Vulnerabilities in Power Industry Supply Chain May Increase Risk of Successful Cyber Attack on Electric Grid

Cyber-related vulnerabilities in the electric sector supply chain present a "clear and present danger" to U.S. national security and are growing as information technology (IT) and operational technology (OT) products and services converge in the evolving electric grid, according to a new study commissioned by Protect Our Power.

The imminent threat of a high-impact cyber attack is not going unchallenged, however. "(I)mportant regulatory and voluntary, best practices-based efforts are underway to change this dynamic," according to the "A Review of Power Industry's Supply Chain Security Risks" report from Ridge Global, a security-focused advisory firm founded by Tom Ridge, the former Pennsylvania Governor and first U.S. Secretary of Homeland Security.

Protect Our Power, a not-for-profit electric grid resilience advocacy organization, commissioned the study in 2019 given the important role that the integrity of the supply chain plays in the generation, transmission and distribution of electricity.

On the OT side, for example, cyber assets are part of transmission and distribution control centers, smart grid devices and smart meters, protective relays, outage and restoration software and more.  On the IT side, supply chain items that could contain a cyber threat are vital to corporate operations, including customer service, telephone and electronic communications, security, interface with operations systems and many other general corporate functions.

Ridge Global surveyed the efforts and programs of government standards agencies, the electric industry and their trade organizations as they work to address potential supply chain cyber issues and risks. Researchers also interviewed leaders within and outside the electric sector.

"Electricity is critical infrastructure, and Americans want it protected. The threats posed to our electric sector are global and multifaceted in scope," Ridge said. "When it comes to supply chain risk – manufacturers, vendors and system integrators alike – there's no protocol that oversees what they embed in the system is secure. It is time the industry got together with its cohorts and develop a unified, comprehensive, industrywide protocol to address supply chain risk. There's a clear and urgent need for coordinated, industrywide action."

In addition to identifying the causes of supply chain vulnerabilities, the 80-page report recommends a "model framework" for supply chain cyber risk management applicable to both the buyers and suppliers of products and services.

"This notional end-to-end model framework is intended to provide a comprehensive baseline against which various regulatory requirements and ongoing voluntary and collaborative activities designed to enhance supply chain cyber risk management with the U.S. electric industry can be objectively evaluated," the report states.

The five key components of the model framework are:

Establish corporate governance and set the direction for supply chain cyber risk management;
Establish and maintain multi-dimensional information sharing partnerships and technical capabilities;
Select the corporate risk management approach and conduct analysis to identify and prioritize risks;
Create and continuously validate a trusted risk management-focused supplier network; and
Implement controls to manage supply chain "life cycle" risk
"Our hope is that this report jumpstarts a dynamic and enduring solution to cyber threats that will secure the grid and make sure these vulnerabilities from equipment and the supply chain are fixed," said Richard Mroz, Protect Our Power's senior advisor for state and government relations and the former chairman of the Critical Infrastructure Committee for the National Association of Regulatory Utility Commissioners.

"As the report makes clear, there are huge gaps in the electric sector's cyber protection for the supply chain. Those gaps include no manufacturing standards; no product testing; no certification process; and no agreement on who would even bestow a 'seal of approval.' The current state of affairs is untenable."

The report includes an examination of a new supply chain cybersecurity standard (CIP 013-1) issued by the North American Electric Reliability Corp. that takes effect in July. It also examines recent revisions to two other NERC standards that pertain to supply chain risk management.