and functions may be subject to manipulation over a network.