PA House Consumer Protection, Technology and Utilities — 2026-09-01

Thank you. Thank you.

Joe Hohenstein, House District 177.

Pat Gallagher, Representative 173rd.

Good morning, Danilo Boutigals, Chairman, 197th Legislative District.

And I would like to have any members that are online, please introduce yourselves.

Representative Jessica Benham, 36th District, Allegheny County.

Good morning, Representative Steve Maligari, 53rd District, Montgomery County.

Thank you, Chairman. I was thinking on the drive up this morning how you can contextualize the modern cybersecurity warfare space. There was a time when I was stationed in the Pentagon around 2004 to 2006. We worked on PCs all day long. We had a low-side computer and a high-side computer, and everything that we did classified had to be on those PCs and didn't leave the building. And everyone in the room remembers the day when we had the little BlackBerry with the little thumb wheel, And that was our one opportunity to have email in our pocket. And even at that, we weren't allowed to have any classified information on those devices. Now, we walk around, as I tell my constituents often, with a computer in our pocket that is far more powerful than any computer I had in college. And it's not just the power of the computer that's in your pocket. It's the information that's on it. That's just in your personal life. Now, I did cybersecurity in the utility sector for a long time, and we participated in grid Xs on the utility side nationwide, I think, on an every two-year cycle. And I was always astonished at the moment when the grid would fail. And it rarely had anything to do with computers, and it had everything to do with people and security equipment. And it caused me to think more globally about, you know, what are we going to do with cybersecurity into the future? And cybersecurity in the future is about supply lines, which the federal government started to address this week. It has to do with human vulnerabilities. Phishing and getting into the computer systems of utility is almost always accessed by a human who's being careless. So that's something to do with internal utility policies less than it has to do with IT infrastructure. And those are the things that we've got to deal with, both as a matter of statute and as a matter of regulation, which is why I'm glad we get to talk to Chairman DeFrank today. Chairman Burgos, Chairman Gallagher, I very much appreciate this conversation. It's something that I'm passionate about, and I look forward to the testimony. Thank you.

Thank you Good morning subcommittee chairman Gallagher and Williams and Committee Chairs Burgos and Metzger and members of the House Subcommittee on Utilities of the House Consumer Protection Technology and Utilities Committee. My name is Steve D. Franken, and I'm the Chairman of the Pennsylvania Public Utility Commission. I appreciate the opportunity to testify before the Subcommittee today, this informational meeting and briefing on the critical topic of utility cybersecurity mandates, ratepayer cost allocation, and regulatory oversight. The Commission is charged with ensuring that essential utility services remain safe, reliable, and affordable for all residents and businesses across the Commonwealth. As critical infrastructure systems increasingly rely on interconnected digital networks, cloud environments, industrial control systems, and operational technology to deliver essential utility services. Safeguarding these assets against sophisticated cyber threats becomes fundamental to both utility reliability and public safety. At the same time, Pennsylvania ratepayers deserve secure, resilient utility services without bearing unreasonable or excessive financial burdens for baseline security compliance. Balancing robust critical infrastructure protection with consumer affordability and ratepayer protection lies at the heart of the Commission's mission. I have submitted a full testimony that highlights the Commission's proactive cybersecurity initiatives, discusses the history and scope of the Commission's cybersecurity oversight, the role of the Office of Cybersecurity Compliance and Oversight, or ACCO, and proposed rulemaking to enhance utility cybersecurity requirements and incident reporting and ratepayer protection and cost allocation principles. I will use my time here today, this morning, to address some key areas. The Commission took the important step of formally establishing the Office of Cybersecurity Compliance Oversight, or ACCO, and appointed a dedicated director to lead the agency's cybersecurity oversight initiatives in 2018. The ACO serves as the Commission's principal technical advisor on all external utility cybersecurity matters. The ACO handles incident response and emergency coordination by serving as the Commission's immediate contact for utilities during active cyber incidents and directing the Commission's cybersecurity incident response team. The ACO Director is my designee for cybersecurity matters on the Governor's Emergency Management Council during activation of the Commonwealth Response Coordination Center and leads the agency execution under the Pennsylvania Cyber Incident Index. The ACO also conducts rigorous after-action reviews following incidents. Additionally, the ACO actively monitors real-time threat intelligence feeds from private, state, and federal partners, coordinating the issuance of immediate secretarial letter advisories and alerts to vulnerable utilities. For example, in March 2026, the Commission issued a secretarial letter to all jurisdictional utilities and licensed electric generation suppliers and natural gas suppliers to share recommendations due to the potential for increased cyber activity targeting domestic critical infrastructure. More recently, in July of 2026, the Commission issued a secretarial letter to all jurisdictional water and wastewater utilities regarding recommendations to prevent the exploitation of OT systems. DiACO also advises the Commission on the reasonableness and prudency of cost recovery claimed in base rate cases for utility cybersecurity capital expenditures software investments and incident response claims On June 18, 2026, the Commission approved a comprehensive Notice of Proposed Rulemaking, or NOPR, related to cyber hygiene. Guided by ACO's technical analysis, this rulemaking transitions from a self-certification to an objective, verifiable regulatory framework. The NOPR modifies Commission regulations by creating new rules regarding evaluations, programs, standards, and plans to impose objective requirements grounded in the standards established by the National Institute of Standards and Technology, or NIST. Its key inclusions include revising security and privacy controls for information systems and organizations to protect information systems and organizations from diverse threats, and updating operational technology security in a manner designed to protect hardware and software that monitors, manages, or controls physical equipment. The NOPR also aims to bridge IT networks and operational environments to avoid a burdensome one-size-fits-all mandate. It establishes a tiered classification framework based on the number of customers a public utility serves and its digital risk profile. The NOPE also updates cybersecurity incident reporting across jurisdictional utilities, specifically including reportable thresholds that cover incidents on utility networks or connected third-party systems causing service outages, compromise or loss of control assets, network risk, or public danger. It further proposes strict reporting timelines to require verbal reporting to the Commission within 72 hours of discovery and immediate 24-hour reporting for ransomware attacks. The Commission's fundamental role was to ensure regulated utilities are making necessary investments to provide baseline cybersecurity without overinvesting in their system. With the ACO's technical support, the Commission evaluates cybersecurity expenditures under established rulemaking principles that include baseline operational duty of care, capital investments, and cost allocation prudency. Routine software patch management, multi-factor authentication, identity governance, basic employee training, and baseline NIST compliance are standard costs of running the utility effectively. Ratepayers should not be subject to special surcharges, riders, or capitalized rate-based treatment for baseline operational hygiene. Instead, ratepayers should only pay for prudent cybersecurity expenses on a dollar-for-dollar normalized level where the shareholder shoulders the risk for price spikes or excess spending. Because cybersecurity is often a shared corporate service, The Commission reviews cost allocation methodologies to ensure security costs are allocated between regulated and non-regulated entities fairly, so ratepayers only pay their portion of the cost. When utilities seek rate recovery or accounting treatment for cyber programs, the Commission exercises its statutory authority to ensure that every rate made, demanded, or received is just and reasonable. Securing Pennsylvania's critical utility infrastructure against modern cyber threats is essential, but must be accomplished without placing unreasonable financial burdens on Pennsylvania families and small businesses. supported by the ACO's technical and rate-making expertise, holds utilities accountable for maintaining reasonable cyber fitness, while ensuring cost recovery is reserved strictly for prudent, verifiable resilience investments. The Commission looks forward to any collaboration and further discussion with the legislature on these vital issues. Thank you for the opportunity to testify today. I'm happy to answer any questions the committee members may have.

Chairman Burgos, Chairman Metzger, members of the committee, fellow panelists, thank you for the opportunity to be here today. My name is Jeremy Young. I am president and CEO of FRC, a Pennsylvania headquartered technology and professional services company serving government and public sector organizations. I spent nearly 30 years in technology, including cybersecurity, data infrastructure, and public sector technology. I want to leave you with one central recommendation. Pennsylvania should move from measuring cybersecurity spending and compliance activity to measuring cybersecurity outcomes. For this committee and for Pennsylvania ratepayers, I think the question is even simpler. If we are paying for cybersecurity, how do we know those investments are actually making us safer? The question is becoming increasingly important because a threat environment is changing rapidly. Attackers now have access to automation and artificial intelligence that can accelerate reconnaissance, phishing, vulnerability, discovery, and exploitation. A utility may have thousands of employees, devices, applications, identities, suppliers, systems, and vulnerabilities to protect. An attacker only needs one successful path. In a security control that worked when it was audited six months ago may not be working today. That's why I believe cybersecurity needs to become a continuous risk management discipline rather than a periodic compliance exercise. The good news is Pennsylvania doesn't need to invest or invent this model from scratch. The federal government has spent years developing frameworks and programs we can build upon. CISA's continuous diagnostics and mitigation program is designed to give federal agencies ongoing visibility into questions such as what's on the network, who's using it, what's vulnerable, what's happening, what risk matters most, and what should we do to fix it. CISA has also developed cybersecurity performance goals specifically for critical infrastructure. And NIST gives us a common framework built around six functions, govern, identify, protect, detect, respond, and recover. The principle I take from these efforts is straightforward. Risk changes continuously. Our understanding of risk should as well. So what should Pennsylvania do? I would focus on seven areas. First, know what we're protecting. Utilities should maintain current inventories of critical IT. operational technology, applications, data, identities, internet-facing assets, and important third-party systems. You cannot effectively protect what you do not know exists Second continuously monitor critical security controls An annual assessment tells us whether a control worked when it was tested It doesn necessarily tell us whether it's working today. Monitoring should be proportional to risk with greater assurance around the systems and controls that matter most. Third, validate that those controls actually work. There is a difference between having a cybersecurity control and knowing that it's effective. Having backups don't prove that they can be restored. Having an incident response plan doesn't prove it'll work during an attack. Don't simply assume a critical control works. You test it. Fourth, establish risk-based remediation. Finding vulnerabilities accomplishes very little if you don't fix them. The question should be, how serious is the risk? How quickly should it reasonably be corrected? Was it corrected? And if not, why? Fifth and particularly important for this committee, connect cybersecurity spending to risk reduction. If a utility seeks recovery for a significant cybersecurity investment, regulators should increasingly understand what risk existed, what investment was required, was the control implemented, was it validated, what evidence demonstrates that it works, and what risk remains. In other words, risk, investment, control, validation, evidence, risk reduction. Ratepayers should support reasonable investments necessary to protect critical infrastructure, but in return, we should increasingly expect evidence that those investments are producing meaningful risk reduction. Six, treat third-party and supply chain risk as a utility risk. Utilities increasingly depend on software companies, cloud providers, telecommunication companies, equipment manufacturers, contractors, and AI providers. A utility can have excellent internal cybersecurity and still inherit significant risk through a supplier. Their risk can become our risk. And seventh, prepare now for AI and the workforce challenge. AI will increasingly become embedded in utility operations. We need to understand where it's being used, what data it accesses, what decisions it influences, and who is accountable for the risk. At the same time, technology alone will not secure Pennsylvania. We need trained people capable of operating these systems, managing risk, responding to incidents, and protecting both information technology and operational technology. technology. This is particularly important for smaller utilities and communities. Other states are already moving in this direction and federal agencies, CISA, NIST, and the Department of Energy have already provided much of this foundation. My recommendation is that Pennsylvania build upon those efforts and consider beginning with a pilot rather than another broad mandate. Work with a small number of willing utilities. Identify a limited number of high-priority security outcomes. Establish the critical assets and baseline risk. Monitor the important controls. Test whether they work. Establish remediation timelines. Track the investment And measure whether risk actually declines In simple terms know what we have know what matters protect it monitor it test it prove it and fix what fails And then ask the question that matters most. Did the investment actually reduce risk? I don't believe Pennsylvania should tell utilities which cybersecurity products to buy. I believe we should give utilities flexibility in how they achieve cybersecurity outcomes while requiring evidence that those outcomes are being achieved. because ultimately the question for this committee and Pennsylvania ratepayers should not simply be how much should we spend on cybersecurity. It should be are Pennsylvanians safer because of it. Thank you, and I look forward to your questions.

So I think that's the balancing act that we do in all facets of a rate case. That's determined in the rate case. And as I pointed out in my testimony, our director of ACO reviews rate cases to make sure the expenses claimed by the utility is we're getting a bang for our buck. That's the balance here. You know, we can be in a perfect – we can reduce all risk. We probably can't afford the rate then to reduce all risk. So it's a balance of how we make sure we're safe with baseline safeguards. we've talked about in my testimony, without overspending at the ratepayer's expense. That's the balancing act that we're trying to achieve. But all that is done in the rate case process. When a utility comes in for a rate case, those are part of a laundry list of expenses that they're looking to recoup in that rate case.

Thank you, Mr. Chairman. Chairman DeFrank, I would like to direct my questions to you also, and they're right in your wheelhouse. I was recently at a national conference dealing on affordability in the energy sector, and there was a moment when we were actually co-located with a conference of regulators. And so legislators and regulators spent an entire afternoon kind of doing problem solving, and I was struck by a prevailing sense from the regulatory side, from the commissioner side, that they just need the legislature to get out of the way. And I'm so grateful that that's not your view of our role in the regulatory space. In fact, you and I are together professionally committed to this basic precept of administrative law, which is the commission can do nothing without enabling legislation. I've listened carefully and read the outline of the ANOPR relative to where we're going with cybersecurity and the utility side, I think, on all three sectors, gas, power, and water. I believe that you have the legislative authority to do that under your requirements to guarantee a reliable grid and a reliable water and gas infrastructure. Do you believe you have the authorities that you need, and is there anything more you need from us?

Yeah, and I assumed that was going to be your answer, too, based on the nature of the ANOPR and its reliance on current authorities under Title 66. I asked the question, having been a cyber lawyer in the power space, in the utility space, and prior to ACO coming online, the requirement of the utilities was simply to write a letter back to the PUC on an annual basis and say, we have a cybersecurity plan. And I'm not exaggerating. That was the entire compliance apparatus for the utility. I think from the utility point of view, that's probably good, because you're not disclosing anything about your plans. You're not disclosing anything about what the infrastructure is, which then, of course, avails you to an attack. But it also precludes public oversight, right? There has to be a balance in there. And I want you to know, by way of a comment, not a question, that I perceive the ANOPR in that spirit. Thank you.

Yeah, and unfortunately in the legislative space, it is very difficult for us to write standards. That's why we have recurring both state and federal expressions of what the new cybersecurity standard is, because it's outdated almost as soon as you write it, which is why tying state regulations to NIST standards are, again, antedated the moment you write them. So, again, thank you, Mr. Chairman.

Thank you. Mr. Young, just to start, it makes me very proud that we have our own homegrown Pennsylvania company leading the way on this issue. I know you're providing services across the country for other states, and I think that's something that we can all be very proud of. Just two really quick questions. I know that whether it's a corporate boardroom or a governmental entity, sometimes we just simply have this perfunctory approach to cybersecurity where we once a year we look at it as an annual checkup, and, yep, we're doing something. Do you think that's enough anymore, or is that something that we need to change our perspective on?

you know we have a particularly on our electric side, but in all of our utilities. We have a rising rate market, and the ratepayers are unhappy with that. I'm unhappy with that. I don't think anybody in this committee wants to see anything that increases rates. So from a cybersecurity standpoint, how can we be, I guess, maybe more accurate in our approach to cybersecurity and those threats and limit that threat to the ratepayer with regard to the cybersecurity on one side, but also the rate increases on the other. So I need to be able to defend against these threats well, accurately, and not increase that cost to my ratepayer. What's the best way to do that, Jeremy?

Thank you.

Good morning Chairman Gallagher Chairman Billings and members of the committee Thank you for the opportunity to be here My name is Sumit Nair and I am the Chief Information Officer for Essential Utilities the parent company for Aqua Pennsylvania and People's Natural Gas. I want to start with the bottom line. To date, neither Aqua Pennsylvania nor People's Natural Gas has experienced a cybersecurity incident that has disrupted our operations, interrupted service to a customer, or caused a material financial impact to the company. That's not because the threat isn't real. Water, gas, and natural utilities alike are consistently targeted by criminal groups and nation-state actors, and that activity has only increased in the recent years. Our clean record to date reflects the fact that we built a cybersecurity program designed for that reality, not that the threat has passed us by. Cybersecurity is a strategic organizational priority supported by a dedicated team of cybersecurity professionals whose primary responsibilities are protection of the critical infrastructure, information assets, and our operational systems through risk management, security oversight, and continuous program improvement. Our program is aligned to the NIST cybersecurity framework. That's basically the standard used across critical infrastructure sectors, and it covers both our information technology systems and our operation technology that physically runs our water and gas infrastructure. Without getting into specific tools or configurations in this setting, what I'd like to say is that the program includes continuous monitoring, modern identity and access controls, regular independent testing, workforce training, and a tested incident response capability. Cyber security risks, strategy, and program performance are reviewed by a cross-functional cyber security committee of senior business executives and executive leaders with regular reporting provided to our board of directors. We treat this as an enterprise risk, not just an IT issue. I'm glad to go into deeper specifics with the committee staff. in a closed setting if that's what you're looking for and if it's going to be useful. Now going to the financial side, we treat cybersecurity spending as a normal, prudent part of running safe and reliable utility operations. The same way we treat the investment in pipes, treatment plants, distribution infrastructure. We have not had to recognize a material loss or an extraordinary charge tied to a cyber event, and there has been no cyber event-related impact on customer rates. Most importantly for this committee, we have not had a cybersecurity incident that affected the public health and safety or that interrupted water or gas delivery to a single customer. Keeping the water running and the gas flowing safely is the entire point of this program. Everything else we do is in service of that. None of this means we consider it solved. Cyber security isn a project with an end date for us It a continuous discipline of assessment investment and adaptation as the threat environment keeps moving We're committed to stay ahead of it and to working closely with the PUC, our industry peers, and our state and federal partners to do that. Thank you for having me today, and I'd be happy to answer any questions you may have.

You did a really good job. I'll say it again, though. Good morning, Chairman Burgos, Chairman Metzger, and members of the committee. My name is Craig Fonestock, and I am testifying on behalf of the Pennsylvania Municipal Authorities Association. PMAA represents nearly 700 municipal authorities providing drinking water, wastewater, and other essential services to roughly 6 million Pennsylvanians. We also have more than 500 associate members providing professional expertise such as IT and cybersecurity support. Cybersecurity is no longer solely an IT issue. It is a water supply, public health, environmental, and public safety issue. Under the Municipality Authorities Act, authorities are independent public entities governed by locally appointed boards. Many serve multiple municipalities and operate on user fees rather than general tax revenues. Their mission is to deliver reliable, safe services at an affordable cost. A cyber attack against an IT system is serious, but an attack against operational technology can interfere with the physical operation of a facility, disrupt treatment or distribution, and interrupt essential public services. These threats are real, and as we've seen recently, federal agencies have issued repeated warnings about attacks affecting the water sector. In preparation for today's hearing, I spoke directly with members about cybersecurity. All of them are working to address it, but their resources vary considerably. Pennsylvania and federal government already have significant cybersecurity-related requirements and resources for the water sector. Any additional requirements should build on and coordinate with these existing framework rather than duplicating it. If a SCADA system goes down at 2 a.m., can our operators keep the plant running safely? Authorities must be prepared to respond, recover, and continue essential operations when technology is unavailable, including operating critical systems manually when necessary. Cybersecurity requires significant and recurring investment. These investments are necessary, but cybersecurity now competes for the same limited resources needed for pipes, pumps, and other capital improvements. Dedicated funding and technical assistance can strengthen protections without forcing authorities to defer critical infrastructure investments or place the entire burden on ratepayers We asking for requirements that are achievable coordinating with what authorities already do and accompanied by the resources necessary to implement them Our written testimony includes detailed policy recommendations, but today I'd like to focus on five key principles. Any statewide cybersecurity approach should be risk-based and scalable, build upon and coordinate with existing state and federal requirements, be technology neutral and focused on meaningful risk reduction, provide adequate funding and technical assistance, and recognize vendor and supply chain risk. Success should be measured by reduced cybersecurity risk and improved ability to respond and recover from an incident. Cybersecurity is a shared critical infrastructure challenge. PMA is committed to helping our members with that challenge. We ask that any framework establish reasonable expectations while providing the funding, technical assistance, and flexibility needed to meet them. Ultimately, this is about protecting the people and the communities we serve. Thank you for the opportunity to testify before you today.

And how can the Commonwealth incentivize a culture of transparent information sharing? Could you repeat that, please?

Our members take this issue very seriously. They are, as we've listened to other presentations today, doing risk assessments. They are preparing for cybersecurity issues. Barriers that they have with reporting to the state, I'm not sure I can answer what barriers you're referring to. Are you talking about financial barriers? Well, challenges in general. Smaller authorities particularly do not have IT staff, sometimes dedicated IT staff. They rely on third-party vendors. We've heard in a previous answer about the concern about the supply chain, those vendors' who's protecting them. Some of the smaller authorities, particularly in more of the rural areas, do not have access to some of the more SCADA integrators. That's a big concern. We've heard about workforce issues with every industry. There's not that's very similar in the SCADA industry. Those access to expertise, people with expertise can be barriers. I hope that answers your question.

Thank you, Mr. Chairman. And I think most people would be actually surprised at the prevalence of attacks on the water system. I think their intuition based on Mission Impossible and James Bond movies is they're always attacking the power sector, whether it's gas or electricity. But they don't know that water is almost always under attack as well. Just this year in July, we have foreign state actors who came in a multi-state water and wastewater attack by way of, I think, cell phones. In the last two years, we had Russia coming after water systems throughout Europe. January of 2024, Biolia, North America, was attacked again by state actors. It's constant. In the same way that the power sector is being attacked as well. I don't want to single out water. I just want to emphasize the importance of safeguarding our water systems as well. I'm concerned about and want to make sure we're providing all the assistance that we can, Mr. Fanestock, to our municipal authorities. I'm not terribly worried about the private sector only because we're going to lean heavily on them to put their financial resources to bear to make sure that their systems are protected and then hold them to account. But the municipal systems need our help. And that's similar to the chairman's question. My open-ended question back to you is what do you need from us? What do you sense that they are asking by way of regulatory help? Do you think the PUC's water and NOPR is on target with respect to its requirements? I have the Chester Water Authority in my district, and they are a top-shelf water system. I want to make sure they have the resources they need.

Anything else? No, that was very helpful. Thank you very much.

Representative Nelson. Thank you so much. As an Aqua customer, I mean, I think this is certainly a very useful and pertinent conversation. And I appreciate the work that you all and all of our utility companies do in ensuring that the natural resources that our communities and our residents rely on are sent into our homes, are distributed, are delivered appropriately. Frankly, none of you all were built to be cybersecurity experts, and I know that it is a portfolio that is growing within each of your individual organizations. Can you talk a little bit about the insurance implications of this new environment? Are you all finding yourselves to be liable for any additional claims? Is this become a conversation that you all are having on, I'll call it the cybersecurity risk, as our insurers are looking at each of your organizations? Right.

Thank you, gentlemen, for your testimony. I appreciate your time. Thank you.

Okay, we will now hear from the third group of panelists. I would like to ask the following individuals to please come forward. Mr. Brian Harrell, Mr. Stephen Elwey, McElwey. Wow, I'm brutal with names today. Panels, your full written testimony will be entered into the official record. We ask that you limit oral remarks to five minutes so members have a maximum time for questions. We will start from left to right. Sir, please introduce yourself and who you represent.

Thank you, Mr. Harrell. Mr. McElwee, did I say that right?

Thank you for all your testimony. We will now move to questions from committee members. I will recognize members for five-minute rounds, alternating between majority and minority. I'll start. If a localized cyber attack compromises communications or water systems, What protocols are in place to ensure the electrical grid remains resilient enough to support those other critical sectors? Mr. Heller.

Thank you, Mr. Haller.

Well, thank you, sir, for your question. And I think genuinely I can say that the electricity sector, by and large, has taken a lot of that low-hanging cyber fruit off the tree. Yes, the big four nation-state adversaries, they're looking at the bulk power system full stop, obviously. But I think what we have done, maybe unlike other sectors, is we've embraced basic cyber hygiene. No, we don't have default passwords on our PLCs and our energy management systems. We test everything before it goes into a live environment. Other sectors may not do that step. Fortunately, we do. We've also built a culture of security. From the CEO to the person in the bucket truck to the executive assistant, they feel like they are part of the security apparatus to protect critical infrastructure. That's not really answering your question, though. I think what really keeps me up at night is while we have done a really good job of protecting ourselves it is the third supply chain It is our vendors It is the consultants that may have your data our data customer data that we need to be just as sharp with them on ensuring that they say, they are doing what they say they have done in the third-party procurement process as we go into a business relationship with them. So again, ensuring that, you know, when you go five and six layers deep in that supply chain that it doesn't get, you know, nation-state adversary heavy. We are asking the probing questions on the front end rather than deal with security on the back end. And as you know, going all the way back to President Obama, every presidential cycle has dealt with executive orders around our supply chain on not just the cybersecurity space, but our security space generally, whether it's physical or cyber. To that end, have you had an opportunity yet to review the PUC's proposed rulemaking, and do you think it adequately addresses, as a query, the problems with third-party supply chains? Admittedly, I have not, but I certainly will as a homework assignment after this. But I think so long as it ensures that security has a prominent seat at the table as we go into these business decisions, you know, rather than be the department or no or the Darth Vader figure at the very end where we're stopping business, instead we're highlighting risk before we ever sign the dotted line. Thank you. That's very helpful.

Representative Haddock.

Yes, Representative, it's a good question. And I I can't give you a specific ranking of each state. I do recognize that each state takes a different role, and I think that the level of effort that Pennsylvania has been demonstrating in terms of regulation and alignment with the NIST cybersecurity framework has been a very positive move, and I think it does set Pennsylvania apart. And I think I'm very happy to hear about the NOPR and where Pennsylvania is going. I do think that, as you mentioned, PJM is across 13 states. And as we look at how each state fits in, we really look at it through the lens primarily of our asset owners, like First Energy, to make sure that we're working with them and we have resiliency built in through our contingencies and we're able to operate despite disruptions that we may have locally. But I do think that Pennsylvania is at the leading edge by introducing these standards.

Haddock. Representative Nelson. Thank you. And I appreciate that answer and question as well as the prior question on kind of what keeps you up at night. I can tell you what keeps me up at night is this slight sense of helplessness, because to talk about this in IRVS 515, understanding that what we're really trying to figure out is how in the world we protect our local residents from actors in Iran, China, North Korea, AI, quantum-enabled computing. it feels wildly, wildly, wildly above our pay grade. I'm pretty sure that there is no valve along our state borders to Ohio, West Virginia, New York, New Jersey, etc. that says we can protect Pennsylvania because of our rulemaking and rape me. So I guess the real question for you both, especially since your entities are spending goo-gobs of money on this and are looking at this across multiple states, can we all appreciate that this is – there is a role for state governance. This is significantly and appreciably a federal requirement, though. How do we understand how our states are able to work alongside a federal government? And are you confident that what's happening in Washington is getting us anywhere close to these sort of assurances that we need here in Pennsylvania and across all the rest of the 12 states, PGM Interconnected Systems? Are we doing anything in Washington that's going to help ensure that our work here is meaningful and not, you know, taking a water gun to this bike?

Can you speak more on the utilities that are not federally? I mean, I think we had some prior, I can imagine wastewater being one, but that are not federally regulated.

Thank you, sir, for your question. I like to use the A word a lot, and that is anticipate. How do we anticipate what we think the enemy might be doing with the tactics, techniques, and procedures that they're trying to deploy here stateside? The way we try to get ahead of that is the relationships that I think you're speaking to in Washington D whether it the Cybersecurity and Infrastructure Security Agency the Department of Homeland Security FBI DOE the Electricity Information Sharing and Analysis Center at NERC or even here locally with our fusion centers we are in lockstep with them to number one take all of that threat stream that threat data, consume it, understand it, dissect it, push it into our system so that we're now threat hunting in our own system before things ever materialize. We're trying to find these rogue IP addresses and things like that in our system. But in Washington, D.C., I think it's a two-way street. I could say this, you know, having worn multiple hats here. You know, I want to take good government information and input it into my system, but I also want to educate our government and national security partners as to what matters, what doesn't matter, what doesn't matter, and what the real impact could be of doing nothing. And then, of course, always demonstrating smart investments when it comes to reducing risk.

So my name is Jackie Zhao. I'm the Director of Cybersecurity for Philadelphia Gasworks, PGW. So we're located in Philadelphia and Pennsylvania. So PGW is the nation's largest ministerially owned natural gas utility, and we serve 500,000 customers. And for the last 190 years, PGW has...

Thank you Representative Malagari can you please acknowledge by speaking so we can see if it working

And Mr. Nair, does your current disaster recovery plan specifically include a cyber blackout scenario where manual analog operations of gas distribution systems is required for an extended period? Thank you, Representative Gallagher, for the question. We do an annual tabletop for our cyber exercise. We simulate a particular event, and we do that. But we also do an annual disaster recovery around the fall time to see if our systems come back online kind of immediately. Those have been done for years, and we can restore our gas systems, at least the information systems, almost real time. we're able to come back to. We also test manual failover and if gas operations can continue their sort of operations annually. Both tests are done for information systems as well as the gas operations.

Thank you, Mr. Chairman. and Chairman Burgos thank you for calling this meeting not only our subcommittee but the standing committee as well you know this has been a good exploration of generalized questions from as you know one representative said folks who are probably in over their head when it comes to this subject matter is somebody who practiced this body of law for more than a decade I can tell you that the conversation and the learning never stops. And it's because the threat never stops. It's persistent, as one witness put it today. Now with the advent of AI and the incorporation of AI by our adversaries, it is a threat that is tireless. It's coming at us constantly. So I think it behooves us, Mr. Chairman, to continue this conversation, to figure out what we can do as a General Assembly by way of rules or funding to make sure that we're on top of these constant attacks. And thank you for your time.