Federal Energy Regulatory Commission Proposes Cybersecurity Measures to Protect Electric Grid

Anna Ribeiro, writing in Industrial Cyber, reports that the US Federal Energy Regulatory Commission (FERC) has proposed new changes to improve cybersecurity for the country’s electric power system. These changes focus on better monitoring of network activity to catch potential cyberattacks before they can do serious damage.

Security monitoring is required only within a specific “electronic security perimeter.” Still, FERC wants to extend this protection to include systems that control access to the network, such as electronic and physical security systems (EACMS and PACS), even if they are outside this perimeter. This is because attackers could bypass the perimeter by targeting these external systems, which are trusted but vulnerable.

The Federal Energy Regulatory Commission is asking the North American Electric Reliability Corporation (NERC) to update the security rules to close this gap. The revised standards should ensure that all parts of the network, inside and outside the perimeter, are monitored for unusual or suspicious activity. This would include identifying unauthorized access, unusual devices or connections, and malicious software. The goal is to detect cyber threats early, stop them quickly, and improve the quality of data that helps understand the scope of an attack.

The new rules would strengthen the electric grid’s overall data security by expanding monitoring to these additional systems. This would make it harder for cybercriminals to gain control of critical systems, helping prevent outages or disruptions. Public comments on this proposal are welcome, and FERC expects NERC to deliver the updated standards within a year after the final rule is in place.