Given the critical infrastructure it oversees, the power utility sector--including investor-owned utilities (IOUs), municipal owned utilities, rural electric cooperatives, and merchant generators--faces a high probability of cyberattacks (see chart 1). A successful cyber or physical attack can cause blackouts and other operational fallouts that herald wide-ranging economic and social ripple effects.

While a successful attack against a U.S. electric utility has not prompted us to take a rating action to date, we view the threat landscape as constantly evolving. Recent events, including an extreme uptick in physical attacks on electric substations and hybrid cyber-kinetic attacks on Ukraine's power grid amid the Russia-Ukraine conflict, underline the sector's heightened vulnerabilities in both the cyber and physical dimensions. Compounding this risk is increased digitalization and system decentralization that inherently enables hackers to exploit potential weaknesses. In the midst of rapid digital transformation, electric utilities face an ever-narrower window in which to effectively prepare for, and respond to, increasingly complex threats. S&P Global Ratings believes that having comprehensive cyber and physical preparedness practices that support continual improvement can help power utilities minimize their credit vulnerabilities.

Chart 1

Recent Threat Trends Underscore Sector's Evolving Challenges

Facing a constant array of threats, many issuers have achieved substantial progress in their cyber defenses to swiftly respond to ever-changing tactics from bad actors. One telling sign is increased investment: In 2022, the average information security budget across all sectors increased by 26% (for more information, see "Cyber Trends and Credit Risks," published Oct. 25, 2022, on RatingsDirect). Nevertheless, a handful of headline-grabbing events highlight the extent to which the power utility sector is exposed to high-impact cyber and physical risks (see table 1).

Table 1

Properly implemented CIP standards provide baseline risk protection

The power utility sector has long been subject to federal standards and guidelines, providing it with baseline security protection against bad actors. A notable one is the mandatory and enforceable Critical Infrastructure Protection (CIP) reliability standards, developed by the North American Electric Reliability Corporation (NERC), with a focus on the Bulk Electric Systems (BES). S&P Global Ratings typically assesses how an issuer prepares for cyberattacks and how it plans both its response and recovery from a successful attack. Viewing CIP standards through this lens, S&P Global Ratings believes utilities establish a baseline for managing risk exposure in terms of asset identification, information monitoring, and incident response. The chart below illustrates selective highlights from the extensive requirements that we view as supportive for effective prevention, response, and recovery.

U.S. entities that generate and deliver electricity through high-voltage transmission lines are considered BES stakeholders and thus are subject to compliance oversight (including compliance audits and spot checks) conducted by six regional entities on behalf of NERC. Distribution utilities, typically serving smaller loads, are outside the CIP scope. However, many of these smaller utilities have voluntarily aligned their cyber defense practices with CIP standards and engage in information sharing through nationwide platforms established by leading industrial associations, all of which we view positively.

We also believe that NERC plays an important role in guiding utilities to level the playing field through its continuous reviews and updates of standards, as highlighted by its enhanced requirements for vendor-related remote access control (effective October 2022) to address supply chain risks, as well as ongoing studies of physical security standards pertaining to all BES transmission stations, substations, and primary control centers.

Chart 2

Within our criteria, we typically factor in cyber and physical risk management as part of our overall assessment of management (see below). Other assessments related to market position and financial metrics could become relevant, particularly following a successful attack. We view alignment with CIP standards as a way to inform our analysis of an issuer's commitment to cyber defense and implementation of risk mitigation practices. Nevertheless, our analysis of an issuer's cyber risk exposure generally considers the function, size, and scope of its operations and focuses on its overarching cybersecurity strategy pertaining to preparedness, response, and recovery. Although rare, if an issuer lacks the understanding of asset vulnerabilities or does not have a plan to monitor cyber and physical security systems, we may consider its preparedness as insufficient to detect or recover from potential security incidents that could result in system shutdowns or monetary losses. This could weaken our view of the issuer's overall management, possibly leading to a lower rating than its similarly positioned peers.

Chart 3

Aging cyber infrastructure is a sector-wide vulnerability

Utilities face roadblocks on the path to meeting evolving industrial standards, providing opportunities for systems to be exploited. One main challenge in the industry is that many of its IT systems are antiquated. Many supervisory control and data acquisition systems (SCADA), a critical digital infrastructure adopted by U.S. utilities since the 1970s, are aging and may lack the capability to keep up with updated compliance standards. Consequences stemming from lags in network upgrades and missing security applications could be far-reaching, as seen in examples of SCADA breaches among water and sewer utilities that involved poisoning the water supply and facility shutdowns (see "Cyber Risk In A New Era: U.S. Utilities Are Cyber Targets And Need To Plan Accordingly," published Nov. 3, 2021).

Even if a utility checks all the boxes when it comes to compliance standards, maintaining effective cybersecurity measures requires ongoing vigilance. Management must constantly coordinate and monitor cyber defense efforts, and employees must stay highly vigilant and aware of their roles and responsibilities to understand, detect, and minimize risks. Among S&P Global Ratings' rated power utilities across ownership classes, data breaches accounted for the majority of cyberattacks in 2018-2022, as compared with ransomware, denial-of-service, and other attack types, as per Guidewire (see chart 4).

According to the 2022 Verizon Data Breach Investigations Report, 82% of cybersecurity breaches can be attributable to human elements (such as errors, misuse, stolen credentials, and phishing) that can be prevented. This suggests that without a constant, long-term effort to train and improve user behavior, all facets of human interaction with physical and digital assets can open the cyber door for criminals to compromise systems. Conversely, if an issuer maintains a cyber-aware workplace culture and conducts regular, comprehensive staff training programs, we view it as supportive of mitigating human susceptibility and enhancing the baseline protection provided by compliance standards.

Chart 4

Successful Attacks Could Pressure Various Credit Rating Factors

After a successful attack, S&P Global Ratings would assess its magnitude based on the type and scale of the damage done and how it affects various aspects of an issuer's credit quality (see table 2). We view the immediate damage primarily as financial risks, where attacks that disable billing systems and disrupt revenue streams, ransomware payments, regulatory fines, or operation restoration result in meaningful, or sometimes compounded, monetary losses that pressure an entity's margins and liquidity. Given this context, we view an issuer's liquidity and cyber insurance levels to be important credit factors that can provide short-term financial buffers following a disruption in cash flows that can mitigate the likelihood of adverse financial effects. However, we note that cyber insurance premiums continue to rise due to the increased frequency and severity of cyberattacks and greater systemic vulnerabilities (See "Cyber Risk In A New Era: The Rocky Road To A Mature Cyber Insurance Market", published July 26, 2022).

Another notable post-attack risk is reputational damage, which can create equally challenging and potentially long-term pressures. Customers and third parties could lose confidence in the reliability of critical services or their administrative leaderships, adversely affecting a utility's market standing, pricing power, demand growth, and member stability.

Continual Risk Management Improvements Are Key To Preventing Cyber And Physical Attacks

The evolving threat landscape indicates that cyber and physical risks have moved beyond a siloed, local risk to a near-ubiquitous priority that must be addressed on a regional or national level. As malicious actors continue to ramp up targeted attacks against utilities, we believe it is a matter of when, not if, an entity will be attacked.

We generally assess whether utilities have proactively integrated cyber and physical risk management into a wider risk management framework, monitor federal regulatory developments, and evaluate the level of credit protection they provide to issuers.

At the same time, we expect well-prepared issuers to continually improve their risk mitigation strategies to keep up with the sector's rapid digitalization and stay ahead of malicious attacks.