Beyond compliance: How competitive power suppliers are preparing for the next generation of cyber and physical threats.
Every October, Cybersecurity Awareness Month reinforces a simple but important message: cybersecurity is a shared responsibility. For America’s critical energy infrastructure, that means preparing people and systems, sharing information, exercising response plans, and working closely with government and industry partners to protect the grid.
And the threat is evolving quickly. One in four malicious breaches studied by IBM this year involved AI-enabled attacks, and nearly two-thirds of those attacks targeted critical infrastructure sectors. Energy was among the most heavily targeted sectors, with the average cost of a breach reaching $5.2 million.
As AI creates new capabilities for defenders and adversaries alike, the grid itself is also changing. NERC’s 2026 Critical Infrastructure Protection Roadmap identifies emerging risks ranging from compromised telecommunications and weaponized drones to the malicious manipulation of large electricity loads, including data centers.
Keeping the grid secure in this increasingly interconnected environment requires constant vigilance, coordination, information sharing, and practice. For competitive power suppliers, that work is already underway.
Putting Cyber Preparedness Into Practice
Last October, EPSA hosted a customized version of NERC and the Electricity Information Sharing and Analysis Center’s GridEx VIII, bringing competitive power suppliers together to test their response to a complex, rapidly evolving threat.
The fictional scenario began with cyber and physical attacks in “Data Center Alley” and escalated to phishing and malware, loss of SCADA systems, fuel disruptions, internet and cloud outages, misinformation, and even fake announcements from company executives.
Teams had to confront the overlapping challenges a real-world incident could create: How do you keep plants operating when systems are unavailable? How do operations, IT, and communications teams coordinate? How do you communicate when information is incomplete or unreliable?
As one participant put it, the exercise “took us out of our silos.” Companies could compare approaches, learn from one another, and bring lessons back to their own organizations—strengthening the relationships that become critical when an incident occurs.
From GridEx to GenEx
This October, EPSA will build on those lessons with GenEx, an EPSA-led, generation-focused preparedness exercise bringing competitive power suppliers together to test plans, strengthen relationships, and share best practices.
We can’t predict exactly what the next threat will look like. But we can prepare for how cyber, physical, fuel, and communications disruptions may intersect—and ensure the people responsible for keeping America’s power plants secure and operating are ready to respond.
Strengthening Coordination Between Industry and Government
Protecting critical infrastructure also requires close coordination between industry and government, while ensuring time is spent wisely—especially when an incident is unfolding.
A new report from the U.S. Government Accountability Office (GAO) highlights opportunities to strengthen that coordination.
Industry participants identified overlapping or inconsistent federal cybersecurity requirements, particularly around incident reporting, that can complicate response. EPSA participated in those discussions alongside other industry and government representatives.
“During a cyber incident, security teams and resources should be focused on identifying, containing, and responding to the threat while making sure government partners quickly get the timely and actionable information they need,” said EPSA President and CEO Todd Snitchler.
One practical opportunity is greater consistency in when and how cyber incidents must be reported. Different federal requirements can apply different reporting thresholds, timelines, and processes to the same incident. Better alignment can reduce duplicative reporting while ensuring agencies quickly receive the actionable information they need.
Electric power companies already operate under rigorous cybersecurity and reporting requirements and take additional proactive measures to protect assets and ensure reliable operations. Better coordination among federal agencies can reduce duplicative reporting, improve response, and keep resources focused on the threat at hand.
“We appreciate GAO bringing industry and government together to identify practical ways to improve that coordination,” Snitchler said.
A Comprehensive Approach to Cyber and Physical Security
Exercises like GridEx are one part of a much broader effort. Competitive power suppliers treat cyber and physical threats as enterprise-level risks and work year-round to protect their people, facilities, systems, and the reliability of the power grid.
That work includes:
- Maintaining rigorous cyber and physical security protections. Competitive power suppliers comply with applicable NERC Critical Infrastructure Protection (CIP) standards covering areas such as electronic and physical security, access controls, vulnerability management, personnel training, incident response, and recovery planning.
- Continuously identifying and managing risk. Companies assess critical assets and vulnerabilities, monitor systems for security events, maintain contingency and recovery plans, and use third-party experts and assessments to test and strengthen their security posture.
- Sharing threat information across the industry. Competitive suppliers participate in the Electricity Information Sharing and Analysis Center (E-ISAC) and other industry forums to exchange timely information on cyber and physical threats, vulnerabilities, incidents, and mitigation strategies.
- Partnering with government. The industry works closely with federal agencies and law enforcement to exchange threat information, improve situational awareness, and coordinate preparation for and response to threats affecting critical infrastructure.
- Training and exercising for real-world events. Companies participate in exercises, trainings, conferences, and simulations that test their ability to respond to and recover from coordinated cyber and physical attacks. EPSA is building on that work through its customized GridEx exercise and this year’s GenEx.
- Planning for more than cyberattacks alone. Effective security means preparing for the ways cyber incidents can intersect with physical security threats, fuel disruptions, communications failures, supply-chain risks, and other events that can affect reliable operations.
- Learning and adapting as threats evolve. Cybersecurity is not a static compliance exercise. Competitive suppliers continually incorporate lessons learned, emerging threat intelligence, new technologies, and best practices into their security and risk-management programs.
Cybersecurity Is a Shared Responsibility: What Individuals Can Do
Protecting critical infrastructure requires action at every level—from power companies and government agencies to individual employees and members of the public. Every employee who accesses sensitive systems or information plays a role in keeping the grid secure, just as everyone can take simple steps to protect themselves, their personal data, and the systems we all rely on.
CISA recommends four basic actions:
- Use strong passwords and a password manager.
- Turn on multifactor authentication.
- Recognize and report phishing.
- Keep software updated.
Keeping Pace With Evolving Threats
Technology will continue to evolve. Threats will change. And the electric grid will become increasingly interconnected with the other infrastructure and industries that power America’s economy.
The fundamentals of resilience remain constant: prepare before a crisis, practice the response, share information, strengthen partnerships, learn from experience, and keep improving.
From GridEx to GenEx, and through continued collaboration with government and industry partners, competitive power suppliers are putting those principles into practice—helping ensure America’s power system is prepared not only for today’s threats, but for whatever comes next.
