Energy Information Sharing and Analysis Center

Energy Information Sharing and Analysis Center
Name	Energy Information Sharing and Analysis Center
Formation	1990s
Type	Nonprofit
Headquarters	United States
Region served	North America

Energy Information Sharing and Analysis Center

The Energy Information Sharing and Analysis Center is a sector-specific Information Sharing and Analysis Center focused on the United States Department of Homeland Security, North American Electric Reliability Corporation, Federal Energy Regulatory Commission, Department of Energy, and private ExxonMobil and General Electric infrastructure stakeholders, providing cyber and physical threat intelligence while coordinating with FBI, Secret Service, National Security Agency, Department of Defense, and industry partners. It operates at the intersection of Presidential Decision Directive 63, Homeland Security Act of 2002, Patriot Act, NIST Cybersecurity Framework, and standards from International Electrotechnical Commission and American National Standards Institute.

Overview

The organization serves as a critical nexus among American Electric Power, Pacific Gas and Electric Company, Duke Energy, Southern Company, NextEra Energy, ConEdison, Tennessee Valley Authority, BP, Chevron, and federal entities such as Department of Energy, Federal Energy Regulatory Commission, Department of Homeland Security, FBI, and National Institute of Standards and Technology to exchange situational awareness about threats, vulnerabilities, and incidents. It provides analytical products aligned with guidance from National Infrastructure Protection Plan, NIST, North American Electric Reliability Corporation, International Organization for Standardization, and industry consortia like GridWise Alliance and Electric Power Research Institute.

History and Development

The center emerged in the aftermath of high-profile incidents and policy initiatives including Presidential Decision Directive 63, the 1993 World Trade Center bombing response evolution, and the institutional reforms following the September 11 attacks. Early participants included utilities such as American Electric Power and Commonwealth Edison alongside technology firms like Siemens, Schneider Electric, Honeywell, and IBM, while regulators including Federal Energy Regulatory Commission and Department of Energy shaped its mandate. Over time it expanded to coordinate with multinational corporations like Royal Dutch Shell, TotalEnergies, Enel, and research institutions such as Sandia National Laboratories and Argonne National Laboratory.

Mission and Objectives

Its stated mission aligns with directives from Department of Energy, Department of Homeland Security, Federal Energy Regulatory Commission, and standards bodies like NIST to improve resilience for critical infrastructure sectors including electricity, oil, and gas. Objectives encompass threat information sharing with partners such as FBI, NSA, CISA, National Cybersecurity and Communications Integration Center, incident response coordination with CERT Coordination Center, and development of mitigation strategies referenced by North American Electric Reliability Corporation reliability standards. It also supports exercises like GridEx and collaborates with academic programs at Massachusetts Institute of Technology, Stanford University, and Carnegie Mellon University.

Structure and Membership

Membership spans investor-owned utilities (e.g., Duke Energy, Southern Company), federal agencies (DOE, FERC), municipal providers like Los Angeles Department of Water and Power, transmission organizations such as PJM Interconnection, Midcontinent Independent System Operator, and suppliers including Schneider Electric, Siemens, ABB, and cybersecurity firms like FireEye and CrowdStrike. The organizational structure mirrors consortiums such as Information Sharing and Analysis Organization models, with working groups focused on cyber, physical security, supply chain risk, and emergency preparedness—coordinating with North American Electric Reliability Corporation regional entities and state public utility commissions like California Public Utilities Commission.

Services and Activities

It issues intelligence reports, vulnerability advisories, incident response playbooks, and situational awareness briefings similar to products from FBI, CISA, NSA Cybersecurity Directorate, and CERT Coordination Center. Activities include tabletop exercises with GridEx, information exchanges with Energy Sector Control Systems Working Group, joint trainings with Sandia National Laboratories and Argonne National Laboratory, and collaboration on standards with NIST, IEEE, and ISO. It also maintains clearinghouses for Indicators of Compromise (IoCs), coordinates with vendors such as Schneider Electric and Siemens on patching, and supports supply chain risk management aligned with National Defense Authorization Act provisions.

Governance and Funding

Governance typically involves a board composed of senior executives from member utilities (e.g., American Electric Power, NextEra Energy), representatives from federal agencies including Department of Energy, FERC, and liaisons from Department of Homeland Security and FBI. Funding derives from member dues, grants from Department of Energy programs, cooperative agreements with DHS, and contributions from corporate partners such as General Electric and Siemens. Oversight mechanisms reference models used by North American Electric Reliability Corporation and reporting expectations consistent with Federal Information Security Management Act frameworks.

Criticism and Controversies

Critics have raised concerns about perceived industry capture and transparency, comparing debates to controversies involving Enron, PG&E, and regulatory capture case studies tied to Federal Energy Regulatory Commission decisions. Privacy advocates have questioned information sharing practices in light of debates around Patriot Act surveillance authorities and coordination with intelligence agencies like NSA and FBI. Security analysts have pointed to incidents such as compromises related to Ukraine power grid attacks and vendor supply chain compromises attributed to firms like Kaspersky Lab in broader discussions about vulnerability disclosure, while legislators in United States Congress have debated oversight and statutory authority.

Category:Energy infrastructure Category:Cybersecurity organizations