Recommendation: The Administrator of FEMA should develop and provide clear written information in the form of policy, guidance, or regulations, as appropriate, to COR3 and PREPA that clarifies how FEMA will implement new authorities for the electricity grid recovery in Puerto Rico, including guidance on industry standards and defining resilience. (Recommendation 1)

Agency: Federal Emergency Management Agency
Status: Open

Comments: Since GAO's October 2019 report, FEMA updated its guidance and has provided information to local entities on project eligibility and the industry standards it would accept for restoring the grid. In addition, in January 2020, FEMA provided training to FEMA regional officials and local entities on how to implement this guidance. Despite these efforts, uncertainty remains regarding the extent to which local entities in Puerto Rico have sufficient information to implement projects to promote grid resilience. This is in part due to challenges such as the need for written guidance on how project development will proceed after the fixed-cost estimate is finalized. GAO will continue to monitor FEMA progress towards implementation of this recommendation.

Recommendation: The Secretary of HUD should establish time frames and a plan for publication of the grant process and requirements for CDBG-DR funding available for improvements to Puerto Rico's electricity grid. (Recommendation 2)

Agency: Department of Housing and Urban Development
Status: Open

Comments: As of August 2020, HUD had not published a federal notice outlining the grant process and requirements for CDBG-DR funding available for improvements to Puerto Rico's electricity grid, nor has it established time frames and a plan for issuing this notice. We continue to believe that the action we recommended is needed and will monitor HUD's efforts as part of our regular recommendation follow-up and additional work examining federal support to improve grid resilience in Puerto Rico. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of FEMA, in coordination with DOE, HUD, and other federal and local entities, should establish a mechanism, or take steps to improve existing mechanisms, for coordination among the multiple local and federal entities involved in grid recovery that facilitates decision-making and information sharing among local and federal agencies. (Recommendation 3)

Agency: Federal Emergency Management Agency
Status: Open

Comments: FEMA and DOE have enhanced coordination efforts between their respective agencies and with local entities involved in long-term grid recovery in Puerto Rico via the Technical Coordination Team but until the team's fiscal working group demonstrates how it will help coordinate different potential funding sources, the extent to which these efforts will enhance progress toward grid recovery is uncertain. FEMA can demonstrate this, in part, by providing documentation of efforts to coordinate funding for long-term recovery projects. GAO will continue to monitor agency efforts to support grid recovery in Puerto Rico.

Recommendation: The Secretary of Energy, in coordination with DHS and other relevant stakeholders, should develop a plan aimed at implementing the federal cybersecurity strategy for the electric grid and ensure that the plan addresses the key characteristics of a national strategy, including a full assessment of cybersecurity risks to the grid. (Recommendation 1)

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: DOE agreed with our recommendation. In its response to our report, DOE stated that it was working through an interagency process to develop a National Cyber Strategy Implementation Plan that will consider DOE's Multiyear Plan for Energy Sector Cybersecurity. To fully address our recommendation, DOE should coordinate with DHS and other relevant stakeholders to develop a plan for implementing the federal cybersecurity strategy for the electric grid and ensure that the plan addresses the key characteristics of a national strategy.

Recommendation: FERC should consider our assessment and determine whether to direct the North American Electric Reliability Corporation (NERC) to adopt any changes to its cybersecurity standards to ensure those standards more fully address the NIST Cybersecurity framework and address current and projected risks. (Recommendation 2)

Agency: Federal Energy Regulatory Commission
Status: Open

Comments: In August 2020, FERC officials told GAO that the Commission assembled a team to conduct a technical analysis to develop a plan with appropriate next steps to address GAO's recommendations. As part of this effort, FERC issued two documents. In June 2020, FERC issued a Notice of Inquiry seeking comments on (1) whether NERC's cybersecurity standards adequately address certain NIST Cybersecurity Framework categories, and (2) whether modifications to the cybersecurity standards would be appropriate to address the potential risk of a coordinated cyberattack on geographically distributed targets. Additionally, in June 2020, FERC issued a white paper exploring a new framework for providing incentives to transmission facilities for cybersecurity investments that exceed the requirements of NERC's cybersecurity standards. The incentives are designed, in part, to incentivize cybersecurity investments by facilities that are not covered by NERC's cybersecurity standards, according to FERC officials. As of October 2020, this recommendation remains open.

Recommendation: FERC should (1) evaluate the potential risk of a coordinated cyberattack on geographically distributed targets and, (2) based on the results of that evaluation, determine whether to direct NERC to make any changes to the threshold for mandatory compliance with requirements in the full set of cybersecurity standards. (Recommendation 3)

Agency: Federal Energy Regulatory Commission
Status: Open

Comments: In August 2020, FERC officials told GAO that the Commission assembled a team to conduct a technical analysis to develop a plan with appropriate next steps to address GAO's recommendations. As part of this effort, FERC issued two documents. In June 2020, FERC issued a Notice of Inquiry seeking comments on (1) whether NERC's cybersecurity standards adequately address certain NIST Cybersecurity Framework categories, and (2) whether modifications to the cybersecurity standards would be appropriate to address the potential risk of a coordinated cyberattack on geographically distributed targets. Additionally, in June 2020, FERC issued a white paper exploring a new framework for providing incentives to transmission facilities for cybersecurity investments that exceed the requirements of NERC's cybersecurity standards. The incentives are designed, in part, to incentivize cybersecurity investments by facilities that are not covered by NERC's cybersecurity standards, according to FERC officials. As of October 2020, this recommendation remains open.

Recommendation: FERC should regularly assess the overall performance of capacity markets by developing goals for assessing capacity market performance, measuring the performance of capacity markets against these goals, and using performance information to make changes as needed to capacity markets. To do so, FERC should leverage data and information already being collected by FERC, the RTOs, and the independent market monitors. (Recommendation 2)

Agency: Federal Energy Regulatory Commission
Status: Open

Comments: As of May 2020, FERC is in the process of taking steps to address this recommendation.

Recommendation: FERC should develop and document an approach to regularly identify, assess, and respond to risks that capacity markets face. (Recommendation 3)

Agency: Federal Energy Regulatory Commission
Status: Open

Comments: As of May 2020, FERC is in the process of taking steps to address this recommendation.