FERC has created an Office of Energy Infrastructure Security (OEIS). According to FERC, the new office will concentrate in four areas:
- Developing recommendations for identifying, communicating and mitigating potential cyber and physical security threats and vulnerabilities to FERC-jurisdictional energy facilities using the Commission’s existing statutory authority;
- Providing assistance, expertise and advice to other federal and state agencies, jurisdictional utilities and Congress in identifying, communicating and mitigating potential cyber and physical threats and vulnerabilities to FERC-jurisdictional energy facilities;
- Participating in interagency and intelligence-related coordination and collaboration efforts with appropriate federal and state agencies and industry representatives on cyber and physical security matters related to FERC-jurisdictional energy facilities including, but not limited to, participating in conferences, workshops and classified briefings; and
- Conducting outreach with private sector owners, users and operators of energy delivery systems regarding identification, communication and mitigation of cyber and physical threats to FERC-jurisdictional energy facilities.
In announcing the new OEIS on September 20, 2012, FERC Chairman Jon Wellinghoff said, “Because of the widespread effects and serious consequences that a successful cyber or physical security event may bring, it is important that swift, consistent, and effective action be taken by entities to prevent such attacks.”
According to Tim Tobin, a partner in Hogan Lovell’s Privacy and Information Management area, “FERC’s action coincides with increasing attention on cybersecurity issues from all quarters, including signals from the White House that it may soon sign an Executive Order to protect the nation’s critical computer infrastructure in the wake of Congress’ failure to enact cybersecurity legislation this Summer.”