2023’s Exercise Program Helps Fortify America’s Energy Sector

When the lights go out during a storm or a hacker tries to disrupt the operation of a pipeline, who would you trust to get energy flowing again? Most of us would prefer a team with previous hands-on experience identifying and addressing the problem quickly, so it’s less likely to happen again. The value of seasoned critical infrastructure professionals is clear, but how can we provide that experience outside of high-risk scenarios? 

The Energy Sector Exercises Program, sponsored and led by the U.S. Department of Energy’s (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER), is designed to do just that – to give energy owners/operators and other professionals the opportunity to test their skills in low-risk scenarios, so they are prepared to respond to threats or vulnerabilities when they arise. In 2023, CESER sponsored dozens of dynamic exercises and events to meet the needs of the energy workforce, including:  

• Information Sharing Environment Analysis (ISEA) Workshop – ISEA is a process tool that identifies the organizations, personnel, activities, programs, networks, and data that make up and support a robust intelligence and information sharing capability across key partners and stakeholders. Participants at CESER’s ISEA workshop in April 2023 produced a response information sharing flow chart for cyber attacks against Hawaii’s electric utilities. 
• Continuity Communications Drill – In July 2023, CESER hosted a drill on alternative communication systems during a simulated incident. Participants succeeded in using multiple contingency communications – like satellite phones – in scenarios that tested response times and teams’ knowledge of communications systems. New to the drill this year was a focus on education and best practices, such as use of primary, alternate, contingency, and emergency (PACE) communications practices.   
• Social Media Drill – This drill, hosted in August 2023, tested the practices and processes for government and industry partners during a simulated multi-hazard incident. Participants used a simulated social media platform to listen for and respond to questions, concerns, and other information This year’s drill brought a new element: televised newscasts and the injection of mis- and dis-information into the scenarios.   
• Liberty Eclipse 2023 Full-Scale Exercise – The Liberty Eclipse Full-Scale Exercise is CESER’s cybersecurity-focused exercises series. Hosted in October 2023 on Plum Island in New York, this year’s exercise focused on advancing the federal government’s goal of strengthening cyber preparedness among public and private energy partners. 
• Clear Path XI Exercise - The 11^TH Clear Path exercise series, originally scheduled for 2023, took place in January 2024, giving participants an opportunity to respond to a fictitious but realistic emergency scenario: a strong Pacific hurricane in conjunction with a severe and opportunistic cyberattack on Hawai’i’s critical infrastructure. Over the course of two days, CESER led sessions on information sharing, continuity communications, and leveraging social media to effectively communicate with the public during an emergency.

In addition to sponsored events, CESER often plays a significant role in exercises hosted by industry stakeholders, such as: 

• Florida Power and Light Storm Drill (April 20)  
  Participants included NextEra, Florida Power and Light and other external vendors and contractors 
• GridEx VII Distributed Play (November 14-15)  
  Hosted by North American Electric Reliability Corporation (NERC) and Electricity Information Sharing and Analysis Center  
• GridEx VII Executive TTX (November 16)  
  Hosted by NERC for invited electric industry executives, senior government officials, and other key stakeholders 
• DMV Disruption TTX (December 6)  
  Hosted by National Security Council Staff and the Metropolitan Washington Council of Governments, in coordination with CESER  

CESER’s 2023 exercises were a critical reminder that the line between “blue sky” and “grey sky” days is very slim, making these learning opportunities that much more important. Ensuring that key players throughout the energy sector can test themselves against timely real-world scenarios ultimately keeps our infrastructure more secure and resilient in the face of evolving threats.  

The 2024 exercise program is based on studying what was learned over the past year and is grounded in strategic thinking about capabilities and future planning requirements. Future exercises will foster relationships with domestic and international partners, including new bilateral exercise engagements with partners in Canada. Threats to energy infrastructure are continuously changing, and CESER is committed to getting ahead of the game by working with international, state, local, tribal and territorial, and industry partners to adapt and secure our energy systems.  

Click here to read the entire End of Year report in our CESER Exercise Library.