Legislative auditors reported to lawmakers on Tuesday that Utah's municipal power systems show significant opportunities for improvement in their cybersecurity protocols. The audit highlights a potential vulnerability for critical infrastructure such as hospitals, drinking water and sewage treatment systems, schools, and transportation, which could face longer-lasting power outages if a cyberattack were to occur.
Auditors noted that municipal power systems, which provide approximately 16% of Utah's electricity, have not consistently implemented robust cybersecurity practices. Specifically, none of the five municipal power systems interviewed by auditors used independent third-party assessments to evaluate their cybersecurity controls. Furthermore, these systems did not develop, document, or regularly practice incident response plans, according to the audit.
This finding is concerning, auditors wrote, referencing the 2015 Russian cyberattacks on Ukraine's power grid, which impacted 225,000 customers. Such cyberattacks have the potential to disrupt electricity delivery and can open the door to future attacks on power systems. While the audit suggests that the impact on individual municipal power systems is generally limited unless simultaneous attacks occur, the absence of incident response plans could contribute to prolonged disruptions.
In contrast, Rocky Mountain Power, Utah’s largest electricity provider, which sells about 78% of the state’s electricity, was found to have "mature" cybersecurity tools. However, legislative auditors determined that direct federal and state supervision on these protocols is limited. The only state agency overseeing cybersecurity for Rocky Mountain Power is the Utah Public Service Commission, and its governance is primarily limited to rate-setting processes.
Rocky Mountain Power addressed the audit in its response, stating the company takes cybersecurity seriously and is dedicated to maintaining a strong, resilient, and continuously evolving cybersecurity program designed to protect critical electric infrastructure and support reliable service to customers. The company also indicated that it believes the report provides a fair and balanced assessment of its program and its commitment to managing evolving cyber threats.
Auditors clarified that while the federal government regulates cybersecurity for large portions of the electrical grid, including large-scale generation and transmission, states can provide oversight for electricity distribution—the stage where power is delivered to customers at lower voltages. Despite the identified gaps in municipal systems, the audit also acknowledged that utilities administered by municipalities may be able to recover faster from attacks due to their limited service areas and the availability of manual controls at substations.
Amid these findings, legislative auditors recommend that state involvement be considered to encourage municipal power systems to improve their cybersecurity practices. Suggestions included the Cybersecurity Commission or Cyber Center helping to develop model incident response plans, requiring municipalities to adopt baseline cybersecurity controls, or encouraging the adoption of best practices by reducing potential liability for those that comply. The Utah Legislature may consider additional oversight for both Rocky Mountain Power and municipal utilities following these audit findings.
