Protecting the electric grid is becoming more complex as the size of the grid continues to grow, and cybersecurity threats are increasing in number and becoming more sophisticated. To meet these emerging threats, states and territories are working to support critical infrastructure protection through several means, including bolstering cybersecurity, supporting physical security improvements, and increasing information sharing across the public and private sectors, among others. A key tool to developing stronger information sharing pathways between states and territories with critical infrastructure owners and operators is through critical energy infrastructure information[1] (CEII) laws. By having these protections in place, it may enable energy providers to share information with states and territories that if otherwise made public, may increase the risk to infrastructure.
Building off of NGA’s 2019 publication on State Protection of CEII, this 55-state and territory map provides an update and overview of state/territory statutes, court rulings, and other relevant actions states and territories have taken to protect CEII and other critical infrastructure information[2] (CII) from public disclosure.
State Protections of Critical Energy Infrastructure Information
In the map above, you can review the provision in each state and territory that relates to protecting critical energy infrastructure information by clicking on one of the highlighted states or territories. Based on the review conducted, NGA is not aware of statutory protections for CEII in the blank states or territories. Please contact Jenna Johnston (jjohnston@nga.org) and Dan Lauf (dlauf@nga.org) with any questions, corrections, or if your state or territory has information you’d like to have added.
CEII and CII laws help to facilitate critical information for key preparedness and response activities such as executing joint table-top exercises and facilitating intelligence sharing through fusion centers, among others. Information and intelligence sharing provides a community-wide benefit, across all utilities, to be able to identify threats, address gaps, and minimize impacts in a timely fashion. In enacting state-level legislation or regulation, states and territories can help facilitate the establishment of secure communication channels between energy providers, regulatory agencies, and local authorities by safeguarding CEII. These laws can play a factor in fostering stronger information pathways between public and private sector entities. These efforts can also be further bolstered by establishing and communicating internal state data handling standards or standard operating procedures. Doing so helps energy companies better understand how information is secured. Additional strategies to build trust include inviting utilities to participate in fusion center liaison programs and ensuring information requests to utilities are narrowly scoped with a focus on areas addressing potential community impacts.
Most states and territories have laws or regulations in place that exempt CEII, or security-related information of critical infrastructure more broadly, from being released through public disclosure requests. States and territories value the importance of public transparency and so these exemptions typically only cover records that could compromise the security of critical infrastructure, primarily focusing on energy, water, and telecommunications systems, and minimize their exposure to potential physical or cyber threats. These records may include blueprints, vulnerability assessments, contingency plans, and information technology (IT) details. The statutes and other actions usually make it incumbent upon the state/territory agency to justify why the information should be exempt from public disclosure, and they also vary in whether it only applies to public-owned infrastructure or infrastructure more broadly.
As shown on the map:
- Thirty-four states and two U.S. territories have adopted statutory exemptions for critical infrastructure security information disclosure.
- Some states such as Alabama directly reference the Federal Energy Regulatory Commission (FERC) definition of CEII, 18 C.F.R. § 388.113. Many states, while not directly citing the FERC definition, describe critical energy infrastructure in similar terms, while others utilize broader language to cover more critical infrastructure.
- Three states (Oklahoma, South Carolina, and Texas) provide statutory exemptions for critical infrastructure security information submitted or discussed as part of the work of the state public utility commission.
- Two states (Hawai’i and Washington) have established case law that interprets their state statutes to protect critical infrastructure security information from public disclosure.
- While not specifically excluding critical infrastructure information from disclosure, states and territories have also taken other actions to protect critical infrastructure information:
- Maryland statutorily directs the state energy office to, among other duties and responsibilities, collect, analyze, and maintain data related to managing any energy emergency or shortfall on a confidential basis to preserve the confidentiality of the source.
- Minnesota has statutorily protected some energy data, statistics, and information provided to the Department of Commerce by a coal or petroleum supplier, or any other data that would identify individual business customers of a public utility.
While many states and territories have statutes in place that protect CEII from public disclosure, it is important to build and maintain a strong relationship between key stakeholders, such as the Governor’s office, state energy office, private utilities, public utility commission (PUC), and other relevant entities to foster secure information sharing and protection. Building trust and confidence among these entities can promote an environment that results in quicker threat identification and response to help reduce service interruption and increase energy security and resiliency.
The National Governors Association Center for Best Practices (NGA Center) thanks the National Association of Regulatory Utility Commissioners (NARUC), National Association of State Energy Officials (NASEO), and the National Conference of State Legislatures (NCSL) for their partnership and contributions to this research. The authors thank the U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response for its support of this publication. The authors thank each of the states and territories for their review and feedback.
[1] The Federal Energy Regulatory Commission defines CEII as, “engineering, vulnerability, or design information about proposed or existing critical infrastructure (physical or virtual) that relates details about the production, generation, transmission, or distribution of energy; could be useful to a person planning an attack; and gives strategic information beyond the location of critical infrastructure.”
[2] 6 USC § 650 defines Critical Infrastructure Information as, “information not customarily in the public domain and related to the security of critical infrastructure or protected systems- (A) actual, potential, or threatened interference with, attack on, compromise of, or incapacitation of critical infrastructure or protected systems by either physical or computer-based attack or other similar conduct (including the misuse of or unauthorized access to all types of communications and data transmission systems) that violates Federal, State, or local law, harms interstate commerce of the United States, or threatens public health or safety; (B) the ability of any critical infrastructure or protected system to resist such interference, compromise, or incapacitation, including any planned or past assessment, projection, or estimate of the vulnerability of critical infrastructure or a protected system, including security testing, risk evaluation thereto, risk management planning, or risk audit; or (C) any planned or past operational problem or solution regarding critical infrastructure or protected systems, including repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to such interference, compromise, or incapacitation.”
This material is based upon work supported by the Department of Energy under Award Numbers DE-CR0000008 and DE-CR0000011.
This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.
