FERC Forms New Office To Focus On Cybersecurity

In the absence of new federal cybersecurity legislation, FERC uses its available authority in an effort to increase the resilience of the nation's critical electric infrastructure to cyber attacks.

On September 20, the Federal Energy Regulatory Commission (FERC or the Commission) announced the creation of a new office, the Office of Energy Infrastructure Security (OEIS), which will focus on physical and cyber risks to energy facilities subject to FERC jurisdiction.1 Headed by the current director of the Office of Electric Reliability, Joseph McClelland, OEIS will assist the Commission in identifying security risks, communicating those risks to other federal and state agencies and regulated utilities, and developing solutions to mitigate those risks. Consistent with the existing approach taken by the Obama administration in the absence of new legislation, FERC's action draws on its existing statutory authority in an effort to increase the cyber resilience of critical infrastructure.

According to FERC Chairman Jon Wellinghoff, OEIS will concentrate on the following four areas:2

Developing recommendations to mitigate security risks to FERC-jurisdictional facilities Advising Congress, other agencies, and utilities regarding these risks Participating in intelligence-related collaborative efforts to address these risks alongside other agencies and utilities Conducting outreach to address these threats with private-sector owners and operators of critical infrastructure OEIS represents the Commission's response to the increased visibility of security risks to key infrastructure, including cyber attacks and electromagnetic pulse events, and is intended to provide for a more rapid and effective response to these risks by the Commission. Chairman Wellinghoff stressed that OEIS's activities will complement, not replace, the existing work performed by the Office of Electric Reliability and the North American Electric Reliability Corporation (NERC) in overseeing the enforcement and development of Reliability Standards, including Critical Infrastructure Protection (CIP) Reliability Standards.

The creation of OEIS reflects the growing focus at the federal level on the need for greater cybersecurity protections for critical infrastructure and an interest in taking any available steps in the absence of new legislation. Despite recent...