Modernization of the Electricity Infrastructure

As the electricity industry has matured and technology has advanced,  utilities have begun taking steps to update the electricity grid—the  transmission and distribution systems—by integrating new technologies  and additional IT systems and networks. The North American  Electric Reliability Corporation (NERC) is the federally designated U.S.  Electric Reliability Organization, and is overseen by FERC. In addition, the Energy Independence and Security Act of 2007  established federal policy to support the modernization of the electricity  grid and required actions by a number of federal agencies, including the  National Institute of Standards and Technology (NIST), FERC, and the  Department of Energy. For example, cybersecurity experts  have demonstrated that certain smart meters can be successfully  attacked, possibly resulting in disruption to the electricity grid. Actions Have Been Taken to Secure the Electricity Grid, but Continued Attention Is Required

As we have previously reported, multiple entities have taken steps to help  secure the electricity grid, including NERC, NIST, FERC, and the  Departments of Homeland Security and Energy. NERC also had enforced compliance with mandatory  cybersecurity standards through its Compliance Monitoring and  Enforcement Program, including assessing monetary penalties for  violations. In 2014, NIST issued updated guidelines, which  address the relationship of smart grid cybersecurity to cyber-physical  attacks and cybersecurity testing and certification. As the lead agency responsible for critical infrastructure protection efforts  in the energy sector, the Department of Energy, as we reported in  December 2011, was involved in efforts to assist the electricity subsector  in the development, assessment, and sharing of cybersecurity standards,  according to department officials. Monitoring implementation of cybersecurity standards. In our report, we noted that FERC  had not developed an approach coordinated with other regulators to  monitor, at a high level, the extent to which industry follows the  voluntary smart grid standards it adopts. We recommended that  FERC, in coordination with state regulators and groups that represent  utilities subject to less FERC and state regulation, periodically  evaluate the extent to which utilities and manufacturers are following  voluntary interoperability and cybersecurity standards and develop  strategies for addressing any gaps in compliance with standards that  are identified as a result of this evaluation. However, FERC has not  implemented this recommendation. Clarifying regulatory responsibilities. Experts also noted concern about the ability of regulatory  bodies to respond quickly to evolving cybersecurity threats. Clarifying  these responsibilities could help improve the effectiveness of efforts to  protect smart grid technology from cyber threats. Taking a comprehensive approach to cybersecurity. Ensuring that smart grid systems have built-in security features. By ensuring that smart grid  systems are securely designed, utilities could enhance their ability to  detect and analyze attacks, reducing the risk that attacks will succeed  and helping to prevent them from recurring. Effectively sharing cybersecurity information. However, the electric industry lacked an  effective mechanism to disclose information about cybersecurity  vulnerabilities, incidents, threats, lessons learned, and best practices. Establishing metrics for evaluating cybersecurity. The electric industry, however, was challenged by a  lack of cybersecurity metrics, making it difficult to determine the extent  to which investments in cybersecurity improve the security of smart  grid systems. In our January 2011 report, we recommended that FERC, working with  NERC as appropriate, assess whether any cybersecurity challenges  identified in our report should be addressed in commission cybersecurity  efforts. First, in 2011, it began  evaluating whether cybersecurity challenges, including those identified in  our report, should be addressed under the agency’s existing cyber  security authority and efforts. As a part of this effort, the commission  directed NERC to revise the electricity industry’s critical infrastructure  protection (CIP) standards with the aim of addressing, among other  things, cybersecurity challenges identified in our report. In November  2013, NERC issued updated CIP standards to address these and other  cybersecurity challenges. Moreover, without monitoring the implementation of  voluntary cybersecurity standards in the industry, FERC does not know  the extent to which such standards have been adopted or whether they  are effective. Given the increasing use of information and  communications technology in the electricity subsector and the evolving  nature of cyber threats, continued attention can help mitigate the risk  these threats pose to the electricity grid.
Why GAO Did This Study

The electric power industry—including transmission and distribution systems—increasingly uses information and communications technology systems to automate actions with the aim of improving the electric grid's reliability and efficiency. However, these “smart grid” technologies may be vulnerable to cyber-based attacks and other threats that could disrupt the nation's electricity infrastructure. Several federal entities have responsibilities for overseeing and helping to secure the electricity grid. Because of the proliferation of cyber threats, since 2003 GAO has designated protecting the systems supporting U.S. critical infrastructure (which includes the electricity grid) as a high-risk area.
GAO was asked to provide a statement on opportunities to improve cybersecurity for the electricity grid. In preparing this statement, GAO relied on previous work on efforts to address cybersecurity of the electric sector.

What GAO Found

GAO reported in 2011 that several entities—the North American Electric Reliability Corporation (NERC), the National Institute of Standards and Technology (NIST), the Federal Energy Regulatory Commission (FERC), the Department of Homeland Security (DHS), and the Department of Energy (DOE)—had taken steps to help secure the electric grid. These included developing cybersecurity standards and other guidance to reduce risks.
While these were important efforts, GAO at that time also identified a number of challenges to securing the electricity grid against cyber threats:
Monitoring implementation of cybersecurity standards : GAO found that FERC had not developed an approach, coordinated with other regulatory entities, to monitor the extent to which the electricity industry was following voluntary smart grid standards, including cybersecurity standards.
Clarifying regulatory responsibilities: The nature of smart grid technology can blur traditional lines between the portions of the grid that are subject to federal or state regulation. In addition, regulators may be challenged in responding quickly to evolving cybersecurity threats.
Taking a comprehensive approach to cybersecurity: Entities in the electricity industry (e.g., utilities) often focused on complying with regulations rather than taking a holistic and effective approach to cybersecurity.
Ensuring that smart grid systems have built-in security features: Smart grid devices (e.g., meters) did not always have key security features such as the ability to record activity on systems or networks, which is important for detecting and analyzing attacks.
Effectively sharing cybersecurity information: The electricity industry did not have a forum for effectively sharing information on cybersecurity vulnerabilities, incidents, threats, and best practices.
Establishing cybersecurity metrics: The electricity industry lacked sufficient metrics for determining the extent to which investments in cybersecurity improved the security of smart grid systems.
Since 2011, additional efforts have been taken to improve cybersecurity in the sector. For example, in 2013, NERC issued updated standards to address these and other cybersecurity challenges. NIST also updated its smart grid cybersecurity standards in 2014. It has also developed a cybersecurity framework for critical infrastructure, and DHS and DOE have efforts under way to promote its adoption. In addition, FERC assessed whether these and other challenges should be addressed in its ongoing cybersecurity efforts. However, FERC did not coordinate with other regulators to identify strategies for monitoring compliance with voluntary cybersecurity standards in the industry, as GAO had recommended. As a result, FERC does not know the extent to which such standards have been adopted or whether they are effective. Given the increasing use of information and communications technology in the electricity subsector and the evolving nature of cyber threats, continued attention can help mitigate the risk these threats pose to the electricity grid.

What GAO Recommends

In its 2011 report, GAO recommended that (1) NIST improve its cybersecurity standards, (2) FERC assess whether challenges identified by GAO should be addressed in ongoing cybersecurity efforts, and (3) FERC coordinate with other regulators to identify strategies for monitoring compliance with voluntary standards. The agencies agreed with the recommendations, but FERC has not taken steps to monitor compliance with voluntary standards.