The US electricity ecosystem has been undergoing a rapid change in its resource mix, end-use loads, and technologies used to control and operate the grid. According to the North American Electric Reliability Corporation (NERC) – the Federal Energy Regulatory Commission (FERC)-designated electric reliability organisation (ERO), grid transformation coupled with the changing threat landscape and the convergence of information technology (IT) and operational technology (OT), business practices, communication networks, and system resources are increasing the grid’s attack surface, resulting in increased cyber and physical security risks. Industry must develop and implement new models, advanced tools and analytical capabilities, and new ideas around planning, designing, building, and operating a reliable and secure power grid moving forward. Hitherto, the industry focused on addressing issues between grid planning, design and operations departments. However, with the increasing focus and risk from cyber security threats, the electric sector needs to explore ways to integrate security and engineering practices into the long-term planning, design, and operations horizons. To address this, in May 2023, the ERO Enterprise (comprising NERC and the six regional entities) released a whitepaper titled, ‘Cyber-Informed Transmission Planning: Roadmap for integrating cyber security into transmission planning activities’.

NERC has been focusing on security integration as well as securely integrating emerging technologies on the North American bulk power system (BPS) through its Security Integration and Technology Enablement Subcommittee (SITES) (created in 2020). NERC has also collaborated with the Institute of Electrical and Electronics Engineers (IEEE) Power and Energy Society (PES) and published an IEEE technical report (TR105) on security integration. NERC and IEEE jointly identified security integration as a high-priority topic for both organisations to tackle together and initiated a joint task force to introduce the concepts of security integration. The effort specifically addresses topics of possible threats to the electricity sector, integrated planning approaches, integrated equipment design, integrated system operations, and securely integrating emerging technologies.

The NERC Physical Security Reliability Standard CIP-014, which was introduced after Pacific Gas and Electric’s Metcalf transmission substation in California was attacked in 2013 to ensure critical infrastructure was protected with physical security measures, is now under review by NERC as directed by the Federal Energy Regulatory Commission (FERC) to check its adequacy. The paradigm is thus shifting toward studying risks to BPS reliability from security-related threats. High-impact facilities are the prime targets for malicious actors due to their ability to affect numerous assets across the system simultaneously. These facilities are heavily protected with multiple layers of security controls to mitigate cyber threats. However, a coordinated cyber-attack on multiple lower-impact assets within the BPS could also pose a significant risk to its reliability. Although the BPS is designed to withstand the loss of a few elements at a time, it is not built to handle widespread outages or compromises of numerous assets that are not directly interconnected. Therefore, the whitepaper aims to explore how coordinated cyber-attacks affecting multiple, independent assets could be studied and understood better to enhance the BPS’s resilience against such threats.

Cyber-Informed Transmission Planning Framework (CITPF)

The paper introduces the cyber-informed transmission planning framework (CITPF) for including cyber security threats, particularly from coordinated attacks, into transmission planning studies that are most commonly conducted by transmission planners (TPs) and planning coordinators (PCs). CITPF is aimed at driving investments in cyber security where warranted and can be used by various entities—NERC, regional entities, industry stakeholders, regulators, and policymakers—to perform reliability studies. These studies will reveal unacceptable risks to the BPS which should be addressed with appropriate mitigations.

CITPF emphasises the need for collaboration between different departments and proposes an adaptable framework in well-defined steps. It facilitates communication and engagement between planning engineers, cybersecurity professionals, and design engineering teams to analyse and evaluate cybersecurity risks that could lead to outages of elements within the BPS. The goal is to establish a more comprehensive level of reliability for the BPS that includes considerations for potential cybersecurity risks. However, it is acknowledged that despite prevention measures, there might still be a reliance on recovery and restoration strategies in the event of cyber compromises, indicating the need for robust recovery plans in addition to preventive measures.

Figure 1: NERC’s proposed cyber-informed transmission planning framework

Source: NERC

The steps are as follows:

Step 1: Define coordinated attack scenarios

TPs and cybersecurity experts face the challenge of prioritising threat scenarios and identifying vulnerable assets amidst numerous potential attack permutations. They can prioritise these scenarios by assessing existing security gaps in technical standards, regulatory compliance, or security frameworks, considering security maturity levels. Entities can also conduct their internal risk assessments using available threat intelligence, including industry risk assessments from NERC, Electricity Information Sharing and Analysis Center (E-ISAC), and Cybersecurity and Infrastructure Security Agency (CISA). These sources highlight emerging risks in the electric sector and globally, informing transmission planning studies. NERC’s Low Impact Criteria Review Team (LICRT) report (October 2022) highlighted the risk of coordinated attacks associated with potential control gaps for Bulk Electric System (BES) Cyber System (BCS) categorised as low-impact as per NERC Critical Infrastructure Protection (CIP) standards. Further, there is a need for putting in place enhanced mitigating security controls even for facilities falling outside NERC CIP thresholds.

TPs and PCs should use the following recommendations to create the outputs in this step for use in the next step: 

  • Input data can be sifted to focus on system elements most relevant to the attack scenario under investigation, such as narrowing down elements using original equipment manufacturer (OEM) equipment with the highest usage in the area.
  • When scenarios necessitate generalising affected assets (for example, estimating percentages of compromised relays or wind turbines), planners can exercise engineering judgment or seek advice from cybersecurity experts to estimate outages appropriately. For instance, if specific location data is unavailable for a wind turbine OEM with known vulnerabilities, estimated penetration data from surveys can be utilised to approximate the percentage of affected turbines across the TP or PC’s region.
  • Assuming the outage of entire facilities based on significant device outages within that facility is feasible. For instance, if most or all relays are suspected to be compromised at a substation, planners may simplify by considering the entire substation as affected. Given the complexity of cyber security compromises, these assumptions aid in efficient planning assessments.

Step 2: Translate attack scenario to planning assessments

Step 2 involves converting the attack scenario details from Step 1 into information usable by TPs for planning assessments. This includes mapping affected assets outlined in Step 1 to contingencies simulated in planning assessments as well as mapping specific attack scenarios to suitable study methods for planning purposes.

To map affected assets to contingency definitions, planners need to align the identified assets to the elements in the planning model. This may include physical BES elements or electronic assets (like remote terminal units (RTUs) and protective relays) linked to physical infrastructure, demanding collaboration between departments like design engineering and security teams. Although existing transmission planning models do not automatically define cyber-related contingencies, manual options like utilising additional data fields in available software tools for cyber contingencies are feasible. For clarity, planners should align the list of impacted BPS elements with base case identifiers like bus numbers, element names, identifiers, and contingency actions for easy tracking and assessment. Collaborative efforts among TPs, design engineers, and cyber security professionals can help identify common system vulnerabilities, especially for coordinated cyber-attacks, allowing detailed analyses and corrective action plans where performance issues are found.

For mapping attack scenarios to study methods, TPs must select appropriate simulation types (steady-state or dynamic) based on the attack scenario’s nature and expected timescale. Worst-case scenario simulations, where all affected assets undergo simultaneous outages, often unveil the most severe reliability impacts. However, consideration of execution timing and feasibility is essential. Longer-term compromises may necessitate steady-state contingency analysis over dynamic simulations. Unstable simulations could indicate modelling errors or discrepancies between steady-state and dynamic analyses, prompting further investigation or corrective action planning. Engineering judgment guides the need for either steady-state or dynamic analysis beyond standard contingencies in TPL-001 (standard for transmission system planning performance requirements) or CIP-014.

Step 3: Conduct planning studies

Planning studies involve various analyses like steady-state, dynamic, and short-circuit evaluations, applying predetermined contingencies to examine electrical quantities in BES. This is akin to traditional transmission planning but requires defining a credible cyber threat and transforming it into a defined contingency before proceeding.

Here are key considerations for TPs conducting these studies:

  • Base case and simulation setup: Ensure accurate models, data inputs, and assumptions, similar to other reliability studies. Configuring simulation tools to handle larger contingencies than usual is necessary.
  • Model quality checks: Thoroughly test and benchmark the model before simulation.
  • Conducting studies: Run simulations for defined contingencies (such as steady-state power-flow, dynamic simulations) based on the nature of cyber threats (like loss of generation or transmission substations).
  • Results analysis: Compare simulation outcomes against performance criteria which include preventing instability, service interruptions, and maintaining system stability within specific parameters. If criteria are not met, corrective action plans may be necessary to meet design goals.

TPs must interpret simulation results carefully, distinguishing between potential reliability issues and simulation instability due to software challenges. Identifying cyber-attack scenarios that violate performance criteria informs strategies for additional security controls or network upgrades to mitigate risks. Even implementing a single security control at specific locations could mitigate risks from multiple cyber-attack scenarios.

Step 4: Identify corrective action plan

This step involves identifying corrective steps to mitigate possible BPS reliability risks. Corrective action plans could include, but are not limited to, the following: 

  • Infrastructure enhancements: Strengthening transmission components like line reinforcements or new substations, installing temporary structures to reroute lines or eliminating the criticality of certain assets through network upgrades and improving interregional transfer capability.
  • Controls and protections enhancements: Implementing additional remedial action schemes and safety measures in load-shedding programmes and adjusting protection and control systems.
  • Operating procedures enhancements: Coordinating enhanced operating and system restoration procedures, including additional contingency reserves and modifying maintenance schedules.
  • Cybersecurity programme enhancements: Integrating added security controls at specific locations or network-wide, enhancing baseline security for critical assets beyond standard requirements, including improved communication network segmentation and implementing intrusion detection/prevention systems and reinforcing incident response programmes for OT.

 Step 5: Implement risk mitigation 

Cybersecurity and design teams must oversee the incorporation of mitigating security controls identified in corrective plans. Security measures should align with a “defence-in-depth” strategy, possibly exceeding minimum NERC CIP standards. Implemented controls can be used to filter out future attack scenarios. The key considerations for the implementation of mitigation measures in new facilities include full support from leadership, early consideration of security features, addressing constraints pre-implementation, choosing equipment favouring enhanced security offerings, implementing secure communication network designs and incorporating security methods in future facility plans.

For existing facilities, there is need for leadership support and cross-departmental collaboration, efficient project management for widespread deployment, assessments for constraints in OT networks or legacy systems, selection of controls based on resources and effectiveness and planning retrofits for crucial controls if resource constraints arise.

Integrating security with transmission planning

In addition to outlining the CITPF, the whitepaper describes additional opportunities for security integration into the existing transmission planning standards, the adequate level of reliability (ALR) definition and regional coordination activities.

Revision of ALR for integration of security

ALR is a term specified in Section 215 of the Federal Power Act (FPA), which guides the development and enforcement of standards by the ERO. Accordingly, NERC has defined ALR to guide standards development and assist technical committees in addressing emerging reliability risks. However, the current ALR definition might need expansion, particularly in incorporating security as a critical aspect of BES reliability. ERO Enterprise has proposed expanding the ALR definition to integrate cybersecurity events, emphasising the need to acknowledge the increasing cybersecurity threats faced by the BES. The proposed updates include:

  • Recognising cybersecurity events as more than just ‘low probability’ and encouraging the adoption of practical security measures.
  • Considering the reduction of critical BPS facilities as a strategy to mitigate both physical and cyber security threats.
  • Adding new ALR performance objectives focused on managing security vulnerabilities and incident response capabilities related to cyber and physical attacks.
  • Updating the rationale for ALR assessment objectives to cater to the needs of security professionals working to support the BES.

The intention behind these proposed updates to the ALR definition is to align it more comprehensively with NERC Reliability Standards and to enhance risk mitigation efforts within NERC technical committees.

Recommended changes to NERC Reliability Standard TPL-001

The existing TPL-001 standard mandates the study of specific extreme events that are expected to cause severe impacts on portions of BES with any requirement to develop corrective action plans to mitigate them. Another limitation is that any adverse BES performance issues identified need not be corrected but just studied.  TPL-001 aims to design a BES capable of consistent operation across diverse conditions and in response to various potential events. Although cyber security attacks occur less frequently than environmental incidents, the growing prevalence and underlying risk associated with cyber threats prompt the ERO Enterprise to reassess which types of cyber-attacks should be categorised as extreme events in contrast to those falling under normal operations. 

Recognising the rising threat of cyber-attacks and their latent risk, BPS’s ability to withstand and recover from cyber-attacks is critical for overall reliability. It emphasises that coordinated cyber-attacks could have more severe impacts on BPS reliability than conventional contingencies studied under TPL-001. Therefore, it recommends enhancing TPL-001 to include cyber-attack scenarios, especially those involving coordinated attacks, in long-term planning assessments. These enhancements aim to ensure that any widespread BPS performance issues caused by credible cyber security attacks are effectively mitigated.  

Relationship to physical security and next steps

The purpose of the physical security standard, CIP-014 is to identify and protect critical transmission stations, substations, and associated primary control centres susceptible to physical attacks that could cause system instability or cascading within an Interconnection. The standard requires transmission operators (TOs) to conduct risk assessments to identify critical stations based on their electrical impact on the BPS and to evaluate potential physical security threats and vulnerabilities for these assets. TOs must develop and implement physical security plans focusing on deterrence, detection, communication, and response to potential threats.

While the standard does not mandate corrective action plans to reduce criticality, it acknowledges the potential for entities to implement resiliency measures that could mitigate the impact of physical attacks. NERC emphasised in FERC proceedings that measures enhancing resiliency, such as modifying system topology or constructing new facilities, could make it more challenging for attackers to cause significant harm to the BPS. 

The study conducted by NERC on the CIP-014 standard (April 2023), as directed by FERC to evaluate the adequacy of the standard and mandatory risk assessments, concluded that CIP-014 appropriately directs limited industry resources towards safeguarding the reliable operation of BPS from physical security incidents at critical facilities. The criteria used in CIP-014 were deemed broad enough to identify the subset of facilities categorized as “critical.” However, the report emphasised the need for more specificity in the types of analyses performed during risk assessments. Subsequently in August 2023, FERC and NERC conducted a technical conference to identify potential improvements to the NERC CIP-014-3 physical security standard. FERC noted that certain improvements are needed considering the various physical attacks on BES and other lower-level utility facilities.

Interconnection-wide planning

Different transmission planning groups, operating at regional, interregional, or interconnection-wide levels, engage in extensive reliability studies aiming to identify BPS performance issues that affect broader areas beyond the footprint of any single planning entity.  These larger-scale planning entities are well-positioned to consider the concept of CITPF and can conduct preliminary studies that aid TPs and PCs in recognising potential cyber-attack scenarios capable of significantly impacting BPS reliability. 

The ERO Enterprise actively participates in these groups and is open to collaborating with industry stakeholders within these forums to advance these concepts in the near future.