In Depth

Security Standards for Power Companies

Power companies have developed converged security standards for protecting and managing risks.

By Michael Fitzgerald

Even with the threat of government regulation, Miserendino says, gaining consensus within NERC on self-regulation took almost three years. "The difficult thing was convincing people this was the first step in an evolution and not an end unto itself," he says.

The standards have room to evolve. While more than 88 percent of NERC's members voted to approve them—approval required two-thirds—there were still some "no" votes cast. NERC noted objections when it announced the critical infrastructure protection standards: implementation costs, combined with the potential for little or no return on that spending; requirements that went beyond critical cyberassets at bulk power system control centers; and some ambiguous asset definitions. FERC may ask for clarification on any of these issues. FERC might also balk at the industry being its own auditor. But no one expects wholesale rejection by FERC.

What remains unclear is whether the standards will have any impact on other elements of U.S. critical infrastructure, such as the chemical, water, or oil and gas industries. "I've told my friends in chemical and oil and gas that they could take those NERC standards, change the definition of what a cybersecurity asset is and use them as they are," says Peterson. He suspects that won't happen, in part because of industry politics and in part for regulatory reasons—FERC has both a measuring stick to gauge compliance and a rod to punish failures. Other industries have fewer cyber­security rules.

Johnson from NERC says that his organization has had only generic talks about cybersecurity with the chemical industry. But its CIP standards have caught the attention of the nuclear power industry and the water sector, both of which are interested in how the standards came about. It may be that Bugh and his drafting team have created a landmark in cybersecurity that will ripple beyond the electric power industry. n

Michael Fitzgerald is a freelance writer based near Boston.