The New York State Public Service Commission (PSC) has granted the state's largest electric and gas utilities permission to lease or transfer utility property among themselves and other utilities in the United States and Canada in the event of a cyberattack. The initiative, part of the Cyber Mutual Assistance (CMA) program, provides for mutual assistance among utility participants in anticipation of, during, or following a cyber incident through the voluntary lease or transfer of services, labor, or equipment.
"New York is a hub for significant financial, governmental, manufacturing, and transportation infrastructure that has higher than normal risk of cyberattack for either criminal or geopolitical reasons," said Commission Chair John B. Howard. "Our utilities' participation in this type of mutual assistance program is both appropriate and timely in light of the increased recent cyberattacks on critical infrastructure. Being able to recover and return to normal operations as quickly as possible is critical, thus pre-approval of transfers of utility property and equipment under the CMA program is in the public interest."
In its decision, the Commission granted the largest utilities in New York — Consolidated Edison Co. of New York, Inc., Orange and Rockland Utilities, Inc., National Grid, Central Hudson Gas & Electric Corp., New York State Electric & Gas Corp., Rochester Gas & Electric Corp., and National Fuel Gas Distribution Corp. — approval to lease or transfer utility property to participants of the CMA program. In addition, New York electric and gas utilities that join the CMA program were also granted approval to lease or transfer utility property to participants of the CMA program.
The Commission said the utilities' participation in the CMA program will not adversely affect their provision to provide safe and reliable service as the program participants are under no obligation to respond to assistance requests. Pre-authorization of utility equipment leases or transfers allows the larger utilities to respond to cyber events under the CMA program at the time the assistance is needed, without having to wait for approval by the Commission.
Utility mutual assistance programs, which enable the program participants to share critical resources to facilitate timely recovery following storms or other natural disasters, are a longstanding energy industry practice. The CMA program is an extension of the tradition of mutual assistance through collective emergency response. The program was developed to counter the increasing and evolving threats to the cybersecurity of energy infrastructure. While traditional utility mutual assistance programs are usually coordinated at regional or state level, the CMA program allows utilities across the United States and Canada to share critical resources and equipment during and/or in recovery from a cyberattack event. The membership comprises most of the major New York State electric and gas utilities and more than 155 other entities, including gas and electric utilities, regional transmission organizations, and independent system operators.
When responding to a cybersecurity incident, the utilities can request assistance in the form of services, equipment, and/or personnel. A member may request certain tools or equipment to aid in the response to the incident itself, or request equipment to replace the damaged or compromised ones during a cybersecurity incident. Under the CMA program, the participants directly impacted by a cybersecurity event are not obligated to request or receive assistance. Similarly, utilities are not required to respond to requests for assistance or to provide such assistance.
The recent decision may be obtained by going to the Commission Documents section of the Commission's website and entering Case Number 21-M-0106 in the input box labeled Search for Case/Matter Number.
