National Lab Recommends Energy Department Test Electric Utility Vendors for Cybersecurity

The Pacific Northwest National Laboratory recommends the Energy Department review the cybersecurity maturity of power utility vendors rather than ban those tied to China—a move supported by a wide range of other stakeholders.

Comments the Pacific Northwest National Laboratory submitted to the Department of Energy bolster those from industry groups and nonprofits urging the administration to work on increasing the supply of appropriate equipment instead of simply banning vendors tied to China.

“Eliminating weakness and vulnerabilities in the factory, so they don’t have to be tested and discovered after they are already in the field, will improve our nation’s security posture,” read comments from the national lab. “PNNL recommends that DOE work with vendors to improve the secure product lifecycle. This can be enhanced to create a realistic and usable best practice guide for all sizes of vendors. Strengthening products in the supply chain that the utilities use is critical.”

The comments were among those Energy published Monday in response to a request for information the administration issued April 20. The RFI sought feedback on how the administration should approach securing the energy sector after revoking a prohibition order issued under former President Donald Trump. The 2020 Trump order aimed at securing the bulk power system (BPS) gave Energy the authority to ban regulated entities from acquiring equipment from entities connected to foreign adversaries.  

Groups including the U.S. Chamber of Commerce, the Solar Energy Industry Association, American Public Power Association and the National Rural Electric Cooperative Association all praised Biden’s revocation of the order.

“Today, the level of uncertainty with the trading relationship with some countries, such as China coming from the federal government has created long term instability within U.S supply chains,” SEIA wrote. “The 2020 BPS EO created mass confusion, impacted buying and logistics decisions across the industry and had a chilling effect on security and operational activities, though this did not seem to be the objective. If DOE and other agencies believe major supply chain security concerns cannot be mitigated, a long-term strategy focused on increasing domestic supply chain capabilities is the appropriate solution, not broad prohibition orders.”

The Chamber noted that the BPS order was made without a public comment period for stakeholder input and said, going forward, “rip-and-replace” orders such as one the Federal Communications Commission is imposing against Huawei and ZTE, should be a last resort. 

“Mitigation can often provide a more rapid and cost-effective reduction of the associated risk,” the Chamber wrote. “As such, mitigation strategies should be evaluated and exhausted before any ‘rip-and-replace’ mandate is implemented.” 

Together with allied groups, the National Rural Electric Cooperative Association argued that operators have little control over their suppliers’ cybersecurity and worried they wouldn’t have the resources necessary to scrutinize their suitability.

“The electric utility industry’s ability to influence the security measures undertaken by industry suppliers is limited, and particularly so for smaller utilities,” the NRECA and others wrote. “The Associations are concerned that utilizing this concept, even with more clarification from DOE, would create a substantial cost burden both directly on utilities for having to track country of origin for products and components, and indirectly through increased vendor costs due to the same requirements.”

The groups acknowledged the operators’ suppliers are outside regulators’ reach, but recommended the department use its influence and resources to identify appropriate vendors. 

“Though vendors are outside the direct authority of the Federal Energy Regulatory Commission and the North American Electric Reliability Corporation, DOE may use its influence to affect supplier practices by encouraging suppliers to adopt shared security practices, and to foster security certification upon which the industry can rely,” the associations wrote. “DOE could assign ‘risk scores’ for equipment and components serving the bulk power system to provide utilities with consistent information when procuring equipment.”

PNNL’s recommendations for Energy would support that effort. The lab said the department should work with vendors to assess their maturity. The vendors would then be able to tout positive results of their assessments in marketing materials and the activity could form the foundation for minimum vendor standards down the road, the lab wrote.