The North American  Electric Reliability Corporation (NERC) is the federally designated U.S.  Electric Reliability Organization, and is overseen by FERC. In addition, the Energy Independence and Security Act of 2007established federal policy to support the modernization of the electricity  grid and required actions by a number of federal agencies, including the  National Institute of Standards and Technology (NIST), FERC, and the  Department of Energy. The Electricity Grid Is Potentially Vulnerable to an Evolving Array of Cyber-Based Threats

Threats to systems supporting critical infrastructure—which includes the  electricity industry and its transmission and distribution systems—are  evolving and growing. In February 2011, the Director of National  Intelligence testified that, in the past year, there had been a dramatic  increase in malicious cyber activity targeting U.S. computers and  networks, including a more than tripling of the volume of malicious  software since 2009. Different types of cyber threats from numerous  sources may adversely affect computers, software, networks,  organizations, entire industries, or the Internet. Intentional threats include both targeted and untargeted attacks  from a variety of sources, including criminal groups, hackers, disgruntled  employees, foreign nations engaged in espionage and information  warfare, and terrorists. The potential impact of these threats is amplified by the connectivity  between information systems, the Internet, and other infrastructures,  creating opportunities for attackers to disrupt critical services, including  electrical power. In addition, the increased reliance on IT systems and  networks also exposes the electric grid to potential and known  cybersecurity vulnerabilities. We and others have also reported that smart grid and related systems  have known cyber vulnerabilities. For example,  the Department of Homeland Security’s Industrial Control Systems Cyber  Emergency Response Team recently noted that the number of reported  cyber incidents affecting control systems of companies in the electricity  sector increased from 3 in 2009 to 25 in 2011. Actions Have Been Taken to Secure the Electricity Grid, but Challenges Remain

Multiple entities have taken steps to help secure the electricity grid,  including NERC, NIST, FERC, and the Departments of Homeland  Security and Energy. For example, it reviewed and approved NERC’s eight critical  infrastructure protection standards in 2008. Challenges to Securing Electricity Systems and Networks

In our January 2011 report, we identified a number of key challenges that  industry and government stakeholders faced in ensuring the cybersecurity  of the systems and networks that support our nation’s electricity grid.These included the following:
There was a lack of a coordinated approach to monitor whether  industry follows voluntary standards. Aspects of the current regulatory environment made it difficult to  ensure the cybersecurity of smart grid systems. Utilities were focusing on regulatory compliance instead of  comprehensive security. There was a lack of security features built into smart grid systems. The electricity industry did not have an effective mechanism for  sharing information on cybersecurity and other issues. The electricity industry did not have metrics for evaluating  cybersecurity. To improve coordination among regulators and help  Congress better assess the effectiveness of the voluntary smart grid  standards process, we recommended that the Chairman of FERC  develop an approach to coordinate with state regulators and with groups  that represent utilities subject to less FERC and state regulation to (1)  periodically evaluate the extent to which utilities and manufacturers are  following voluntary interoperability and cybersecurity standards and (2)  develop strategies for addressing any gaps in compliance with standards  that are identified as a result of this evaluation. Although FERC agreed with these recommendations, they have not yet  been implemented. We will continue to monitor the status of its efforts to address  these recommendations. Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but  More Can Be Done to Promote Its Use. Electricity Grid Modernization: Progress Being Made on Cybersecurity  Guidelines, but Key Challenges Remain to Be Addressed.
Why GAO Did This Study

The electric power industry is increasingly incorporating information technology (IT) systems and networks into its existing infrastructure (e.g., electricity networks, including power lines and customer meters). This use of IT can provide many benefits, such as greater efficiency and lower costs to consumers. However, this increased reliance on IT systems and networks also exposes the grid to cybersecurity vulnerabilities, which can be exploited by attackers. Moreover, GAO has identified protecting systems supporting our nations critical infrastructure (which includes the electricity grid) as a governmentwide high-risk area.
GAO was asked to testify on the status of actions to protect the electricity grid from cyber attacks. Accordingly, this statement discusses (1) cyber threats facing cyber-reliant critical infrastructures, which include the electricity grid, and (2) actions taken and challenges remaining to secure the grid against cyber attacks. In preparing this statement, GAO relied on previously published work in this area and reviewed reports from other federal agencies, media reports, and other publicly available sources.

What GAO Found

The threats to systems supporting critical infrastructures are evolving and growing. In testimony, the Director of National Intelligence noted a dramatic increase in cyber activity targeting U.S. computers and systems, including a more than tripling of the volume of malicious software. Varying types of threats from numerous sources can adversely affect computers, software, networks, organizations, entire industries, and the Internet itself. These include both unintentional and intentional threats, and may come in the form of targeted or untargeted attacks from criminal groups, hackers, disgruntled employees, nations, or terrorists. The interconnectivity between information systems, the Internet, and other infrastructures can amplify the impact of these threats, potentially affecting the operations of critical infrastructures, the security of sensitive information, and the flow of commerce. Moreover, the electricity grids reliance on IT systems and networks exposes it to potential and known cybersecurity vulnerabilities, which could be exploited by attackers. The potential impact of such attacks has been illustrated by a number of recently reported incidents and can include fraudulent activities, damage to electricity control systems, power outages, and failures in safety equipment.
To address such concerns, multiple entities have taken steps to help secure the electricity grid, including the North American Electric Reliability Corporation, the National Institute of Standards and Technology (NIST), the Federal Energy Regulatory Commission, and the Departments of Homeland Security and Energy. These include, in particular, establishing mandatory and voluntary cybersecurity standards and guidance for use by entities in the electricity industry. For example, the North American Electric Reliability Corporation and the Federal Energy Regulatory Commission, which have responsibility for regulation and oversight of part of the industry, have developed and approved mandatory cybersecurity standards and additional guidance. In addition, NIST has identified cybersecurity standards that support smart grid interoperability and has issued a cybersecurity guideline. The Departments of Homeland Security and Energy have also played roles in disseminating guidance on security practices and providing other assistance.
As GAO previously reported, there were a number of ongoing challenges to securing electricity systems and networks. These include:
A lack of a coordinated approach to monitor industry compliance with voluntary standards.
Aspects of the current regulatory environment made it difficult to ensure the cybersecurity of smart grid systems.
A focus by utilities on regulatory compliance instead of comprehensive security.
A lack of security features consistently built into smart grid systems.
The electricity industry did not have an effective mechanism for sharing information on cybersecurity and other issues.
The electricity industry did not have metrics for evaluating cybersecurity.

What GAO Recommends

In a prior report, GAO has made recommendations related to electricity grid modernization efforts, including developing an approach to monitor compliance with voluntary standards. These recommendations have not yet been implemented.