TSA Takes Steps to Address Some Pipeline Security Program Weaknesses

The nation's pipelines are vulnerable to cyber-based attacks due to increased reliance on computerized systems. In May 2021 malicious cyber actors deployed ransomware against Colonial Pipeline's business systems. The company subsequently disconnected certain systems that monitor and control physical pipeline functions so that they would not be compromised.
Protecting the nation's pipeline systems from security threats is a responsibility shared by both the Transportation Security Administration (TSA) and private industry stakeholders. Prior to issuing a cybersecurity directive in May 2021, TSA's efforts included issuing voluntary security guidelines and security reviews of privately owned and operated pipelines. GAO reports in 2018 and 2019 identified some weaknesses in the agency's oversight and guidance, and made 15 recommendations to address these weaknesses. TSA concurred with GAO's recommendations and has addressed most of them, such as clarifying portions of its Pipeline Security Guidelines improving its monitoring of security review performance, and assessing staffing needs.
As of June 2021, TSA had not fully addressed two pipeline cybersecurity-related weaknesses that GAO previously identified. These weaknesses correspond to three of the 15 recommendations from GAO's 2018 and 2019 reports.
Incomplete information for pipeline risk assessments. GAO identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline security reviews. For example, TSA's risk assessment did not include information consistent with critical infrastructure risk mitigation, such as information on natural hazards and cybersecurity risks. GAO recommended that TSA develop data sources relevant to pipeline threats, vulnerabilities, and consequences of disruptions. As of June 2021, TSA had not fully addressed this recommendation.
Aged protocols for responding to pipeline security incidents. GAO reported in June 2019 that TSA had not revised its 2010 Pipeline Security and Incident Recovery Protocol Plan to reflect changes in pipeline security threats, including those related to cybersecurity. GAO recommended that TSA periodically review, and update its 2010 plan. TSA has begun taking action in response to this recommendation, but has not fully addressed it, as of June 2021.
TSA's May 2021 cybersecurity directive requires that certain pipeline owner/operators assess whether their current operations are consistent with TSA's Guidelines on cybersecurity, identify any gaps and remediation measures, and report the results to TSA and others. TSA's July 2021 cybersecurity directive mandates that certain pipeline owner/operators implement cybersecurity mitigation measures; develop a Cybersecurity Contingency Response Plan in the event of an incident; and undergo an annual cybersecurity architecture design review, among other things. These recent security directives are important requirements for pipeline owner/operators because TSA's Guidelines do not include key mitigation strategies for owner/operators to reference when reviewing their cyber assets. TSA officials told GAO that a timely update to address current cyber threats is appropriate and that they anticipate updating the Guidelines over the next year.

Storms and Record Rainfall in Western Europe Disrupts CI

Record rainfall has caused swollen rivers to burst their banks and wash away homes and other buildings in western Europe – leading to more than 190 fatalities and over 1000 people missing. The floods have affected several river basins, first in the United Kingdom and later across northern and central Europe including Austria, Belgium, Germany, Luxembourg, the Netherlands, Switzerland and Italy.
The German states of Rhineland-Palatinate and North Rhine-Westphalia were among the worst hit by the torrential rainfall, with water levels rising in the Rhine River, as well as the Walloon Region in Belgium. The storms and high waters have also battered neighbouring Switzerland, the Netherlands and Luxembourg.
Data from the Copernicus Sentinel-1 mission are being used to map flooded areas to help relief efforts. The mission has been supplying imagery through the Copernicus Emergency Mapping Service to aid relief efforts. The devastating floods has triggered four activations in the Copernicus Emergency Mapping Service, in Western Germany, Belgium, Switzerland and the Netherlands.
The service uses observations from multiple satellites to provide on-demand mapping to help civil protection authorities and the international humanitarian community in the face of major emergencies.
Westnetz, Germany's biggest power distribution grid, stated that 200,000 properties in the North Rhine-Westphalia and Rhineland-Palatinate regions were without power and that it would be impossible to repair substations until roads were cleared.

CISA and FBI Launch Operation Flashpoint to Raise Awareness about How to Prevent Bomb Making

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Justice’s Federal Bureau of Investigation (FBI) announced a new pilot program called “Operation Flashpoint” to build awareness in communities across the U.S. about how to prevent bomb attacks.
At the pilot’s launch today at Revell Ace Hardware in Clinton, Miss., CISA and FBI officials highlighted the threat posed by domestic violent extremists and others who can build improvised explosive devices (IEDs) from common household items found at retail stores across the country. Approximately 250,000 businesses in the U.S. sell, use or distribute materials that can be used to build bombs.
IEDs pose a significant threat in the U.S. In 2020 alone, there were 2,061 total bomb threat, suspicious package and device-related incidents across the nation, according to CISA’s Office for Bombing Prevention TRIPwire report. Major bombings can cause mass casualty events and cost hundreds of millions of dollars or more.
The 90-day Operation Flashpoint pilot, which will include events in other cities including Columbia, S.C.; Louisville, Ky.; and Orlando/Tampa, Fla., encourages businesses and the public to voluntarily report suspicious activities, such as buying large amounts of chemicals and materials (or a combination of these) that can be used to build bombs.
“Operation Flashpoint is a major milestone in implementing U.S. policy to thwart bomb threats,” said Dr. David Mussington, Executive Assistant Director for CISA’s Infrastructure Security Division. “It shows the strong unity in the federal government, between the Department of Justice and the Department of Homeland Security, to safeguard citizens and critical infrastructure.”

IAEA Tool for Self-Assessment of National Nuclear and Radiation Safety Infrastructure Now Available Online

The IAEA has launched a web-based version of its self-assessment tool — eSARIS — with additional features and advanced functionalities to support Member States in assessing their nuclear and radiation safety framework, to either strengthen the national regulatory infrastructure or in preparation for an IAEA Integrated Regulatory Review Service (IRRS) mission.

“eSARIS allows multiple users across different organizations in a Member State to work together more effectively, as they can view and edit information simultaneously,” said Teodros Hailu, IAEA Radiation Safety Specialist and eSARIS technical officer. “Users can also use charts to monitor their self-assessment progress and the new tool provides the opportunity of tracking changes made to information provided.”

eSARIS is a new version of the IAEA Self-Assessment of Regulatory Infrastructure for Safety (SARIS). SARIS was originally launched in 2013 and is regularly updated in line with the development of IAEA safety requirements. eSARIS now provides users with easy and secure online access, and acts as a shared online platform for all users within a country.

The SARIS methodology, used by staff of regulatory bodies, technical services provider organizations, facilities using radiation sources and government entities, is based on a structure of questions that promotes the objective evaluation of current safety framework, processes and related activities, and enables Member States to devise a continuous improvement plan for their national safety infrastructure.

Conducting self-assessment using SARIS is a preparatory requirement for IAEA Integrated Regulatory Review Service (IRRS) missions, a peer review service of regulatory framework for Member States to strengthen and enhance the effectiveness of their regulatory infrastructure.

User-friendly features

The new eSARIS was developed in response to feedback from Member States and allows regulatory bodies to modify the scope of their self-assessment. Since it is accessed via the IAEA Nucleus system, existing Nucleus account holders will benefit from single sign-on, while eSARIS also guarantees users a high level of restricted access and security.

Isabel Villanueva Delgado, Head of the General Secretary’s Cabinet at the Spanish Nuclear Safety Council (CSN), who was involved in the development stage of the tool, said: “eSARIS systematically guides on how to implement the self-assessment plan; organize roles and responsibilities; develop an action plan for improvement in line with updated IAEA safety standards; and create a repository of information and evidence, which could prove beneficial in the short and long term.”

Richard Ndi Samba, Director of Regulation and Regulatory Control at the National Radiation Protection Agency (NRPA) in Cameroon and also involved in the development process, added that “the updated tool provides an easy interface to communicate with IAEA technical officers, which allows country counterparts to quickly identify areas of performance improvement.”

eSARIS also includes other components, such as the Integrated Review of Infrastructure for Safety (IRIS) tool, which provides for a comprehensive and targeted self-assessment in line with the IAEA Specific Safety Guide SSG-16 (Rev. 1) on the establishment of a national safety infrastructure for a nuclear power programme.

IACIPP Concerned at Increasing Ransomware Attacks Against Critical Infrastructure

The International Association of CIP Professionals (IACIPP) is concerned about the increasing threat and ransomware attacks against critical infrastructure and in particular the energy sector.
As has been demonstrated by the recent ransomware attack on Colonial Pipeline in North America, and the impact this has had across other infrastructure services, and the wider economic impact on, for example, the price of petrol and oil, such attacks should be a concern to us all.
"The attack on the Colonial Pipeline Industrial Control System was not a total surprise. For years, our pipeline infrastructure and other critical infrastructures have experienced an ever-increasing level of probes and attacks.  The ICS owners and operators must be vigilant and assure their systems are continuously monitored and armed with the latest cyber protection tools." Commented Dr. Ron Martin, CPP,  Professor of Practice: Critical Infrastructure, Industrial Control System Security, and Access and Identity Management at Capitol Technology University.
Although the FBI and other federal and private cybersecurity entities are working to mitigate the effects of the attack on Colonial Pipeline, there needs to be the wider discussion and collaboration across industry sectors to prepare for future attacks to mitigate future economic impact such attacks cause.
“Our critical infrastructure sectors are the modern day battlefield and cyber space is the great equalizer. Hacker groups can essentially attack with little individual attribution and virtually no consequence. With over 85% of all infrastructure owned and operated by the private sector, significant investment and attention must be placed on hardening key critical systems. I anticipate more attacks like this happening in the future. A key lesson here is that while technology and automation is good, we must also have the ability to efficiently operate manually as well. Attacks will happen, but how quick can you recover and restore critical services?” commented Brian Harrell, Strategic Adviser to IACIPP and Former Assistant Secretary for Infrastructure Protection.
CISA and the Federal Bureau of Investigation (FBI) have recently released a Joint Cybersecurity Advisory (CSA) on a ransomware-as-a-service (RaaS) variant—referred to as DarkSide—recently used in a ransomware attack against Colonial Pipeline.
Chuck Brooks, President of Brooks Consulting International and cyber expert, commented, “Protecting critical infrastructure needs to be a shared responsibility of both the public and private sectors. The energy sector become a preferred target of sophisticated hackers often in collusion with nation state actors. The cost of breach as evidenced in the Colonial pipeline ransomware attack can be disruptive to commerce and impact many industry verticals. “
“Critical infrastructure needs to be fortified from cyberattacks and physical attacks in a joint government/industry collaboration. Resources need to be invested in emerging automation technologies and training. IT and OT systems need to be monitored at the sensor level for anomalies. Sensitive operations need to be segmented and air gapped. Back up of data is an imperative and resiliency a requirement for all critical infrastructure operations. It may take new laws and regulations, but it needs to be done.” Concluded Mr Brooks.
The cyberattack against Colonial Pipeline that was discovered on May 7 underscores the growing impact of cyberthreats on industrial sectors. While the investigation is ongoing and important lessons from this attack will be extracted in the next few weeks, the fact that Colonial Pipeline had to pro-actively take their OT systems offline after starting to learn about which IT systems were impacted by the ransomware is significant.
John Donlon QPM the Chairman of IACIPP stated - ‘This type of attack comes as no real surprise. It is consistent with recent trends and what is really quite concerning is the fact that the scale and impact of such events continue to escalate. We have seen recent Government activity across the Western world seeking to put in place support to Infrastructure Owners and Operators but the speed of new attack methodologies, either through nation-state actors or criminal groups, means it is not always easy to keep ahead of the curve. Unfortunately, I believe we will continue to see even greater escalation in the power of attacks being executed and therefore the breadth and depth of collaboration between governments and the private sector has to develop at pace’.
This will also be subject to a case study panel discussion at Critical Infrastructure Protection and Resilience North America (www.ciprna-expo.com) in New Orleans LA on 19th - 21st of October 2021.

Natural hazard triggered industrial accidents: Are they Black Swans?

A recently published JRC study examines whether technological accidents caused by natural hazards (Natech accidents) are real “Blacks Swans” (unpredictable and hence unpreventable events), identifies their possible causes and discusses effective strategies to manage extreme risks.
The study concludes that the Black Swan metaphor is overused for technological accidents in general and Natech accidents in particular, whose recurrence raises questions about the effectiveness of corporate oversight and the application of state-of-the-art knowledge in managing risks.
What are Natech accidents?
Natech accidents occur when the natural and technological worlds collide, wherever hazardous industry is located in areas prone to natural hazards. Past Natech accidents have often had significant impacts on public health, the natural and built environment, and the local, national or even global economy.
Major technological accidents considered unpreventable are occasionally called Black Swan events. Three features characterize a Black Swan:
- it must be an outlier with respect to normal expectations, making it unpredictable;
- it has to have a major impact;
- it can be explained in hindsight, making it appear predictable.
Inadequate risk management and organisational risk blindness
A closer look at past Natech accidents shows that the vast majority of these events, if not all, could have been foreseen and prevented using available information and knowledge prior to the disaster. They can therefore not be considered inevitable or Black Swans.
The JRC study provides a detailed analysis of the reasons for why Natech risks are often underestimated:
- Risk management traditions and the Act-of-God mindset - The focus for managing natural risks has traditionally been on the response side and hence on disaster management, rather than on prevention and risk management, whereas the technological-risk community has always focused on risk- rather than disaster management. Natech risk is sandwiched between these two worlds, and neither community feels very much at ease with taking ownership of the risk;
- Complexity of Natech risk scenarios - Natech risk analysis would need extensions to traditional risk-analysis methodologies in order to cover the multi-hazard nature of the risk and the multitude of possible simultaneous scenarios;
- Risk governance and risk management problems due to the multi-stakeholder and multi-hazard nature of Natech risks, and the multitude of possibly conflicting issues that are usually on a manager’s radar screen;
- Socio-economic context, including group interests and power, economic pressure, and public or media indifference; and
- Human fallacies and cognitive biases that can corrupt the experiences we draw on for estimating risks.
Managing extreme risks
Building organisational resilience is key to managing risks effectively, in particular in high-risk industry. The JRC study discusses possible strategies to reduce extreme risks, prepare better for their consequences, and make Black Swans more accessible:
- Risk-based versus precaution-based strategies
- Disaster incubation theory and warning signals
- Mindfulness
- Resilience engineering
- Scenario planning
- Red teaming
While the JRC study is centered on Natech risks, it is generally applicable to managing also other types of extreme or low-probability risks.

How science can help build a more resilient Europe

Enhanced data collection, more knowledge sharing and a long-term approach to risk will be key in strengthening Europe’s resilience against future disasters, according to a new book published today by the JRC.
Drawing lessons from the coronavirus pandemic and other crises, ‘Science for Disaster Risk Management 2020: acting today, protecting tomorrow’ explores how to protect lives, livelihoods, the environment and our rich cultural heritage from future disasters.
With input from over 300 experts, the book highlights the important role of science in preparing Europe to face the challenges that lie over the horizon.
Commissioner for Crisis Management, Janez Lenarčič, said: “As disasters defy borders the EU supports national action and promotes cross-border cooperation on disaster risk management – with the EU Civil Protection Mechanism being at the heart of this work. Using all data, science and lessons learnt available is vital to strengthen the collective safety and resilience against disasters in the EU and beyond”.
Commissioner for Innovation, Research, Culture, Education and Youth, Mariya Gabriel said: “The Joint Research Centre has long held key expertise in disaster risk management, spawning valuable tools like early warning systems and satellite mapping services, disaster risk studies and global risk models. The new book ‘Science for Disaster Risk Management 2020: acting today, protecting tomorrow’, is the latest of these tools: it shows how vital science is in helping us prepare for disasters, and how we can all work together to learn the lessons of the past and prepare better for the future.”
The aftermath of disasters can be learning opportunities, both in recovering quickly and dealing with the underlying drivers of disaster risk to avoid or mitigate similar events. This new book provides several examples and recommendations on how to grasp these opportunities to build a more resilient future.
Data is key to understanding the impact of disasters, and better managing them in the future
Events like the Fukushima accident in 2011 or the coronavirus pandemic show that, however improbable they may seem, disasters do occur and they can have a huge impact.
On a practical level, past disasters can serve to highlight weaknesses and trigger changes in the policy framework. For example, the forest fires of 2017 in Portugal caused a reassessment of fire management policies and led to new legislation to protect people and territory from forest fires.
To make the most of these opportunities, scientists need quality, comprehensive data and information gathered after a disaster to develop the right methodologies and tools. The book authors recommend developing a mechanism so that disaster loss data can be collected and used in this way.
A major challenge to collating and using data is that much of the damages and loss to cultural and environmental ecosystems caused by disasters can remain hidden when the value of these assets are not easy to define in economic terms.
It is hard to put a price on cultural artefacts or quantify what is lost when certain oral traditions and customs are no longer performed.
As a first step, the authors recommend compiling an inventory of the current state of cultural heritage assets in Europe, which can contribute to preserving that heritage in the face of disasters.
Taking a long-term view on disaster risk
The book also calls for a shift from a short-term, reactionary approach to disaster risk management, towards a long-term view that tackles the underlying drivers of risk - such as inequality, urbanisation, or climate change.
For example, the authors show how urban planning can play a key role in avoiding building in risk-prone areas like flood plains. Climate change also poses a challenge that requires a long-term response: sectors like European agriculture will need to deal with more frequent and extreme weather events in the coming years.
The book recommends actions such as supporting research groups from across different scientific disciplines to work together to find nature-based innovative solutions to societal challenges.
Sharing knowledge and working together to become more resilient
In today’s complex world and the many links between assets, sectors and governance levels, disasters often have an impact across countries and sections of society. It is therefore necessary that different stakeholders and groups share their data and knowledge to co-create effective strategies to reduce disaster risk.
One positive example of this came following the explosion of a fertiliser plant near Toulouse in 2001. It triggered a set of actions to engage local stakeholders in the co-design of strategies and measures to deal with technological risk.
By establishing local committees for information and consultation, people can now participate in the decision-making process and implementation of measures to prevent these risks, while also having an influence on land-use planning.
The book recommends education and training to raise awareness and build the capacity of individuals and communities to contribute to these efforts.

IAEA Develops New Benchmarks for Computational Methods for Utilization, Operation and Safety Analysis of Research Reactors

Under a recently completed IAEA project, experts have developed a benchmark database for computational methods and tools used for the utilization, operation and safety analysis of research reactors.
A benchmark in this context is an experiment conducted in a research reactor, including the measured data and sufficient details about the research reactor and the experimental facility.
“The benchmark allows modelling the experiment using a computer code,” said Frances Marshall, the lead officer of the four-year IAEA coordinated research project (CRP). “The results of the calculations are compared with the data to assess whether the code and the modelling done are adequate for the case under study.”
Benchmarking computational codes and methods against experimental data is key to assessing the validity of the codes’ application to the design, operation, utilization and safety analysis of research reactors.
The benchmarks can be used to:
- train new professionals in research reactors by allowing them to develop their modelling skills using well-documented cases (benchmarks);
- improve modelling requiring advanced code functions and user knowledge;
- conduct formal validation of codes, models or user qualifications.
The CRP benchmarked many of the most common research reactor codes used at international level, and demonstrated that the codes, methods and the nuclear data available yield results that, in the majority of cases, meet the operational requirements of research reactor facilities.
The collected data will be used to update the IAEA’s Research Reactor Benchmarking Database: Facility Specification and Experimental Data, which is a valuable resource for assisting the optimization of research reactor core management and experimental programmes, while maintaining safety.
The project was carried out by several research reactor operating organizations with ongoing irradiation and measurement activities in fuel burnup and material and target activation. The participants provided experimental data and research reactor facility specifications covering a broad range of research reactor types and power levels. The quality of the data was assessed by an independent review to confirm its use as benchmarks, leading to the establishment of 14 benchmark specifications using data from nine different research reactors. Calculations were then made by at least two participants for each of the benchmarks, using a wealth of codes, leading to a total of 53 analysis contributions.
The overall objective of the CRP was to encourage cooperation, foster the exchange of information and increase the knowledge and expertise in numerical analysis to improve the design, operation, utilization, safety and decommissioning of research reactors, in particular in fuel multicycle depletion analysis, and material and target activation calculations.

UNISDR Report: Words into Action guideline: Man-made/technological hazards

The UNISDR has issues a report that takes a practical approach in addressing man-made and technological hazards, and builds upon previous analyses and recommendations relating to such hazards in the context of DRR.
The number and magnitude of man-made disasters worldwide have risen since the 1970s and continue to grow in both frequency and impact on human wellbeing and economies, particularly in low and middle-income countries.
Several major technological accidents and the increased number of new hazardous substances and materials have highlighted the need to tackle these hazards within the overall frame of inclusive disaster risk management. Paragraph 15 of the Sendai Framework for Disaster Risk Reduction 2015-2030 leaves no doubt about the need to address hazards comprehensively as it applies to the risk of small-scale and large-scale, frequent and infrequent, sudden and slow-onset disasters, caused by both natural and man-made hazards as well as related environmental, technological and biological hazards and risks. It aims to guide the management of disaster risk at all levels as well as within and across all sectors.
The United Nations Office for Disaster Risk Reduction (UNISDR) is the focal point of the United Nations system for disaster risk reduction and the custodian of the Sendai Framework, supporting countries and societies in its implementation, monitoring and review of progress.
In accordance with the Sendai Framework, this guide seeks to address man-made hazards by strengthening national and local disaster management plans to include these hazards and by raising awareness of their risks and impacts. Furthermore, it will be a valuable tool to support training and capacity building.
This guide provides a set of evidence-based, practical activities for implementation for chemical, industrial and transport accidents, and nuclear and radiological hazards under the Sendai Framework’s four priorities for action. The guide highlights the existing diversity of thematic frameworks, institutional and legal mechanisms at global and regional levels that are related to and used for addressing man-made hazards. It also draws attention to existing collaborations within the disaster risk reduction community and key partners.
The Guide builds on the outcomes of the Open-ended Intergovernmental Expert Working Group on Indicators and Terminology for the Sendai Framework, and the work on hazard classification and terminology related to man-made hazards.
Full guide is available here >>

GAO Report: Opportunities Exist for DOE to Better Support Utilities in Improving Resilience to Hurricanes

Hurricanes are a leading cause of major power outages in the U.S., impacting millions of customers in recent years. Utilities in hurricane-affected states have invested in ways to better equip their grids to withstand and rapidly recover from hurricanes. For example, some utilities have elevated equipment to protect grid infrastructure from flooding.
The Department of Energy and its National Laboratories are developing planning tools, such as metrics to track grid resilience. However, we recommended that DOE create a plan to better guide these efforts and to better inform utilities about available resources at its National Labs.
Since 2012, utilities have taken steps to improve grid resilience to severe hurricanes, such as (1) implementing storm hardening measures to enable the grid to better withstand the effects of hurricanes; (2) adopting technologies to enhance operational capacity and help quickly restore service following disruptions; and (3) participating in mutual aid programs with other utilities and training and planning exercises. For example, utilities have implemented storm hardening measures that include elevating facilities and constructing flood walls to protect against storm surges. Utilities have also adopted technologies that enhance communication capabilities and monitor systems to detect, locate, and repair sources of disruptions. However, these utilities reported challenges justifying grid resilience investments to obtain regulatory approval, and some utilities have limited resources to pursue such enhancements.
Various federal agencies can provide funding for efforts to enhance grid resilience to hurricanes, including the Department of Agriculture (USDA) and the Federal Emergency Management Agency (FEMA). However, eligibility for most federal funding for grid resilience, including some USDA and FEMA funding, is limited to publicly owned utilities and state, tribal, and local governments. The Department of Energy (DOE) does not provide direct funding for grid resilience improvements, but it has efforts under way, including through its National Laboratories, to provide technical assistance and promote research and collaboration with utilities. DOE has also initiated preliminary efforts to develop tools for resilience planning, including resilience metrics and other tools such as a framework for planning, but DOE does not have a plan to guide these efforts. Without a plan to guide DOE efforts to develop tools for resilience planning, utilities may continue to face challenges justifying resilience investments. In addition, DOE lacks a formal mechanism to inform utilities about the efforts of its National Laboratories. Such a mechanism would help utilities leverage existing resources for improving grid resilience to hurricanes.
Hurricanes pose significant threats to the electricity grid in some U.S. coastal areas and territories and are a leading cause of major power outages. In recent years, hurricanes have impacted millions of customers in these areas. Adoption of technologies and other measures could improve the resilience of the grid so that it is better able to withstand and rapidly recover from severe weather; this could help mitigate the effects of hurricanes.
This report examines (1) measures utilities in selected states have adopted to enhance grid resilience following major hurricanes since 2012 and any challenges utilities face funding such measures; and (2) federal efforts to support the adoption of measures to enhance grid resilience to hurricanes and any opportunities that exist to improve these efforts. For this report, GAO assessed agency and industry actions; reviewed relevant reports, policies, and documents; and interviewed federal, industry, and local officials.
GAO recommends that DOE (1) establish a plan to guide its efforts to develop tools for resilience planning, and (2) develop a mechanism to better inform utilities about grid resilience efforts at the National Laboratories. DOE agreed in principle with these recommendations, but its proposed actions do not fully address GAO's concerns.
Full report can be found here >>
1 5 6 7 8 9 10