The report highlights actions governors can take to better prepare their state for a potential prolonged and widespread electrical power outage.
(Download)
Executive Summary
The electrical power grid is the backbone of the U.S. economy and society, with most goods and services depending on its safe, secure and reliable operation. Increasingly, natural and human-made hazards pose risks to the grid, some of which could lead to lasting and widespread outages. Although improbable, such disruptions would have a substantial effect and result in the failure of other critical infrastructure sectors such as water, transportation, financial services and communications; endanger the health and well-being of the public; and lead to considerable economic losses. Most states have energy assurance plans in place to address energy system disruptions, but few contemplate an extreme power grid outage. Governors can play a unique role in preparing their states for such an incident by recognizing and planning for the specific threats that face their state, coordinating with key players and communicating plans with the public.
Recognizing the potential threat to states, the National Governors Association Center for Best Practices (NGA Center) in 2014 and 2015 convened roundtables of states and subject matter experts to identify the cascading effects of a prolonged and widespread electrical grid disruption. Those discussions also included actions governors can take to help prepare for prolonged, widespread outages and discussed how those preparations could improve responses to less severe outages and enhance resiliency within a state. In 2016, the NGA Center hosted state-specific retreats in Washington and Wisconsin to help these states examine their existing plans, identify gaps, develop action plans to address those gaps and ultimately improve their overall planning. This paper captures the recommendations and lessons learned at the experts roundtables and state retreats and presents additional research findings.
Since development of the Pearl Street Station in lower Manhattan in 1882, the U.S. electrical power grid—a collection of three systems that span North America—has grown into a complex network of more than 300,000 miles of interconnected distribution and high-voltage transmission lines delivering power to customers from more than 7,200 large power generation plants.1 Private companies typically own the grid, and more than 2,000 electric utilities are responsible for its operation. Regulatory and market oversight authority is split between state public utility commissions, regional transmission operators and federal agencies such as the Federal Energy Regulatory Commission.
The power grid generally functions well, but threats to reliable power delivery and the risks associated with a prolonged and widespread grid outage in the United States are becoming more pronounced for several reasons:
- Weather and other natural disasters are becoming more frequent and severe;
- The grid is becoming increasingly digitized, opening utility systems to cyberattacks;
- Critical infrastructure remains vulnerable to physical attack;
- Threats from natural and human-produced electromagnetic disturbances have grown; and
- Human error and other threats continue to be factors.
Although it varies by region, the electrical grid is largely privately owned. Governors are responsible for the safety and security of the people and industries in their state. Therefore, governors, alongside the private sector and local and federal government, play a key role in planning for, responding to and recovering from an outage. In addition to existing efforts directed at less severe outages, governors can take the following actions to better prepare their state for a potential prolonged and widespread outage:
- Determine the potential risks to and consequences for the state;
- Identify the plans currently in place and determine whether they are sufficient;
- Ensure that plans consider the effects of grid outages on other critical infrastructure;
- Enhance stakeholder preparedness by conducting joint exercises;
- Define roles and responsibilities clearly and appropriately;
- Understand and communicate the process for restoring power;
- Determine the capacity for backup generation and address limitations; and
- Develop a strategy for communication with the public and key players.
March 2024
Addendum
Energy is critical to all facets of modern life, with individuals, businesses and critical infrastructure systems relying on a steady flow of electricity and fuel. Disruptions to electric power can be dangerous and damaging to the economy, public health and safety. The impacts of an electrical outage are compounded during an extreme, prolonged outage. In 2016, NGA released a resource titled “Preparing States for Extreme Electrical Power Grid Outages” discussing strategies Governors can take to prepare their state or territory for a potential prolonged and widespread electrical outage. While there is no single definition of an extreme electrical power outage, the paper identifies an extreme outage as lasting for multiple weeks, causing a high percentage of customers to lose power, spanning a large geographical area, impacting other critical infrastructure and causing severe physical damage to the electrical grid. Not only has the threat environment continued to increase, but the supply chain to restore services to the grid has also become more constrained. For example, the Department of Energy estimates that large power transformers could take years to replace following an incident, underscoring the need to protect current assets. While the recommendations to Governors from the 2016 paper remain relevant, new resources have been released and actions have been taken that can further inform or support Governors’ efforts to prepare for a potential extreme outage.
Since the publication of NGA’s 2016 paper, the threats of natural disasters and malicious attacks on critical infrastructure have grown, and there has been a notable increase in the number of cyberattacks and physical attacks on energy infrastructure:
Cyberattacks
- In May 2021, a ransomware attack on the Colonial Pipeline infected the data and information technology (IT) systems of the pipeline, leading operators to preemptively shut down the pipeline for multiple days out of an abundance of caution, protecting operational systems but also leading to consumer panic buying that resulted in fuel supply concerns.
- The use of cyberattacks on critical infrastructure during the Russian war in Ukraine has raised concerns for the National Security Agency (NSA).
- In February 2024, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the NSA released a joint assessment highlighting that People’s Republic of China state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure, including the energy sector.
Physical Attacks
- In 2022, there were multiple high-profile physical attacks on substations across the United States, including in North Carolina and Washington. According to the U.S. Department of Energy (DOE), physical attacks on the grid increased 77% to 163 incidents from 2021 to 2022. While none of these events led to an extreme outage, a more robust or coordinated attack could cause a major disruption.
Severe Weather
- Since 2016, many major weather events have caused electrical outages, including extreme outages in Puerto Rico and the U.S. Virgin Islands (USVI) in 2017. Hurricanes Irma and Maria, respectively category five and four hurricanes that occurred within two weeks of one another, caused catastrophic damage to the electrical grids in Puerto Rico and USVI. The hurricanes caused numerous deaths, severely damaged infrastructure, and caused electricity and cellular service outages for an extended period of time. Hurricane Maria caused the longest power outage in U.S. history; in Puerto Rico, power was knocked out to all 1.5 million customers and was not fully restored for 11 months.
- In 2022, Hurricane Fiona hit Puerto Rico and once again knocked out power to 100% of the electrical grid. While devastating, the storm did not have as catastrophic of an effect on Puerto Rico as the 2017 hurricanes did. Two weeks after Hurricane Fiona made landfall, over 90% of customers had restored power.
- In 2023, Typhoon Mawar hit Guam as a Category 4 typhoon—the strongest to hit the territory in over 20 years. As a result of investments to strengthen the grid, such as converting wooden power line poles to concrete, energy was able to be restored to more than 90% of the territory within 5 weeks.
- In August 2020, a Derecho storm swept across the Midwest causing major damage and power outages in Illinois, Indiana, Iowa, Michigan, Ohio, Nebraska, South Dakota and Wisconsin. Nearly two million customers lost power during the thunderstorms between August 10 through 13. Although the outage was not an extreme duration (most customers regained power within seven to 10 days), the 2020 Derecho caused catastrophic damage to the health, safety and economies of the affected states.
- As evidenced by the 2020 derecho storm, severe weather events with the potential to cause extreme outages are not limited to coastal states or islanded territories. According to the National Oceanic and Atmospheric Administration, the frequency of billion-dollar disasters in the United States is on the rise. The Fifth National Climate Assessment also highlighted that the United States now experiences on average a billion-dollar weather or climate disaster every three weeks. In addition, these severe storms are occurring in irregular locations and outside of the traditional time-bounds of storm seasons.
Federal Funding Opportunities for Grid Resilience and Energy Security
Recent federal legislation has created large funding opportunities for states and territories to advance energy security. In 2021, the Infrastructure Investment and Jobs Act (IIJA) was signed into law, containing robust funding for grid hardening and modernization, cybersecurity and resilience. Hardening the grid and increasing the cybersecurity of grid infrastructure are key strategies to reducing the likelihood and mitigating the effects of an extreme electrical outage. Pertinent grid hardening and security programs include:
- The U.S. Department of Energy (DOE) Building a Better Grid Initiative, which includes the following programs, among others:
- $10.5 billion for the Grid Resilience and Innovation Partnerships (GRIP) program
- $2.5 billion for the Grid Resilience State/Tribal Formula Grant Program (also referred to as 40101(d))
- $2.5 billion for the Transmission Facilitation Program
- $250 million for DOE’s Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance (RMUC) Program
- The Federal Emergency Management Agency’s Building Resilient Infrastructure and Communities Program
- The DHS Cybersecurity and Infrastructure Security Agency’s State and Local Cybersecurity Grant Program
Detailed information about these and other programs can be found on NGA’s IIJA Implementation Resources page.
State Energy Security Planning (IIJA Section 40108)
Governors should be aware of the IIJA provision Section 40108 that elevated State Energy Security Plans (SESPs) to include a Governor’s review and certification. This provision requires states and territories submit State Energy Security Plans to DOE by the end of the federal fiscal year until the sunset of the law (October 31, 2025) as a condition of eligibility to receive funding from the U.S. Department of Energy (DOE) State Energy Program (SEP). According to additional guidance states and territories have received from DOE following their 2024 State Energy Security Plan submissions, “delivery of applicable FY25 federal financial assistance to a state or territory may be delayed or withheld under Part D of Title III of EPCA, if a fully compliant SESP is not received and verified by DOE.”
The DOE reviews these plans to ensure they fully address the six Congressionally-defined elements:
- An overview of all energy sources and regulated or unregulated energy providers;
- A state energy profile including production, transmission, distribution and end-use energy estimates;
- An assessment of potential hazards to each energy sector or system, including physical and cybersecurity threats and vulnerabilities;
- A risk assessment of energy infrastructure and cross-sector interdependencies;
- A risk mitigation strategy; and
- Regional, tribal (if applicable), and multi-state coordination plans as well as mutual assistance.
Once a state or territory has fully addressed all six elements, a Governor’s certification letter may be sent to DOE in lieu of a plan. The IIJA provides an additional $500 million to State Energy Offices via the State Energy Program (SEP) in addition to funding provided through the annual appropriations process.
Energy Security Planning is an important way for states to coordinate the many public and private entities with a role in ensuring energy reliability and resilience against threats to energy infrastructure. In addition to regularly updating their State Energy Security Plans, many states and territories are supplementing those efforts by engaging in in-state exercises to test their plans and assess their emergency preparedness.
The U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) has many resources for states and territories, including but not limited to:
- DOE State Energy Security Plan Guidance
- Energy Security Resource hub
- SLTT Program Resource Library | Department of Energy
In addition to these resources, CESER and the National Association of State Energy Officials (NASEO) published an Energy Emergency Response Playbook for States and Territories in May 2022. This resource provides states and territories with best practices for energy emergency planning that could be incorporated partially or fully in their state energy security plans and includes a specific guidance for preparing for and responding to power outages.
New Federal Resources
Multiple reports focused on preparing for and responding to an extreme power outage have been published by federal agencies in recent years.
- In 2017, the U.S. Department of Homeland Security (DHS) Federal Emergency Management Agency (FEMA) released the “Power Outage Incident Annex: Managing the Cascading Impacts from a Long-Term Power Outage.” This resource provides guidance for federal level responders to provide response and recovery support to local, state, tribal, territorial and insular area efforts in the wake of an extreme power outage.
- In 2018, the President’s National Infrastructure Advisory Council released a study entitled “Surviving a Catastrophic Power Outage: How to Strengthen the Capabilities of the Nation.” This report studied the national preparedness for a prolonged and widespread electrical outage, finding existing plans to be ill-equipped to respond to such a crisis. Also in 2018, the Center for Climate and Energy Solutions published a report “Resilience Strategies for Power Outages” that outlines policies state and local governments can adopt to increase the resilience of the electrical grid against outages.
- In 2023, the Cybersecurity and Infrastructure Security Agency (CISA) working with the Resilient Power Working Group (RPWG) developed this document, “Resilient Power Best Practices for Critical Facilities and Sites with Guidelines, Analysis, Background Material, and References,” to provide resilient power best practices for critical facilities and sites.
NGA Resources
2023 Energy Cybersecurity Resources for Governors’ Advisors: NGA recently published an updated energy cybersecurity resource guide that provides an overview of federal and state cybersecurity standards for the energy sector as well as a collection of energy cybersecurity resources from NGA, the federal government, and other state focused organizations.
This addendum was prepared by Fiona Forrester, Policy Analyst, NGA Center for Best Practices. For additional energy assurance and security resources, please reach out to the energy or homeland security program leads at the NGA’s Center for Best Practices: Dan Lauf (dlauf@nga.org) and Jessica Davenport (jdavenport@nga.org).
This material is based upon work supported by the Department of Energy, Office of Cybersecurity, Energy Security, & Emergency Response under Award Number DE-CR0000011. This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.
