Finding
The grid's cyber risk has moved from IT break-ins to pre-positioned access in operational networks and in imported devices that utilities cannot inspect
Ukraine proved malware can black out a grid: BlackEnergy in 2015 and Industroyer in 2016, both attributed to Russia's Sandworm. In the US, CISA reported in 2024 that the China state actor Volt Typhoon had pre-positioned in critical infrastructure networks, including the Littleton Electric Light and Water Departments in Massachusetts, for disruption in a future conflict rather than for data theft.
The device supply chain is the newer problem. Grid-scale and rooftop inverters from Huawei, Sungrow and other Chinese makers communicate with vendor clouds, and in 2025 US investigators reported undocumented communication devices in some Chinese inverters and batteries. Texas's Lone Star Infrastructure Protection Act (2021) already bars grid access contracts with companies tied to China, Russia, Iran and North Korea, and several states and utilities now restrict remote access to inverters.
Regulation is catching up inside the fence: FERC approved NERC CIP-015 in 2025, requiring internal network security monitoring at high- and medium-impact sites, on top of CIP-014 for physical security. China runs its own regime, the Multi-Level Protection Scheme (MLPS 2.0), and State Grid controls its dispatch stack end to end through NARI. Vehicle and charger security is covered on Software-Defined Systems Security.
Layers
Defense layers
From field devices to the security operations center; outlook through the end of the decade.
| Layer | Controls | Function | Outlook |
|---|---|---|---|
| Devices | Secure IEDs, RTUs, PMUs and meters; signed firmware | Hardware trust, tamper resistance | Slow; tied to hardware refresh, legacy devices stay exposed |
| Network | Segmentation, firewalls, IEC 62351, zero trust | Isolates OT from IT, secures SCADA and DER links | Rapid adoption driven by IT/OT convergence |
| Control systems | SCADA, EMS, ADMS, DERMS with role-based access and logging | Authenticated operations | Upgraded with platform replacements |
| Monitoring | OT intrusion detection, SIEM, anomaly detection: Dragos, Claroty, Nozomi Networks | Finds intruders already inside | Strong growth; mandated by CIP-015 |
| Remote access to DER | Vendor cloud controls, inverter communication limits | Stops fleet-wide remote commands | New; state and utility rules spreading |
| Governance | NERC CIP, DOE C2M2, ISO 27001 | Minimum controls and audits | Mandatory for North American bulk power operators |
Rules
Rules and frameworks
| Rule | Who | Requires |
|---|---|---|
| NERC CIP-002 to CIP-013 | North American bulk power operators | Asset categorization, access control, incident response, supply chain risk management |
| NERC CIP-014 | Critical transmission substations | Physical security assessments and plans (after Metcalf, 2013) |
| NERC CIP-015 | High- and medium-impact sites | Internal network security monitoring |
| IEC 62351 | Protocol vendors | Authentication and encryption for IEC 61850 and DNP3 |
| Lone Star Infrastructure Protection Act | Texas grid | Bars access agreements with companies tied to China, Russia, Iran, North Korea |
| MLPS 2.0 | China | Tiered security protection for critical information infrastructure |
Bottlenecks
What slows grid security
| Bottleneck | Constraint | Impact |
|---|---|---|
| Legacy devices | Millions of field devices that cannot be patched | Permanent attack surface |
| Imported devices | Inverters, batteries and modules with vendor cloud links | Hard to audit; remote command risk |
| Standards overlap | IEC, IEEE, NERC and ISO frameworks | Slows vendor adoption |
| Workforce | Few OT security engineers | Delayed deployments and audits |
| Data volume | PMU, AMI and DER telemetry | Strains monitoring budgets |
Sources
Sources and scope
- Scope
- Grid Cybersecurity
- Sources
- CISA advisories on Volt Typhoon (2024); Dragos; ESET and SANS reports on Ukraine; Reuters (May 2025); FERC and NERC; Texas SB 2116
- Updated
- October 2026