Senate grills FERC, DOE on power sector cybersecurity

Dive Brief:

The Senate Committee on Energy and Natural Resources on Wednesday held its first hearing in more than a year on the cybersecurity of the energy sector.
Committee chairman Sen. Lisa Murkowski, R-Alaska, pointed out several developments since the last hearing on cybersecurity, including President Trump's executive order on securing the U.S. bulk power system.
The Department of Energy has held over 90 telephone calls with stakeholders since President Donald Trump issued the executive order, Alexander Gates, senior advisor in the Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESER) said in response to a committee question. Those stakeholders include owners of bulk power supply assets and equipment manufacturers; and over 3,000 individuals have engaged with DOE since the issuance of the order, Gates said.

Dive Insight:

President Trump May 1 issued an executive order on physical and cybersecurity of the nation's power grid (E.O. 13290). DOE July 8 published a request for information (RFI), specifying six countries — China, Cuba, Iran, North Korea, Russia and Venezuela — as "foreign adversaries" from which the power sector cannot purchase equipment. The RFI also asks stakeholders to respond to a series of eight questions about critical infrastructure vulnerabilities. Comments are due Aug. 7.

Federal Energy Regulatory Commission (FERC) has a two-pronged approach to addressing the reliability and security of the electric power supply, Joseph McClelland, director of the Office of Energy Infrastructure Security for FERC, told the committee. Those are establishing and enforcing mandatory standards and collaborating with operators to develop best practices and alert the private sector to imminent threats.

FERC June 18 issued a white paper discussing incentives, possibly allowing a higher return on equity, for utilities that make cybersecurity enhancements to their grid operations. Commission staff is awaiting comments on the white paper.

Sen. Catherine Cortez Masto, D-Nev., asked Gates and O'Brien about efforts to train and develop a cybersecurity workforce in the power sector.

"This is a challenge for the country," Gates acknowledged, "we're going to be short not only of IT (information technology) cybersecurity professionals, but the shortages are even starker when we talk about industrial controls systems." DOE has started an internship program at its National Laboratories for cadets at the U.S. Coast Guard Academy, according to Gates.

"The supply and demand on cybersecurity resources is somewhat problematic," Thomas F. O'Brien, senior vice president and chief information officer of PJM Interconnection responded. PJM has rotational development programs to train its own staff both in different aspects of the business and different technologies.

Sen. Angus King, I-Maine, suggested distributed energy resources could reduce cybersecurity targets by decentralizing electric power supply. Gates responded that interconnected DERs may be potential targets of cyberattack and components and equipment must be secured.