Key Federal Agencies Have Taken Various Actions to Address Electromagnetic Risks to the Grid; Some Actions Align with the 2008 EMP Commission Recommendations

		Federal Agencies Have Taken Actions to Address Electromagnetic Risks to the Grid

DHS, DOE and FERC have taken various actions to address  electromagnetic risks to the electric grid, which generally fall under four  categories: (1) standards, guidelines, tools and demonstration projects;  (2) research reports; (3) strategy development and planning; and (4)  training and outreach. Some Actions Taken by DHS and DOE Align with EMP Commission Recommendations

The actions recommended by the EMP Commission generally align with  existing authorities and responsibilities of DHS and DOE relating to the  protection of critical infrastructure, such as identifying key assets and  analyzing risks, and as discussed above, DHS and DOE have taken  actions to address some risks to the electric grid from electromagnetic  events. Although DHS and DOE did not report that any of their actions  were taken in response to the commission report, actions taken by both  agencies have aligned with some of the recommendations. Specifically,  the EMP Commission made seven recommendations related to the  electric grid, most of which were directed to DHS and DOE. In addition, a DHS entity developed EMP  protection guidelines to help federal agencies and industry identify  options for safeguarding critical communication equipment and control  elements, such as Supervisory Control and Data Acquisition (SCADA)  systems, from an EMP attack. Additional Opportunities Exist for Federal Agencies to Identify Responsibilities, Assess Risks, and Strengthen Collaboration with Partners to Address Electromagnetic Risks

		DHS Has Not Identified Roles and Responsibilities for Addressing Electromagnetic Risks

DHS has not clearly identified internal roles and responsibilities for  addressing electromagnetic risks to the electric grid or communicated  these to external federal and industry partners. Designating internal roles and  responsibilities within DHS regarding electromagnetic risks and  communicating these to federal and industry partners could provide  additional awareness of related activities and help ensure more effective  and coordinated engagement with other federal agencies and industry  stakeholders. DHS Has Not Fully Leveraged Existing Opportunities to Collect and Analyze Information on Electromagnetic Risks

Although DHS components have independently conducted some efforts  to assess electromagnetic risks as identified above, the department has  not fully leveraged available risk information or conducted a  comprehensive analysis of these risks. Within the DHS Office of Policy,  there is recognition that “space weather” and “power grid failure” are  significant risk events, which DHS officials have determined pose great  risk to the security of the nation. For example, further  collection of information on sector interdependencies could help DHS to  assess the potential economic consequences associated with long-term  power outages. Federal Agencies Have Not Fully Coordinated Efforts to Implement Key EMP Risk Management Activities

Key federal agencies, including DHS and DOE, as well as industry  partners have not established a fully coordinated approach to identifying  and implementing risk management activities to address EMP risks. According to the NIPP Risk Management Framework, such activities  include identifying and prioritizing research and development efforts, and  evaluating potential mitigation options, including the cost-effectiveness of  specific protective equipment. EMP Research and Development

There are several areas of EMP research highlighted in previous studies  where coordinated federal involvement could help address identified gaps  and further inform risk assessment efforts. While DHS recognizes that both space weather and power grid failure are  risk events that can affect the nation’s security, there are additional  opportunities for DHS to collect key risk inputs, such as further  collaboration with DOD to obtain applicable EMP threat, vulnerability, and  consequence information. To more fully leverage critical infrastructure expertise and address  responsibilities to identify critical electrical infrastructure assets as called  for in the NIPP, we recommend that the Secretary of Homeland Security  and the Secretary of Energy direct responsible officials to review FERC’s  electrical infrastructure analysis and collaborate to determine whether  further assessment is needed to adequately identify critical electric  infrastructure assets, potentially to include additional elements of  criticality that might be considered. To facilitate federal and industry efforts to coordinate risk-management  activities to address an EMP attack, we recommend that the Secretary of  Homeland Security and the Secretary of Energy direct responsible  officials to engage with federal partners and industry stakeholders to  identify and implement key EMP research and development priorities,  including opportunities for further testing and evaluation of potential EMP  protection and mitigation options. DOD did not provide comments on this  report. Appendix II: Summary of Key Federal Agency Actions Addressing Electromagnetic Risks to the Electric Grid

	Standards, Guidelines, Tools, and Demonstration Projects

Since 2008, the Department of Homeland Security (DHS), the  Department of Energy (DOE), and the Federal Energy Regulatory  Commission (FERC) have taken an array of actions aimed at addressing  electromagnetic risks to the electric grid.
Why GAO Did This Study

Electromagnetic risks caused by a man-made EMP or a naturally occurring solar weather event could have a significant impact on the nation's electric grid as well as other infrastructure sectors that depend on electricity, such as communications. These risks could lead to power outages over broad geographic areas for extended durations.
GAO was asked to review federal efforts to address electromagnetic risks to the electric grid. This report examines (1) the extent to which key federal agencies have taken action to address electromagnetic risks and how these actions align with the 2008 EMP Commission report recommendations, and (2) what additional opportunities exist to enhance federal efforts to address electromagnetic risks to the electric grid. GAO reviewed the EMP Commission report and federal program documents, and interviewed DHS, DOE, and FERC officials and relevant stakeholders who provided insights on key actions taken.

What GAO Found

Key federal agencies have taken various actions to address electromagnetic risks to the electric grid, and some actions align with the recommendations made in 2008 by the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack (EMP Commission). Since 2008, the Department of Homeland Security (DHS), the Department of Energy (DOE), and the Federal Energy Regulatory Commission (FERC) have taken actions such as establishing industry standards and federal guidelines, and completing EMP-related research reports. GAO found that their actions aligned with some of the EMP Commission recommendations related to the electric grid. For example, DHS developed EMP protection guidelines to help federal agencies and industry identify options for safeguarding critical communication equipment and control systems from an EMP attack. Further, agency actions and EMP Commission recommendations generally align with DHS and DOE critical infrastructure responsibilities, such as assessing risks and identifying key assets.
Additional opportunities exist to enhance federal efforts to address electromagnetic risks to the electric grid. Specifically, DHS has not identified internal roles and responsibilities for addressing electromagnetic risks, which has led to limited awareness of related activities within the department and reduced opportunity for coordination with external partners. Doing so could provide additional awareness of related activities and help ensure more effective collaboration with other federal agencies and industry stakeholders. Moreover, although DHS components have independently conducted some efforts to assess electromagnetic risks, DHS has not fully leveraged opportunities to collect key risk inputs—namely threat, vulnerability, and consequence information—to inform comprehensive risk assessments of electromagnetic events. Within DHS, there is recognition that space weather and power grid failure are significant risk events, which DHS officials have determined pose great risk to the security of the nation. Better collection of risk inputs, including additional leveraging of information available from stakeholders, could help to further inform DHS assessment of these risks. DHS and DOE also did not report taking any actions to identify critical electrical infrastructure assets, as called for in the National Infrastructure Protection Plan. Although FERC conducted a related effort in 2013, DHS and DOE were not involved and have unique knowledge and expertise that could be utilized to better ensure that key assets are adequately identified and all applicable elements of criticality are considered. Finally, DHS and DOE, in conjunction with industry, have not established a coordinated approach to identifying and implementing key risk management activities to address EMP risks. Such activities include identifying and prioritizing key research and development efforts, and evaluating potential mitigation options, including the cost-effectiveness of specific protective equipment. Enhanced coordination to determine key research priorities could help address some identified research gaps and may help alleviate concerns voiced by industry regarding the costs and potential adverse consequences on grid reliability that may be caused by implementation of such equipment.

What GAO Recommends

GAO recommends that DHS identify internal roles to address electromagnetic risks, and collect additional risk inputs to further inform assessment efforts; that DHS and DOE collaborate to ensure critical electrical infrastructure assets are identified; and engage with industry stakeholders to identify and prioritize risk-management activities, such as research and development efforts, to address EMP risks to the grid. DHS and DOE concurred with our recommendations and identified planned actions to address the recommendations.