DOE launches 100-day grid security push as Biden ends Trump ban on some Chinese-made equipment

Dive Brief:

The U.S. Department of Energy and the Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday announced a 100-day plan to address "persistent and sophisticated threats" to the nation's electric grid, including a "voluntary industry effort" to deploy technologies to secure industrial control system (ICS) and operational technology (OT).
DOE also announced it is revoking a prohibition order issued in 2020, that blocked utilities supplying critical defense facilities from procuring some types of bulk power system equipment from China.
And, the agency has issued a new Request for Information (RFI) seeking recommendations for securing U.S. energy system supply chains. The RFI will focus on "preventing exploitation and attacks by foreign threats," according to DOE, and is part of a larger, coordinated effort to secure energy sector supply chains.

Dive Insight:

Electric utilities say they welcome the White House's new cybersecurity push to secure ICS technology, "given the sophisticated and constantly changing threats."

"We view cybersecurity as a shared responsibility between industry and government," Tom Kuhn, president of the Edison Electric Institute (EEI), said in a statement. The group represents investor-owned utilities.

EEI and its member companies coordinate on security issues through the CEO-led Electricity Subsector Coordinating Council (ESCC), said Kuhn.

"The ICS effort announced today is complementary to other ESCC initiatives already underway, and shows the industry's willingness to collaborate on new, creative approaches that enhance security," he said. "The White House is leading the effort — in close coordination with the private sector and its partners."

Those partners include DOE's Office of Cybersecurity, Energy Security, and Emergency Response (CESER).

Outlining its security initiative, DOE said that over the next 100 days CESER "will continue to advance technologies and systems that will provide cyber visibility, detection, and response capabilities for industrial control systems of electric utilities."

DOE also said the initiative:

encourages implementation of measures or technology that enhance "detection, mitigation, and forensic capabilities";
includes "concrete milestones" for identification and deployment of technologies and systems "that enable near real time situational awareness and response capabilities" in ICS and OT networks; and
includes a "voluntary industry effort" to improve visibility of threats in ICS and OT environments.

"This partnership with the Department of Energy to protect the U.S. electric system will prove a valuable pilot as we continue our work to secure industrial control systems across all sectors,” CISA Acting Director Brandon Wales said in a statement.

Experts say there is a growing recognition grid control systems can make the power system vulnerable to hackers. In January, Biden suspended President Donald Trump's Executive Order 13920 that blocked the installation of bulk-power system equipment "designed, developed, manufactured, or supplied, by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary."

The 90 day suspension is now up and the order is back in effect.

DOE said it will use comments from the RFI to to "evaluate new executive actions to further secure the nation's critical infrastructure against malicious cyber activity and strengthen the domestic manufacturing base."

While recommendations are being developed, however, DOE said it expects "utilities will continue to act in a way that minimizes the risk of installing electric equipment and programmable components that are subject to foreign adversaries' ownership, control, or influence."