USA Final Project Report 8/25/2018 USA Final Project Report ERTF-4 Singapore April 25, 2017 Test

EWG 02 2014S – Cyber-Energy Nexus Study Best Practices, Opportunities, and Challenges for Smart Energy Technology* The study was conducted as part of the Energy Smart Communities’ Initiative (ESCI) smart grid pillar with six primary goals: Define the cyber-energy nexus landscape, Identify relevant standards and current policy gaps in standards development, Share best policy practices, Identify related opportunities and challenges, Provide guidance to help APEC economies implement cyber-energy nexus plans in ways that optimize shared security and interoperability goals, and Add to the ESCI Knowledge Sharing Platform’s resource links and case studies. *http://publications.apec.org/publication-detail.php?pub_id=1772

The cyber-energy nexus landscape is rapidly evolving and presents many energy security opportunities and challenges The report is organized along 8 topics: Opportunities for Cooperation Industry Standards and Best Practices Cybersecurity Programs and Organizations Framework Implementation Guidance Asia-Pacific Economic Cooperation Member Economies Challenges Recommendations Additional Resources

The report reviews tools to strengthen cybersecurity capabilities US DOE has developed the Electric Subsector Cybersecurity Maturity Model (ES-C2M2)* The ES-C2M2 outlines ten domains, such as risk management and incident response, in which utilities should seek to improve capabilities This tool can facilitate self-assessments by energy sector entities *https://energy.gov/oe/services/cybersecurity/cybersecurity-capability-maturity-model-c2m2-program/cybersecurity

This study is an initial effort to identify relevant standards and current cyber-energy security General observations included: The cyber threat to energy systems and infrastructure in APEC continues to increase, threatening economic and national security Increased situational awareness of the cyber threat and mitigation solutions would be facilitated by increased public information sharing by government and industry on relevant policies The lack of skills both in the domain of cybersecurity and smart grids seems to be common to the vast majority of APEC members

A potential follow-up study could include a deeper dive into APEC’s cyber-energy landscape Describe the current cybersecurity posture Describe their target state for cybersecurity Identify and prioritize opportunities for improvement within the context of a continuous and repeatable process Assess progress toward the target state Communicate to both internal and external stakeholders about cybersecurity risk