The federal government regulates cybersecurity for large portions of the electrical grid, including large scale generation and transmission,” auditors wrote.
However, unlike large-scale electricity providers, municipal power systems — which provide about 16% of Utah’s electricity — have opportunities for improvement in issues, auditors wrote.
None of the five municipal power systems auditors interviewed used independent third-party assessments to evaluate their cybersecurity controls.
“While attacks can be disruptive, the impact on municipal power systems is generally limited to individual power systems unless simultaneous attacks occur,” according to the audit.
Amid those gaps, legislative auditors recommend looking into whether state involvement is necessary “to encourage municipal power systems to improve cybersecurity practices.”