Federal Energy Regulatory Commission staff detail efforts to address energy infrastructure cybersecurity challenges

Federal Energy Regulatory Commission (FERC) staff discussed in a presentation at FERC’s November open meeting several organizational changes aimed at enhancing the agency’s focus on cybersecurity challenges that impact energy infrastructure.

FERC staff highlighted the creation of a security-focused group within the Office of Energy Projects’ Division of Dam Safety and Inspections, which will address cyber and physical security concerns at jurisdictional hydropower facilities. Chairman Neil Chatterjee announced that FERC’s Office of Electric Reliability would establish a division focused exclusively on cybersecurity.

“At FERC, we are charged with overseeing the development and enforcement of cybersecurity standards for the nation’s high-voltage transmission system and jurisdictional hydroelectric facilities,” Chatterjee said. “These two developments will help FERC staff more efficiently focus its efforts on cybersecurity. This new security group in OEP and the realignment in OER will consolidate the cybersecurity staff into a division that focuses solely on cyber.”

Staff also identified five areas of focus related to cybersecurity challenges: supply chain/insider threat/third-party authorized access; industry access to timely information on threats and vulnerabilities; cloud/managed security service providers; adequacy of security controls; and internal network monitoring and detection.

Staff also described several activities and initiatives they plan to prioritize in fiscal year 2020, including monitoring supply chain security implementation and the adoption of new technologies and services by the energy industry related to cyberinfrastructure implementation, maintenance, and management.

FERC also noted that the Office of Energy Infrastructure Security will continue to build on its existing outreach initiatives and that the Office of Electric Reliability will continue to conduct and participate in audits.