FERC Proposes To Require Reporting For All Cyberattacks On Important Electric Infrastructure

Under a notice of proposed rulemaking to be released today, December 21, the Federal Energy Regulatory Commission (FERC) is proposing to direct the North American Electric Reliability Corporation (NERC) to revise the Critical Infrastructure Protection (CIP) reliability standards to require electric utilities to report all cyberattacks on the electric security perimeters surrounding their key electric infrastructure as well as the associated electronic access control and monitoring devices that protect those perimeters.

This proposal is driven in part by FERC's concern that the existing CIP reliability standards only require regulatory reporting if an attack has an impact on bulk-power system reliability. As a result, attacks that are successfully thwarted or prevented by electric utilities are not reported. According to FERC, this lack of reporting inadvertently creates an underreporting of the threat to reliability posed by these attacks.