House explores grid cybersecurity boosts amid growing threats

Several bills before Congress would reauthorize or bolster various programs designed to strengthen the nation’s electric grid against cyber threats and help cash-strapped public utilities bolster their defenses.

A subcommittee of the House Energy and Commerce Committee considered various pieces of legislation at a hearing this week, including one to reauthorize the Rural and Municipal Utility Advanced Cybersecurity Program, known as RMUC, and another that would require state energy offices to include more data on vulnerabilities in their state energy security plans.

The Defense Intelligence Agency warned this year in its Worldwide Threat Assessment that the grid is an attractive target for cyberattacks, especially from adversarial nation-states looking to wreak havoc and cause major disruption to critical infrastructure. And lawmakers warned that, without Congress taking action to help utilities that struggle under the weight of insufficient staff and money, those vulnerabilities will only get deeper.

“Addressing cyber and physical threats is no easy task,” Rep. Bob Latta, an Ohio Republican who chairs the Energy Subcommittee that held the hearing, said during his opening statement. “The avenues for malicious activity only widen as digitization, communications, and linkages of gas pipelines, new generating resources, and transmission take root to meet energy demands. The interconnected nature of our energy systems requires constant intelligence sharing, clear visibility into threat landscapes, and sufficient resources to fill gaps in security protections for rural and small utility service territories.”

The RMUC has proven to be popular since its inclusion in the 2021 infrastructure law. Initially authorized with $250 million over five years, the program helps co-operative, municipal and small investor-owned utilities harden their systems, provide training, respond to and recover from cyberattacks. 

In written testimony before the subcommittee, Nathaniel Melby, vice president and chief information officer at the Dairyland Power Cooperative in La Crosse, Wisconsin, said the program “bridges the rural resource gap, ensuring that the security posture in rural America is as robust and formidable as anywhere else in the nation.”

But while Melby said reauthorization is a necessary step, he criticized the Department of Energy for not yet releasing $80 million in grants that it announced last fall under the program for more than 400 electric co-ops.

“These investments will ensure that we no longer see pockets of strength, but substantial cybersecurity improvement across our member co-ops’ systems and infrastructure,” said Melby, who also appeared before the subcommittee on behalf of the National Rural Electric Cooperative Association.

He said that the program can be run better, too, including by moving more quickly with implementation and funding awards, while also giving more flexibility to allow electric cooperatives to compete not just for grant money but also technical assistance. Melby said the program’s “promise” is “undeniable.”

Administration officials who appeared before the subcommittee showed a willingness to work with states and localities on cybersecurity preparedness.

“Sophisticated attacks on rural utilities illustrate the critical need for DOE to accelerate improvements in cyber readiness while also closing the rural resources gap,” Alex Fitzsimmons, acting undersecretary of energy and director of Energy’s Office of Cybersecurity, Energy Security and Emergency Response, said in written testimony.

More work lies ahead, however, especially when it comes to information sharing. One pending bill, the Energy Threat Analysis Center Act, looks to reauthorize Energy’s threat information-sharing hub. Scott Aaronson, senior vice president for energy security and industry operations at the Edison Electric Institute, testified that the ETAC has “repeatedly proven its value.” He said that giving it extra legal authority to allow for “candid discussion of extremely sensitive security and operational topics” would build on its good work so far.

Meanwhile, witnesses also supported requiring more information in state energy plans around supply chain security and threats to local distribution utilities . 

“Close coordination among industry and government partners at all levels is imperative to deterring attacks and preparing for emergency situations,” said Adrienne Lotto, senior vice president of grid security, technical and operations services at the American Public Power Association, in written testimony.

Fitzsimmons said President Donald Trump’s administration is “committed” to having state, local, tribal and territorial governments “play a more active and significant role in energy resilience and preparedness.” He said this will help them “mitigate risks posed to the electric grid by empowering them to fully assess, review, and respond to risks from cyber and physical attacks, severe weather, and other vulnerabilities.”

A vote on the legislation is expected soon.