Within DHS, the National Protection and Programs Directorate (NPPD) is  responsible for working with public and industry infrastructure partners  and leads the coordinated national effort to mitigate risk to the nation’s  infrastructure through the development and implementation of the  infrastructure protection program. Preliminary Findings Indicate that DHS Actions to Address Electromagnetic Threats were Conducted Independently of the EMP Commission Recommendations

As of July 2015, DHS reported taking several actions that could help  address electromagnetic threats to the electric grid, but these efforts were  conducted independently of the 2008 EMP Commission  recommendations. Our preliminary analysis of DHS’s actions indicates  that they generally fell under four categories of effort: (1) developing  reports, (2) identifying mitigation efforts, (3) strategy development and  planning, and (4) conducting training exercises. Impacts of Severe Space Weather on the Electric Grid. This  2011 report assessed the impacts of space weather on the electric  grid, seeking to understand how previous solar storms have affected  some power grids, and what cost-effective mitigation efforts are  available to protect the electric grid, among other topics. RecX. In 2012, S&T partnered with industry to develop a prototype  transformer that could significantly reduce the time to transport, install,  and energize a transformer to aid recovery from power outages  associated with transformer failures from several months to less than  one week. For  example, DHS’s efforts to clearly identify agency roles and responsibilities  to date have been limited. We recognize that DHS does not have a statutory obligation to address  the specific recommendations of the EMP Commission and many of  these recommendations were also directed to DOE. Nevertheless, we  believe that implementation of them could help mitigate electromagnetic  impacts to the electric grid, such as helping to assure the protection of  high-value transmission assets. To date, our preliminary analysis  suggests that DHS has not fully addressed some key responsibilities  related to effectively preparing for and responding to electromagnetic  threats to the electric grid, in conjunction with DOE as the sector-specific  agency for the energy sector, which is responsible for critical electrical  infrastructure. We will continue to assess  the extent to which DHS’s efforts align with the EMP Commission  recommendations as well as the extent to which DHS’s current and  planned actions align with its own risk management framework, as  identified in the NIPP, as we complete our work. We will report our final  results later this year. Preliminary Analysis Indicates DHS Has Not Fully Coordinated with Stakeholders to Address some Risks to the Electric Grid

Our preliminary analysis indicates that since the EMP Commission issued  its recommendations in 2008, DHS has coordinated with federal and  industry stakeholders to address some, but not all risks to the electric  grid. Specifically, DHS has not fully coordinated with stakeholders in  certain areas such as identifying critical assets or collecting information  necessary to assess electromagnetic risks. Our preliminary work has  identified eight projects in which DHS coordinated with other federal  agencies or industry to help protect the electric grid. These projects  encompass a range of different protective efforts, including the  development of plans to address long term power outages, participation  in exercises, and research and development activities which address the  resiliency of electrical infrastructure (See Appendix II for a list of projects  we identified.) DHS has not identified any efforts to  specifically provide EMP-related threat information to industry  stakeholders. and other federal agencies regarding the identification of key  infrastructure assets. Collecting risk information. Funding could be directed through a number of avenues, including the Department of  Homeland Security (DHS) and National Science Foundation. 2. This is a work of the U.S. government and is not subject to copyright protection in the  United States.
Why GAO Did This Study

The threat posed by an electromagnetic pulse (EMP) or solar weather event could have a debilitating impact on the nation's critical electrical infrastructure, as well as other key assets that depend on electricity. These events could lead to power outages over broad geographic areas for extended durations. Addressing these risks requires collaboration among multiple government and industry stakeholders; with DHS in the lead role for overall infrastructure protection efforts, working in coordination with DOE.
The EMP Commission, established by statute and comprised of subject matter experts, issued recommendations in 2008 addressing the preparation, protection and recovery of critical infrastructures against a possible EMP attack. The majority of these recommendations were made to DHS and DOE.
This testimony is based on preliminary observations from GAO's ongoing review of DHS's efforts to address electromagnetic threats. Specifically, this testimony addresses the extent to which DHS has: (1) taken action to address recommendations from the 2008 EMP Commission Report and (2) coordinated with other principal federal agencies, such as DOE and industry stakeholders to mitigate risks to the electric grid from electromagnetic threats.
GAO reviewed EMP Commission recommendations and DHS program documents, and interviewed relevant stakeholders who provided insights on key issues and coordination activities with the federal government to address these threats.

What GAO Found

As of July 2015, the Department of Homeland Security (DHS) reported taking several actions that could help address electromagnetic threats to the electric grid. GAO's preliminary analysis of DHS's actions indicates that they generally fell under four categories: (1) developing reports, (2) identifying mitigation efforts, (3) strategy development and planning, and (4) conducting exercises. For example:
Impacts of Severe Space Weather on the Electric Grid . This 2011 report evaluated how previous solar storms have affected electric grids, and identified potential cost-effective mitigation equipment available to protect these grids, among other topics.
RecX . In 2012, DHS Science &Technology partnered with industry to develop a prototype transformer that could significantly reduce the time to transport, install, and energize a transformer to aid recovery from power outages associated with transformer failures from several months to less than one week.
DHS reported its actions were not taken in response to the 2008 recommendations of the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack (EMP Commission). GAO also recognizes that DHS does not have a statutory obligation to specifically address the recommendations, but implementation of them could help mitigate electromagnetic impacts to the electric grid, such as helping to assure the protection of high-value transmission assets. Moreover, GAO's preliminary work suggests that DHS, in conjunction with the Department of Energy (DOE), has not fully addressed a key critical infrastructure protection responsibility—identification of clear internal agency roles and responsibilities related to addressing electromagnetic threats. For example, although DHS recognized one component as the lead for assessing solar weather risks, the component has not yet identified any specific roles related to collecting or analyzing risk information.
DHS has also coordinated with federal and industry stakeholders to address some, but not all risks to the electrical grid since the EMP Commission issued its recommendations. GAO preliminarily identified eight projects in which DHS coordinated with stakeholders to help protect the grid including developing plans to address long term power outages, participation in exercises, and research and development activities. Although these are positive steps, GAO's preliminary work indicates that DHS has not effectively coordinated with stakeholders to identify critical assets or collect necessary risk information, among other responsibilities. GAO will continue to assess the issues in this statement as it completes its work and will issue a report with the final results later this year.