GridEx is a security exercise put on by the North American Electric Reliability Corporation (NERC) that is designed for utility and government partners to exercise coordinated responses to simulated cyber and physical security attacks, strengthen crisis communication relationships, and provide input for lessons learned. The goal of each GridEx is to help participants strengthen their capabilities to respond to and recover from severe events affecting the reliable operation of the North American electric grid.

The seventh GridEx (GridEx VII) took place in November 2023, and the “GridEx VII Lessons Learned Report,” published last week, is a detailed post-exercise review and analysis of NERC and the Electricity Information Sharing and Analysis Center’s (E-ISAC) GridEx VII.

The report provides recommendations and actions for utilities, government partners, the E-ISAC, and other stakeholders to prepare for and respond to security incidents that affect the North American electric system.

“Today’s threat landscape is dynamic, presenting challenges that are increasingly difficult to detect and protect against,” said Manny Cancel, senior vice president of NERC and chief executive officer of E-ISAC. “The scenario created for GridEx VII reflected this by testing the collective ability of industry, government, and cross-sector partners to restore the grid under the most extreme circumstances. An exercise on this scale requires significant commitment and collaboration from the participants. This continues as we develop associated action plans and I am encouraged that several participants have already begun to implement some of the recommendations in their organizations.”

More than 15,000 participants from approximately 250 North American organizations, including the electric industry, cross-sector partners from gas and telecommunications, and U.S. and Canadian government partners, took part in a two-day exercise, which tested operational and policy measures that would be needed to restore the grid following a severe cyber and physical attack. Using core planning and exercise materials developed by E-ISAC’s GridEx team, participants tested their response and restoration capabilities by customizing the core scenario to meet their actual operating environment.

GridEx VII concluded with a day-long executive session, during which industry executives and government leaders from the U.S. and Canada convened in-person in Washington, D.C., as well as virtually, to explore strategic and policy implications presented by the scenario.

Among the key recommendations offered by GridEx VII to the industry’s success during a severe security event are:

1 – Explore opportunities to improve the transmission of critical data between control centers.

2 – Evaluate alternative technologies for voice communications necessary to operate the grid.

3 – Increase participation and collaboration between utilities, local, state, and provincial governments.

4 – Conduct further discussion between industry and government regarding restoration priorities and supply chain concerns.

5 – Evaluate options to manage the grid reliability impacts of energy market disruption over an extended period.

Further collaboration and coordination between the E-ISAC, industry, and government is already in progress, with action plans in development based on recommendations in the report. Feedback received from participants will be incorporated into the planning process for GridEx VIII in 2025. NERC and the E-ISAC are committed to continue enhancing the GridEx program to meet the challenges posed by the complex threat environment across North America.