Audit: none of five Utah municipal power systems had cyber incident response plans

None of the five municipal power systems that legislative auditors interviewed had developed, documented or regularly practiced a cybersecurity incident response plan, according to an audit presented to lawmakers Tuesday, Utah News Dispatch reported. None used independent third-party assessments to evaluate their cybersecurity controls either. ^[1]

The audit called the cybersecurity tools of Rocky Mountain Power, which sells about 78% of Utah's electricity, "mature." Auditors said the Utah Public Service Commission is the only state agency overseeing its cybersecurity, and only through its rate-setting process. They noted that the federal government regulates large parts of the grid, including large-scale generation and transmission. The company said in its response that it takes cybersecurity extremely seriously and called the report a "fair and balanced assessment." ^[1]

Municipal systems supply about 16% of the state's power. Without incident response plans, auditors wrote, outages could last longer and affect hospitals, drinking water and sewage treatment, schools and transportation. They also noted that municipal utilities serve limited areas and may recover faster if they have manual controls at substations, and that attacks on municipal systems are generally limited to individual systems unless they happen simultaneously. Auditors cited the 2015 cyberattacks on Ukraine's power system, which affected 225,000 customers. ^[1]

Auditors recommended that the state examine whether it should get involved. Options include having the Cybersecurity Commission or Cyber Center help develop model incident response plans, requiring baseline cybersecurity controls for municipalities, or reducing liability for systems that adopt best practices. ^[1]