How Does NERC Protect North America's Power Grid?

TL;DR

NERC protects North America's power grid through mandatory standards, rapid information sharing, and industry-wide training exercises. Its approach combines enforceable cyber, physical security, and reliability requirements with programs such as CRISP and CAISS, plus Grid Security Conference training and the Grid X simulation, to help organizations prepare for cyberattacks, physical attacks, severe weather, and catastrophic outages.

Transcript

Hi, my name is Mark Sox. I'm the Chief Security Officer at the North American Electric Reliability Corporation, also known as NERC. We are the organization that, as we like to say, that keeps the lights on in North America. So we have multiple roles. Uh, we do reliability of the grid as well as security of the grid. I'm gonna talk a little bit toda... Read More

Key Insights

• The North American power grid is a large interconnected machine that links generation, transmission, local distribution organizations, and electricity users. Its generators operate at sixty hertz and must remain synchronized across each major interconnection to support reliable electricity delivery.
• NERC is the Electricity Reliability Organization responsible for mandatory and enforceable grid reliability standards. Its congressionally mandated role began in 2006 and covers reliability, cybersecurity, and physical security requirements for the power sector.
• NERC's standards are developed collaboratively by the organization, power companies, outside individuals, federal government participants, and researchers. This shared process brings operational, governmental, and technical perspectives into requirements designed to keep the grid secure and reliable.
• International grid incidents are sources of practical security lessons for North America. NERC monitors overseas events, including the December 2015 events in Ukraine, because foreign grids can use many of the same components found in the United States and Canada.
• CRISP is the Cyber Risk Information Sharing Program, which pools technical threat and vulnerability data from several dozen companies. NERC uses this information to provide early warnings and can share resulting insights with municipalities, rural utilities, and other small distribution companies.
• CAISS is the Cyber Automated Information Sharing System, a relatively low-cost program based on STIX and TAXII. It rapidly distributes indicators and information concerning observed cyber and physical security issues through structured information exchange.
• Grid Security Conference is NERC's annual forum for training, awareness, and knowledge sharing. Hundreds of experts from the United States and Canada gather to discuss organizational experiences, lessons learned, security developments, vendors, and new products during the week-long conference.
• Grid X is a two-day distributed simulation held every other year to test responses to hypothetical grid damage. Scenarios can involve cyberattacks, physical attacks, weather, isolated grid sections, and catastrophic outages requiring coordination among operators, law enforcement, federal agencies, and the National Guard.

Questions & Answers

Q: How does NERC protect North America's power grid?

NERC protects the grid through three primary areas: mandatory and enforceable standards, technology-supported information sharing, and training. Its Critical Infrastructure Protection standards address cyber and physical security, while its broader responsibilities also cover reliability. CRISP and CAISS distribute information about threats, vulnerabilities, and indicators. Grid Security Conference and Grid X help organizations learn, train, and practice coordinated responses to major disruptions.

Q: How does electricity move through the North American power grid?

Electricity begins at generating facilities such as dams, nuclear power plants, and gas turbines. The generators produce power at a standard frequency of sixty hertz and send it into the transmission system. Transmission operators move that energy across large networks and deliver it to municipal utilities, large service providers, or rural cooperatives. Those local organizations then supply homes, businesses, factories, and other electricity users.

Q: Why must generators across an interconnected grid stay synchronized?

Generators within the interconnected North American system operate at sixty cycles and must remain in phase with one another. That means electricity generated in places such as Florida, Iowa, or Ottawa must work together as part of the same large machine. Synchronization supports the coordinated movement of power from generation through transmission and distribution, allowing numerous organizations across the United States and Canada to operate an international electricity system.

Q: What authority does NERC have over grid reliability and security?

NERC was given its reliability mission in 2006 and is known as the Electricity Reliability Organization. Under a mission established in federal statute and mandated by Congress, it has authority to develop mandatory, enforceable standards. These requirements cover grid reliability, cybersecurity, and physical security. NERC describes the Critical Infrastructure Protection standards as unique mandatory requirements for this critical infrastructure sector and notes that they have improved through multiple versions.

Q: What is the Cyber Risk Information Sharing Program?

The Cyber Risk Information Sharing Program, known as CRISP, pools technical information from several dozen participating companies. The collected data concerns threats and vulnerabilities directed toward those organizations or otherwise relevant to grid security. NERC analyzes the information to provide early warning to participating companies. Findings can also benefit municipalities, rural organizations, and other small distribution companies by sharing what larger companies are observing.

Q: What is NERC's Cyber Automated Information Sharing System?

The Cyber Automated Information Sharing System, or CAISS, is NERC's structured program for rapidly exchanging security information. It is based on STIX and TAXII formats and is presented as a relatively low-cost method for sharing indicators and observations. The system supports the rapid dissemination of information about cyber and physical security issues, complementing the work of automated systems, sensors, analysts, and participating organizations.

Q: How does the Grid X exercise prepare organizations for outages?

Grid X is a two-day distributed simulation that NERC conducts every other year. Organizers use grid information to create hypothetical scenarios involving damage, isolated sections, cyberattacks, physical attacks, or weather-related events. Participating companies test what they can do locally and how they coordinate with grid operators, law enforcement, the federal government, the National Guard, and others who would respond to a catastrophic power outage.

Q: What role does training play in NERC's security strategy?

Training helps grid organizations share lessons, build awareness, and practice responses before real emergencies occur. NERC's annual Grid Security Conference brings together hundreds of experts from the United States and Canada for a week of discussions, training, vendor participation, and product awareness. Grid X adds operational practice through simulated disruptions, allowing utilities and government partners to examine their local actions and broader coordination during severe incidents.

Summary & Key Takeaways

• North America's power system is a vast interconnected machine that moves electricity from generators through transmission networks to local utilities, homes, businesses, and factories. Major regional grids operate at sixty hertz, requiring generators across each interconnected system to remain synchronized while many organizations coordinate the reliable delivery of electricity.

• NERC serves as the Electricity Reliability Organization under a congressionally mandated mission established in 2006. It collaboratively develops mandatory, enforceable standards covering reliability, cybersecurity, and physical security. Power companies, government agencies, researchers, and other participants contribute to these standards and exchange information about threats, vulnerabilities, engineering practices, and international incidents.

• NERC supplements standards with information-sharing technology and practical training. CRISP collects technical threat and vulnerability data from participating companies, while CAISS uses STIX and TAXII formats to distribute indicators rapidly. Grid Security Conference supports professional learning, and the two-day Grid X simulation tests coordinated responses to hypothetical cyber, physical, and weather-related disruptions.