Sign in Subscribe
Social services

Joint Utilities Seek Pre-Authorization for Cyber Mutual Assistance Program

Strategic Insights

— 2 min read

The New York State Public Service Commission is being requested by a group of utilities to grant pre-authorization for the transfer or lease of equipment under the Cyber Mutual Assistance (CMA) program. This program, led by the Edison Electric Institute, aims to facilitate assistance among participating utilities in the event of a cyber incident. The Joint Utilities, including Central Hudson Gas & Electric Corporation, Consolidated Edison Company of New York, Inc., and others, seek to participate in this program to enhance the reliability and resiliency of their energy systems.

Key Takeaways:

  • The Joint Utilities are seeking pre-authorization from the New York State Public Service Commission to participate in the Cyber Mutual Assistance (CMA) program.
  • The CMA program aims to facilitate assistance among participating utilities in the event of a cyber incident through the voluntary lease or transfer of equipment.
  • The program is led by the Edison Electric Institute (EEI) and has been developed in response to the growing threat of cybersecurity attacks on utilities.
  • The Joint Utilities believe that participating in the CMA program will enhance the reliability and resiliency of their energy systems by allowing them to promptly and efficiently share critical services and equipment during and/or in recovery from a cyber event.
  • The program also includes the sharing of personnel to assist in the response to a cyber incident, but this component is not part of the current petition.
  • The Joint Utilities believe that participation in the CMA program is essential to minimize the adverse effects of cyber events and expedite restoration processes.
  • The petition is requesting pre-authorization for the transfer or lease of equipment pursuant to the CMA Agreement, which requires Commission approval under Public Service Law § 70.

Statistics:

  • 6 Public Service Law § 70 requires Commission approval for the transfer or lease of a gas or electric corporation's works or system.
  • 2 A utility is experiencing millions of attempts per day by parties seeking to gain access to their business enterprise and operations systems.
  • 10 The National Association of Regulatory Utility Commissioners (NARUC) has noted that a serious cyberattack on industrial facilities, on the scale of the massive 2012 attacks on oil company workstations in the Middle East, could require the repair of tens of thousands of systems, massive data quarantine procedures, and large reinstallations operations with the possibility of hardware replacements at significant scale.
  • 7 The 2019 Worldwide Threat Assessment warned that nation state actors can execute cyberattacks in the United States that can disrupt an electrical distribution network for at least a few hours.

Sources:

  • Executive Order No. 13,920, Securing the U.S. Bulk-Power System, 85 Fed. Reg. 26,595, at 26,595 (May 1, 2020)
  • Daniel R. Coats, Worldwide Threat Assessment of the U.S. Intelligence Community, Director of National Intelligence, Select Committee on Intelligence (Jan. 29, 2019), https://www.dni.gov/files/ODNI/documents/2019-ATA-SFR---SSCI.pdf
  • Joint Statement by the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the Office of the Director of National Intelligence, and the National Security Agency, January 5, 2021, https://www.dni.gov/index.php/newsroom/press-releases/press-releases-2021/item/2176-joint-statement-by-the-federal-bureau-of-investigation-fbi-the-cybersecurity-and-infrastructure-security-agency-cisa-the-office-of-the-director-of-national-intelligence-odni-and-the-national-security-agency-nsa

Read more