Utah energy providers have ‘mature’ cybersecurity protocols, but there are gaps, audit says

Utah’s largest electricity provider has “mature” cybersecurity tools, but the Utah Legislature may consider additional oversight for it and municipal utilities after legislative auditors determined that direct federal and state supervision on the protocols is limited.

The only state agency that oversees cybersecurity for Rocky Mountain Power — which sells about 78% of the state’s electricity — is the Utah Public Service Commission, legislative auditors said in a report presented to lawmakers on Tuesday. But, that governance is limited to commissioners’ rate-setting processes. 

“Multiple levels of government have jurisdiction for ensuring adequate electricity cybersecurity. The federal government regulates cybersecurity for large portions of the electrical grid, including large scale generation and transmission,” auditors wrote. “States can provide oversight of cybersecurity for electricity distribution, the stage where power is delivered to customers at lower voltages.”

Rocky Mountain Power didn’t have much to say in its audit response, saying that the company “takes cybersecurity extremely seriously and remains committed to maintaining a strong, resilient, and continuously evolving cybersecurity program designed to protect critical electric infrastructure and support the reliable delivery of electric service to customers.”

“We believe the report provides a fair and balanced assessment of the company’s cybersecurity program and accurately reflects our commitment to protecting critical infrastructure, managing evolving cyber threats, and maintaining reliable electric service for the communities we serve,” the company wrote.

However, unlike large-scale electricity providers, municipal power systems — which provide about 16% of Utah’s electricity — have opportunities for improvement in issues, auditors wrote.

“This finding is concerning because cyberattacks have the potential to disrupt the delivery of electricity such as that seen in Ukraine in 2015,” the audit says, referring to the 2015 Russian cyberattacks on Ukraine power which impacted 225,000 customers. “Cyberattacks can also affect related systems and open the door to future attacks on power systems.”

None of the five municipal power systems auditors interviewed used independent third-party assessments to evaluate their cybersecurity controls. They didn’t develop, document or regularly practice incident response plans either, auditors wrote. 

“While attacks can be disruptive, the impact on municipal power systems is generally limited to individual power systems unless simultaneous attacks occur,” according to the audit. 

Lacking plans for incident response could contribute to longer lasting power outages if a cyberattack were to occur. Those extended disruptions could affect critical infrastructure like hospitals, drinking water and sewage treatment systems, the audit says, as well as schools and transportation. 

But, because utilities administered by municipalities cover the service of limited areas, they may be able to recover faster if they have manual controls available at substations.

Amid those gaps, legislative auditors recommend looking into whether state involvement is necessary “to encourage municipal power systems to improve cybersecurity practices.”

“This could include such things as having the Cybersecurity Commission or Cyber Center help develop model incident response plans, requiring municipalities to adopt baseline cybersecurity controls, or encouraging adoption of best practices by reducing potential liability for those that do adopt best practices,” the audit says.