Cybersecurity for Utility Regulators

• Cybersecurity Baselines for Electric Distribution Systems and DER
  NARUC and DOE CESER developed a set of cybersecurity baselines for the electric distribution systems and distributed energy resources (DER) that connect to them. These baselines, coupled with the forthcoming implementation guidance, are intended as resources for state public utility commissions, utilities, and DER operators and aggregators. Learn more. 
• Emerging Issues Brief: Volt Typhoon
  This brief describes the threat to critical infrastructure posed by the cyber threat actor group known as Volt Typhoon. It contains questions PUCs may consider asking utilities about their actions to identify and mitigate malicious Volt Typhoon-related activity on their critical systems. Download
• On-Demand Cybersecurity Training Modules
  The Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response in partnership with NARUC have produced a set of on demand cybersecurity training modules. Much of the content included in the training is based on NARUC's Cybersecurity Manual. Learn More
• Cybersecurity Advisory Team for State Solar (CATSS)
  Created by the National Association of State Energy Officials and NARUC, the CATSS Toolkit provides State Energy Offices and public utility commissions with actionable information on cybersecurity for solar power and supports state cybersecurity enhancements for solar and other distributed energy resources. Learn More
• Compendium of Cyber Incident Notification Requirements for Critical Infrastructure Utilities by State
  This resource details state-by-state requirements for utiltiies to report cybersecurity incidents. Links to statutes and orders are included. Download
• Issue Brief: Log4j Vulnerability
  This one pager describes the recently discovered Log4j vulnerability, which affects millions of applications world wide. The brief contains questions PUCs may consider asking utilities about their actions to identify and mitigate the vulnerability on thier systems. Download
• A Guide for Public Utility Commissions: Recruiting and Retaining a Cybersecurity Workforce
  This paper serves as a reference guide for PUCs trying to develop or expand their cybersecurity proficiency. It describes the role of cybersecurity personnel within a PUC and a range of cybersecurity skill sets that may fit a PUC’s needs, as well as avenues for recruiting, retaining, and growing cybersecurity expertise. Appendices provide lists of cybersecurity training resources, recruitment pipelines, and a compendium of sample cybersecurity job descriptions for PUC consideration. Download
• Cybersecurity for the Smart Grid: Questions for Utilities
  This paper introduces cybersecurity topics relevant to the smart grid. It also suggests questions PUCs might ask utilities to better understand how they are assessing and mitigating the new risks associated with advancing technologies that comprise the smart grid. Concepts in this paper draw from seminal works by the National Institute of Standards and Technology (NIST) as well as topics introduced in NARUC’s Cybersecurity Manual. This paper is a complement to Understanding Cybersecurity Preparedness: Questions for Utilities, one component of the manual. Download

• Cybersecurity Manual
  NARUC has developed a comprehensive suite of resources, collectively referred to as the Cybersecurity Manual, to help public utility commissions gather and evaluate information from utilities about their cybersecurity risk management practices. These evaluations facilitate well-informed PUC decisions regarding the effectiveness of utilities’ cyber security preparedness efforts and the prudence of related expenditures. Learn More

  • Cybersecurity Strategy Development Guide
    This document aims to guide commissions’ interactions with their utilities on issues related to cybersecurity, drawing from the experiences of federal, state, and private-sector stakeholders, including state PUCs themselves. Further, it provides guidance and practices for regulators to consider as they develop and implement their strategies. Commissions that have already developed a strategy can use this guide to review and enhance their current strategy.
  • Understanding Cybersecurity Preparedness: Questions for Utilities
    This resource provides a set of comprehensive, context-sensitive questions that PUCs can ask of a utility to gain a detailed understanding of its current cybersecurity risk management program and practices. The questions build upon and add to those included in prior NARUC publications.
  • Cybersecurity Preparedness Evaluation Tool (CPET)
    The CPET provides a structured approach for PUCs to use in assessing the maturity of a utility’s cybersecurity risk management program and gauging capability improvements over time. The CPET is designed to be used with the Questions for Utilities on an iterative basis to help PUCs identify cybersecurity gaps, spur utilities’ adoption of additional mitigation strategies, and inform cybersecurity investment decisions.
  • Cybersecurity Tabletop Exercise Guide
    This guide details the steps that PUCs can take to design, execute, and evaluate a cybersecurity-focused tabletop exercise (TTX). An exercise could examine utilities’ and other stakeholders’ readiness to respond to and recover from a cybersecurity incident or analyze the PUC’s internal capabilities. This guide includes example scenarios and customizable templates.
    • Appendix B - Template Cyber TTX Checklist
    • Appendix C - Template SitMan
    • Appendix D - Template Exercise Evaluation Guide
    • Appendix E - Template AAR-IP
  • Cybersecurity Glossary

    This glossary contains cybersecurity terms used throughout the Cybersecurity Manual, as well as “terms of art” that utilities may use during discussions with PUCs. It also contains a list of cybersecurity related events that demonstrate the growing threats and vulnerabilities against critical infrastructure sectors.

  • Modernized Grids Can Increase Security Risks

This infographic contains helpful information for regulators to enhance cyber preparedness. It also contains links to relevant USAID and NARUC resources.