WIXLIB

improve distribution systems’ cybersecurity and federal efforts to supportthose actions, and (3) examines the extent to which DOE has addressedrisks to grid distribution systems from cyberattacks in its plans forimplementing the national cybersecurity strategy for the energy sector.To address the first two objectives, we conducted semistructuredinterviews with 38 key federal and nonfederal entities that play a role ingrid distribution systems’ cybersecurity: Federal entities Officials from four federal agencies with responsibilities related todistribution systems’ cybersecurity (e.g., DOE, DHS) that weidentified from previous GAO reports; and Officials from nine national laboratories that we selected based onprevious or ongoing research and development projects related togrid distribution systems (e.g., Argonne, Brookhaven, Idaho) andidentified from previous GAO reports and recommendations fromfederal officials.Nonfederal entities State officials from six public utility commissions (henceforthreferred to as “states” or “commissions”) that we selected basedon multiple criteria, including operating in states that contain alldistribution utility ownership types; 9 and Industry representatives from six distribution utilities (henceforthreferred to as “utilities”) that we selected based on multiplecriteria, including being located in one of the states of the sixselected public utility commissions and designation as criticalinfrastructure by DHS; as well as seven electric industryassociations, two cybersecurity firms; three grid equipmentmanufacturers; and one researcher, all of whom we identified fromprevious GAO reports and recommendations from entities weinterviewed and selected because of their relevant knowledge ofgrid distribution systems’ cybersecurity.The views of the officials and representatives we interviewed cannot begeneralized to those we did not speak with as part of our review, but theyprovide valuable insight into the extent to which the grid’s distributionsystems are at risk from cyberattacks and actions intended to improve9Distribution utilities are distinguished by three primary ownership types—investor owned,publicly owned (e.g., municipal utilities), and cooperatives.Page 3GAO-21-81 Electricity Grid Cybersecurity

distribution systems’ cybersecurity. We conducted a content analysis ofthese entities’ interview responses to identify any themes related tomanaging grid distribution systems’ cybersecurity risks.To describe the extent to which the grid’s distribution systems are at riskfrom cyberattacks and the scale of potential impacts from such attacks,we reviewed threat assessments from relevant federal agencies. 10 Wealso reviewed our prior reports on grid cybersecurity and relevant reportsfrom DOE and DHS. 11To describe selected state and utility actions to improve distributionsystems’ cybersecurity and federal efforts to support those actions, wereviewed relevant documentation from these entities, such as emergencymanagement plans, research project descriptions, and state cybersecuritylegislation.To examine the extent to which DOE has addressed risks to griddistribution systems from cyberattacks in its plans for implementing thenational cybersecurity strategy for the energy sector, we reviewed andanalyzed relevant DOE plans and assessments. 12 We also incorporatedfindings from our prior work that compared those plans and assessmentswith leading practices GAO identified on key characteristics for a national10For example, Daniel R. Coats, Director of National Intelligence, Worldwide ThreatAssessment of the U.S. Intelligence Community, testimony before the Senate SelectCommittee on Intelligence, 116th Cong., 1st sess., January 29, 2019; Department ofEnergy, Office of Electricity Delivery and Energy Reliability, Electric Subsector RiskCharacterization Study (Washington, D.C.: June 2017); and Department of HomelandSecurity, 2020 Homeland Threat Assessment (Washington, D.C.: October 2020).11For example, GAO, Cybersecurity: Challenges in Securing the Electric Grid,GAO-12-926T (Washington, D.C.: July 17, 2012); Department of Homeland Security,Cybersecurity and Infrastructure Security Agency, Securing Industrial Control Systems: AUnified Initiative FY2019 – 2023 (Washington, D.C.: July 2020); and Department ofEnergy, Office of Inspector General, Audit Report: Federal Energy RegulatoryCommission’s Monitoring of Power Grid Cyber Security, DOE/IG-0846 (Washington, D.C.:January 2011).12Departmentof Energy, EERE [Energy Efficiency and Renewable Energy] CybersecurityMultiyear Program Plan (Washington, D.C.: October 2020); Multiyear Plan for EnergySector Cybersecurity (Washington, D.C.: May 2018); Department of Energy andDepartment of Homeland Security, Assessment of Electricity Disruption IncidentResponse Capabilities (Washington, D.C.: August 2017); and Department of Energy andDepartment of Homeland Security, Energy Sector-Specific Plan, 2015 (Washington, D.C.:2015).Page 4GAO-21-81 Electricity Grid Cybersecurity

strategy. 13 Appendix I provides further information about the scope of ourreview and the methods we used.We conducted this performance audit from September 2019 to March2021, in accordance with generally accepted government auditingstandards. Those standards require that we plan and perform the audit toobtain sufficient, appropriate evidence to provide a reasonable basis forour findings and conclusions based on our audit objectives. We believethat the evidence obtained provides a reasonable basis for our findingsand conclusions based on our audit objectives.BackgroundGrid Components andFunctionsAs shown in figure 1, the U.S. electricity grid comprises three distinctfunctions: Generation and storage: Power plants generate electric power byconverting energy from other forms—chemical, mechanical(hydroelectric or wind), thermal, radiant energy (solar), or nuclear—into electric power. Energy storage, such as batteries or pumpedhydroelectric, can improve the operating capabilities of the grid whilealso regulating the quality and reliability of power. Transmission: The grid’s transmission system connectsgeographically distant power plants with areas where electric power isconsumed. Substations are used to transmit electricity at variedvoltages. These substations generally contain a variety of equipmentand system operations instruments to control the flow of electricpower. Distribution: The grid’s distribution systems carry electric power outof the transmission system to industrial, commercial, residential, andother consumers. Distribution systems may have distributed energyresources (e.g., solar panel installations on homes and businesses),smart meters, and networked consumer devices (e.g., smartthermostats and electric vehicle chargers) connected to them.13GAO-19-332.Page 5GAO-21-81 Electricity Grid Cybersecurity

Figure 1: Functions of the U.S. Electricity GridDistribution Systems’Cybersecurity RegulationDistribution utilities are generally not subject to the mandatory federalcybersecurity standards that apply to the bulk power system. 14 Instead,state and local entities typically oversee the reliability of the grid’sdistribution systems, and distribution utilities may apply nationalcybersecurity guidance and standards voluntarily. 15 Distribution utilitiesare distinguished by three primary ownership types:14TheFederal Energy Regulatory Commission (FERC)—the federal regulator for theinterstate transmission of electricity—has approved mandatory cybersecurity standards forthe bulk power system. FERC’s regulatory authority and responsibility specificallyexcludes facilities used in the local distribution of electricity.15Inaddition, state public utility commissions may adopt Institute of Electrical andElectronics Engineers standards on a voluntary or mandatory basis, and distributionutilities may voluntarily implement the standards, according to FERC officials.Page 6GAO-21-81 Electricity Grid Cybersecurity

Investor-owned distribution utilities are privately owned. They areoverseen by state public utility commissions. Publicly owned (e.g., municipal) distribution utilities are divisions oflocal government. They are overseen by local city councils or byelected or appointed boards. Cooperatives are private, member-owned utilities legally establishedto be owned by and operated for the benefit of those using its service.Cooperatives tend to serve rural populations and are overseen bytheir members.Industrial Control SystemsIndustrial control systems play a significant role in supporting the controlof electric power generation, transmission, and—increasingly—distribution. These vital systems monitor and control sensitive processesand physical functions, such as the opening and closing of circuitbreakers on the grid. Early industrial control systems were not designedwith cybersecurity protections in mind because they operated in isolationand were not connected to information technology (IT) systems or theinternet. Technological advances in these systems have offeredadvantages to system operators but have also increased the vulnerabilityof the systems. For example, increased access to industrial controlsystems, particularly through remote means and IT networking protocols,offers benefits to system operators such as easier maintenance and moredetailed systems data, but they also make these systems morevulnerable to cyberattacks. Such cyberattacks may require an unusualdegree of sophistication and knowledge, in part because industrial controlsystems often use operating systems and applications that may beunfamiliar to typical IT personnel.Critical InfrastructureProtection Roles andResponsibilitiesFederal policy and public-private plans establish roles and responsibilitiesfor the protection of critical infrastructure, including the electricity grid. Forexample: Presidential Policy Directive 21 made DOE responsible forcollaborating with critical infrastructure owners and operators in theenergy sector, identifying vulnerabilities, and helping to mitigatePage 7GAO-21-81 Electricity Grid Cybersecurity

incidents. 16 The directive also called for DHS to coordinate the overallfederal effort to promote the security and resilience of the nation’scritical infrastructure. The directive emphasized that criticalinfrastructure owners and operators (e.g., distribution utilities) areuniquely positioned to manage risks to their individual operations andassets and to determine effective strategies to make them moresecure and resilient. The National Infrastructure Protection Plan further integratescritical infrastructure protection efforts between government andprivate sectors by describing a voluntary public-private partnership.Under this partnership, designated agencies serve as the leadcoordinators for the security programs of their respective sectors. 17This plan made designated agencies responsible for the developmentand updating of a critical infrastructure plan to support the NationalInfrastructure Protection Plan. The National Defense Authorization Act for Fiscal Year 2021establishes additional roles and responsibilities for designatedagencies in securing critical infrastructure. 18 For example, the actrequires designated agencies to provide specialized expertise, assessrisks, and support risk management of their respective criticalinfrastructure sectors.16WhiteHouse, Presidential Policy Directive/PPD-21: Critical Infrastructure Security andResilience (Washington, D.C.: Feb. 12, 2013). DOE has this role through its designationas the sector-specific agency for the energy sector. The Fixing America’s SurfaceTransportation Act (FAST Act) codified DOE’s role and gave it the authority to orderemergency measures, following a presidential declaration of a grid security emergency, toprotect or restore the reliability of critical electric infrastructure. Pub. L. No. 114-94, Div. F,§ 61003, 129 Stat. 1312, 1778 (2015).The FAST Act contains provisions designed toprotect and enhance the nation’s electric power delivery infrastructure.17Departmentof Homeland Security, NIPP [National Infrastructure Protection Plan] 2013:Partnering for Critical Infrastructure Security and Resilience (Washington, D.C.: December2013).The plan also called for each sector to have a government coordinating council,consisting of representatives from various levels of government, and many sectors have acoordinating council consisting of owner-operators of these critical assets orrepresentatives of their respective trade associations. For example, the Energy SectorGovernment Coordinating Council has been established (comprising the electricitysubsector, as well as the oil and natural gas subsectors), and an Electricity SubsectorCoordinating Council has been established to represent electricity asset owners andoperators.18TheWilliam M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year2021, Pub. L. No. 116-283, § 9002(c)(1), 134 Stat. 3388, 4770–72.Page 8GAO-21-81 Electricity Grid Cybersecurity

National CybersecurityStrategyThe executive branch has taken steps toward outlining a national strategyfor confronting cyber threats to critical infrastructure—including the grid’sdistribution systems. For example, in 2017, the White House issuedExecutive Order 13800, which required DOE and DHS to assess thepotential impacts of a significant cyber incident. 19 Additionally, in 2018,the National Security Council issued the National Cyber Strategy, whichdescribes actions that federal agencies and the administration are to take,such as prioritizing risk-reduction across seven key areas, includingenergy and power, to protect critical infrastructure. 20DOE has led the development of three plans and an assessment that,collectively, represent the department’s efforts to implement the nationalcybersecurity strategy specifically for the energy sector, including the grid: The Energy Sector Specific Plan was developed in 2015 inresponse to Presidential Policy Directive 21. The plan guides efforts toimprove the security and resilience of the energy sector—includingthe electricity grid—and discusses the various cyber and physicalrisks and threats facing the sector. 21 Assessment of Electricity Disruption Incident ResponseCapabilities, developed in 2017 in response to Executive Order13800, examines the potential scope and duration of a cyberattack onthe electricity grid. 22 It also evaluates the nation’s readiness tomanage the impacts of a cyber incident and assesses capability gapsin responding to an incident.19Executive Order No. 13800, 82 Fed. Reg. 22,391 (May 16, 2017). The executive orderalso required DOE and DHS to assess the readiness of the United States to manage theconsequences of such an incident and any gaps or shortcomings in assets or capabilitiesrequired to mitigate the consequences of such an incident.20WhiteHouse, National Cyber Strategy of the United States of America (Washington,D.C.: September 2018). In 2019, the National Security Council developed anImplementation Plan that details activities that federal entities are to undertake to executethe priority actions outlined in the National Cyber Strategy. However, we reported inSeptember 2020 that the Implementation Plan and National Cyber Strategy, whencombined, are missing key elements for addressing some characteristics of a nationalstrategy. GAO, Cybersecurity: Clarity of Leadership Urgently Needed to Fully Implementthe National Strategy, GAO-20-629 (Washington, D.C.: Sept. 22, 2020).21Department of Energy and Department of Homeland Security, Energy Sector-SpecificPlan, 2015.22Department of Energy and Department of Homeland Security, Assessment of ElectricityDisruption Incident Response Capabilities.Page 9GAO-21-81 Electricity Grid Cybersecurity

The Multiyear Plan for Energy Sector Cybersecurity that DOEdeveloped in 2018 lays out an integrated strategy to reduce cyberrisks in the U.S. energy sector through high-priority activities that areto be coordinated within DOE and with the strategies, plans, andactivities of other federal agencies and the energy sector. 23 It alsodescribes how DOE will carry out its mandated cybersecurityresponsibilities and address the evolving security needs of energyowners and operators. 24 The 2020 Cybersecurity Multiyear Program Plan supplements the2018 multiyear program plan and describes DOE’s strategy andactivities for energy delivery systems within its purview. 25 The planincludes milestones and time lines for the completion of theseactivities.In August 2019, we reported that these first two DOE plans andassessment to implement the national cybersecurity strategy for the griddid not fully address all of the key characteristics needed to implement anational strategy. 26 For example, none of those documents fully analyzedthe cybersecurity risks and challenges to the grid. In response, werecommended that DOE develop a plan that addresses the keycharacteristics of a national strategy, including a full assessment ofcybersecurity risks to the grid. DOE agreed with our recommendationand, according to DOE officials, the department is updating its plans andassessment.23Departmentof Energy, Multiyear Plan for Energy Sector Cybersecurity.24DOE established the Office of Cybersecurity, Energy Security, and EmergencyResponse in 2018 with the goal of providing greater visibility, accountability, and flexibilityin securing U.S. energy infrastructure.25Departmentof Energy, EERE Cybersecurity Multiyear Program Plan.26GAO-19-332.Page 10GAO-21-81 Electricity Grid Cybersecurity

The Grid’sDistribution SystemsAre Increasingly atRisk fromCyberattacks, but theScale of PotentialImpacts Is UnclearGrid Distribution SystemsAre IncreasinglyVulnerable toCyberattacksThe grid’s distribution systems face significant cybersecurity risks—thatis, threats, vulnerabilities, and impacts—and are increasingly vulnerableto cyberattacks. Threat actors are growing more adept at exploiting thesevulnerabilities to execute cyberattacks. 27 However, the scale of thepotential impacts of such cyberattacks on the grid’s distribution systems isunclear.Like the rest of the grid, distribution systems are becoming morevulnerable to cyberattacks, in part due to the introduction of and relianceon monitoring and control technologies. For example, industrial control systems increasingly include remote accesscapabilities to monitor and control operations and connect tocorporate business networks; grid operations increasingly rely on global positioning systems (GPS)for critical position, navigation, and timing information; and more networked consumer devices and distributed energy resources,which provide increased monitoring and control capabilities forconsumers and utilities, are being connected to distribution systemsnetworks. 28Increasing grid vulnerabilities related to these technological advances,discussed in further detail below, are compounded for distributionsystems because the sheer size and dispersed nature of the systemspresent a large attack surface.Industrial Control SystemsAccording to officials and representatives of selected federal andnonfederal entities we interviewed, industrial control systems in griddistribution systems are becoming increasingly vulnerable tocyberattacks. For example, officials from two selected nationallaboratories and a cybersecurity firm stated that the addition of remoteaccess capabilities and connections to business IT networks could make27A threat actor is a person or group that takes malicious action—including acyberattack—on computers, systems, or networks.28GAO-19-332.Page 11GAO-21-81 Electricity Grid Cybersecurity

industrial

The U.S. grid’s distribution systems —which carry electricity from transmission systems to consumers and are regulated primarily by states—are increasingly at . transmission, and distribution. The generation and transmission systems, which together