6.1a ERMUSR 03-13-2017 - Laserfiche WebLink

Home Browse Search

AMERICAN PUBLIC Dowis �► �� ,... ..i.-�TM ASSOCIATION Powering Strong Communities ISSUE BRIEF January 2017 • Cybersecurity and the Electric Sector Summary for non-compliance.Additionally,FERC can instruct NERC The electric utility industry(including public power utilities) to develop new or revised reliability standards with a very short takes very seriously its responsibility to maintain a strong elec turn-around time. tric grid and it is the only critical infrastructure sector besides To date, the electric utility sector's Federal Power Act(FPA) Section 215 processes and its actions beyond the Section 215 re- nuclear power that has any mandatory and enforceable federal gime have prevented a successful cyber-attack causing operation- regulatory standards in place for cybersecurity.As the grid l evolves,unfortunately,so do threats to its integrity.The threat consequences on the bulk electric system in the United States. of cyber-attacks is relatively new compared to long-known phys That said,APPA has long recognized that increased information ical threats,but an attack with operational consequences could sharing and appropriately tailored liability protection would further enhance the industry's ability to guard against cyber-at- occur and cause disruptions in the flow of power if malicious tacks.As such,the Association strongly supported passage of the actors are able to hack into data overlays used in some electric generation and transmission infrastructure.Furthermore,such Cybersecurity Act of 2015,which was incorporated as Division an attack could also cause public power utilities to incur liability N of H.R.2029,the Consolidated Appropriations Act,2016. for damages.While the American Public Power(Association or The Act set up policies and procedures for sharing cybersecurity APPA) believes that the industry itself,with the North American threat information between the federal government and private Electric Reliability Corporation(NERC),has made great strides entities(which include public power) and between private enti- in addressing cybersecurity threats,vulnerabilities,and potential ties and provides limited liability protection for these activities if emergencies,it recognizes that emergency situations warranting conducted in accordance with the Act. In addition to the Cybersecurity Act of 2015,the Association federal involvement may arise. strongly supported Section 61003 of P.L. 114-94(the"FAST Act"),which gave the Secretary of Energy broader authority to Background and Congressional Action address grid security emergencies under the FPA and clarified The electric utility sector is the only critical infrastructure sector the ability of FERC and other federal agencies to protect sen- besides nuclear power plants(a part of the overall sector) that sitive Critical Electric Infrastructure Information(CEII)from has any mandatory and enforceable federal regulatory regime public disclosure under the Freedom of Information Act(FOIA) in place for cybersecurity. Congress approved the standards and other sunshine laws.Specifically,the provision directed that regime for the bulk power system in the Energy Policy Act of FERC-designated CEII be exempt from disclosure for a period 2005 (Section 215 of the Federal Power Act). Under Section of up to five years with a process to lift the designation or chal- 215,NERC,working with electric industry experts,regional lenge it in court and established sanctions for the unauthorized entities,and government representatives,drafts reliability and disclosure of shared information.FERC issued a final rule to cybersecurity standards that apply across the North American implement this provision on December 21,2016. grid,inclusive of Canada. Participation by industry experts and Outside of the legislative process,the Association and its compliance personnel in the NERC standards development members,as well as other utilities,continue to participate in process ensures that the standards are technically sound,fair, the NERC Critical Infrastructure Protection(CIP)standards and balanced.The Federal Energy Regulatory Commission drafting process on cyber and physical security. (See APPA's (FERC) has the power to then approve or remand those stan- "Physical Security and the Electric Sector"issue brief for more dards as they apply in the United States.To ensure compliance, information on the physical-security standard.)As attacks on critical electric infrastructure are ever-changing,so must be the NERC conducts rigorous audits and can levy substantial fines PubticPower.org II 193