Electricity generation is vital to the commerce and daily functioning of the United States. The electric power grid in the United States comprises all of the power plants generating electricity, together with the transmission and distribution lines and systems which bring power to end-use customers. The grid also connects the many publicly and privately owned electric utility and other wholesale power companies in different states and regions of the United States. The U.S. electric grid has historically operated with a high level of reliability; however, the various parts of the electric power system are all vulnerable to failure due to natural, operational, or manmade events. While natural and operational failures can be mitigated somewhat by planning and prudent investments, cybersecurity is a growing concern for both electric utilities and other critical infrastructure entities. Adoption of digital technologies has improved the efficiency and speed of operations and processes, and allowed for an almost instantaneous exchange of information between connected devices. Often, these digital devices are also connected to the internet to increase the ability to share information with a multitude of users and devices. While the benefits of internet-connected digital technologies are many, so too are the risks of a cybersecurity breach from exposure to a globally internet-connected environment. The electric grid relies on a number of electronic devices, switches, and circuit breakers to regulate and report on the flow of electricity at different parts of the system. Together, these pieces of mechanical and automated equipment constitute the grid's industrial control system (ICS) network, managing power plant controls, transformer yard and power bus functions, transmission, and distribution substations. The grid's ICS networks essentially operate in a "control loop" in which sensors continually check key components, with variable responses against control variables to ensure that the system is functioning as designed. ICS networks control industrial processes in a number of energy and manufacturing operations. One particular type of ICS network common in the electric power industry is a supervisory control and data acquisition (SCADA) system which gathers information from remote stations across a utility system to control geographically dispersed assets. In 2015, a cyber attack on distribution utility substations in Ukraine shut off power to over 225,000 utility customers for several hours, and was the first time that a cyber attack was publicly acknowledged to have caused a grid power outage. A second cyber attack in Ukraine in 2016 was reported on an electricity control center in the city of Kiev, shutting down substations which controlled 200 megawatts of capacity. The potential for a similar attack on the U.S. grid was seen as a possibility. Some recent reports about foreign hackers targeting the U.S. electric power system and other critical infrastructure are summarized below. While these intrusions have not been reported as having resulted in significant disruptions, concerns have increased over the potential for these intrusions to result in damaging cyber attacks in the future. The intrusions, which have been directed at the ICS networks of energy, manufacturing, communications and nuclear entities, include the following: Cyber intrusions on the SCADA systems of the Bowman Dam in Rye, New York resulted in federal indictments against a group of hackers linked to Iran's Islamic Revolutionary Guard Corps. Cyber intrusions in October 2017 were reported to have targeted electric company ICS networks in a reconnaissance and information gathering campaign attributed to North Korea. In March 2018, the United States Computer Emergency Readiness Team (US-CERT) issued an alert concerning cyber intrusions at critical energy and manufacturing infrastructure companies. The Department of Homeland Security and the Federal Bureau of Investigation concluded that Russian government hackers conducted a multi-stage intrusion campaign to access files on ICS networks. The malware conducted network reconnaissance, collecting information on ICS and SCADA systems before being found. Further attacks on U.S. critical energy infrastructure are expected, as nation states view disruption of the U.S. economy as a potential target. This report discusses the current state of electric grid cybersecurity, and the interconnected dependency of critical infrastructure with regard to electric sector reliability. Current efforts to ensure the reliability of the grid are highlighted, and potential grid vulnerabilities are explored with a focus on the electric power sector's mutual dependency on other critical infrastructure. Technologies and actions to address perceived future threats are described, and possible risks to approaches moored in technology-based cybersecurity defense systems. Finally, since the possibility does exist for a major cyber and/or physical security attack to result in significant damage or impairment, the potential need to build resilience into the grid to enable a quicker recovery is discussed. Congress gave the Federal Energy Regulatory Commission (FERC) authority to oversee the reliability of the bulk-power system under the Energy Policy Act of 2005 ( P.L. 109-58 ; EPACT05). Reliability standards were added as section 215 of the Federal Power A ct (FPA) in an effort to help ensure the reliable operation of the bulk power system so that "instability, uncontrolled separation, or cascading failures" will not occur as a result of a sudden disturbance. Section 215 of the FPA also defines FERC's jurisdiction in terms of "users, owners and operators" of the bulk power system. FERC can approve or remand back reliability standards proposed by the Electric Reliability Organization (ERO) , which bulk-power system owners and operators must follow to help ensure the reliable operation of the grid. Currently, the North American Electric Reliability Corporation (NERC) serves as the ERO. NERC therefore proposes reliability standards for Critical Infrastructure Protection (CIP), which are updated considering the status of reliability and cybersecurity concerns for the grid. Reliability standards address programs ranging from vegetation clearances in electric transmission line rights-of-way to policies and procedures for critical infrastructure protection focused on the cyber- and physical security of power plants and supporting facilities. The standards are both mandatory and enforceable in that violators of reliability rules may be subject to a civil fine of up to $1 million per violation for each day that it continues. While the bulk electric power system has mandatory and enforceable standards for both cyber and physical security for critical infrastructure protection, these are developed on a consensus basis before being submitted to FERC, which determines whether to accept or remand the standard back to NERC for revision. Under the Federal Power Act, FERC's authority is largely limited to wholesale power sales and the transmission of electricity in interstate commerce, while states have authority over retail sales by electric distribution systems. FERC acknowledges that EPACT05 excluded local distribution systems from its reliability mandate under Section 215 of the Federal Power Act, as not being part of the bulk power system. That criterion excluded facilities in Alaska and Hawaii, and virtually the entire grid in cities with large distribution systems like New York City. In 2012, FERC approved NERC's criteria for the definition of the bulk electric system. These criteria and definitions apply to all NERC regions and are a bright-line threshold including all Transmission Elements operated at 100 kilovolts (kV) or higher, and real power and reactive power resources connected at 100 kV or higher. The increase in the number of cyber attacks aimed at U.S. critical energy infrastructure has led to heightened attention from the federal government. While a cyber attack on the U.S. grid similar to the cyber attacks in Ukraine was not expected to result in the same type of consequences (given the older electricity systems in place in Ukraine), the potential for financial market and economic disruption may be a legitimate concern. In 2017, President Trump issued Executive Order (E.O.) 13800 on "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure" because the risks of cyber threats to critical infrastructure are perceived as a national security imperative. E.O. 13800 called for an assessment of a prolonged electric power outage resulting from a cyber attack, and an evaluation of the "readiness and gaps in the United States' ability to manage and mitigate consequences of a cyber incident against the electric subsector." The cyber supply chain and public-private cybersecurity information sharing were listed among a number of major cybersecurity potential vulnerabilities. The Fixing America's Surface Transportation Act (FAST Act; P.L. 114-94 ) gives the Department of Energy (DOE) new authority to order electric utilities and NERC to implement emergency security actions. DOE is designated as the lead sector specific agency for the Energy sector, with responsibilities for both physical and cyber security. DOE has established a new Office of Cybersecurity, Energy Security, and Emergency Response (CESER) to "bolster DOE's efforts in cybersecurity and energy security." CESER is to focus on more coordinated preparedness and response to natural and man-made threats to energy infrastructure security. Following E.O. 13800, DOE established a five-year strategy for reducing cyber risks in the U.S. energy sector which is intended to serve as the basis for CESER activities. Under the strategy, CESER will carry out the DOE's Office of Electricity's cybersecurity responsibilities in supporting the physical and cybersecurity needs of energy owners and operators. Three main goals have been established under the strategy: Strengthen Energy Sector Cybersecurity Preparedness — focuses efforts through Cybersecurity Risk Information Sharing Program (CRISP) activities; Coordinate Cyber Incident Response and Recovery — establishes a coordinated national cyber incident response capability for the energy sector to augment cyber mutual assistance. DOE's national laboratories are to develop an integrated set of specialized cyber resources and capabilities that can be deployed to help energy companies identify and respond to a cyber attack; and Accelerate Game-Changing R esearch, D evelopment, and D emonstration (RD&D) of Resilient E nergy D elivery S ystems —keys on research, development and demonstration of new cybersecurity tools and technologies for automated defense of future energy delivery systems. While the bulk electric system has mandatory and enforceable rules for cyber and physical security, other energy sectors do not.