Utah Legislative Audit Finds Cybersecurity Gaps at Municipal Power Systems
Utah's legislative auditor presented performance audit report 2026-32, on electric and natural gas cybersecurity, to the Legislative Audit Subcommittee on Tuesday, October 20, Utah News Dispatch reported. The audit found that Rocky Mountain Power, which accounts for about 78% of electricity sold in Utah, has a mature cybersecurity posture. By contrast, municipal power systems — about 16% of sales — showed basic gaps: none of the five systems interviewed had obtained an independent third-party assessment, and none had a documented, regularly practiced incident response plan.
Auditors warned that prolonged outages would affect hospitals, drinking water and wastewater treatment, schools and transportation, and that untested plans can lengthen recovery times. Rather than prescribe a single fix, the report offers legislators options, including having the Utah Cyber Center or the Cybersecurity Commission develop a model response plan, setting baseline protection requirements, or granting liability protection to systems that adopt recognized practices.
The audit said the Utah Public Service Commission's cybersecurity oversight of Rocky Mountain Power rests mainly on its rate-case framework and is limited. Any new statewide requirements would need legislative or agency action; the audit itself sets no rules.
Published by GSM · USA (original Chinese edition)
Photo: 图：犹他州议会大厦（Salt Lake City）。摄影：Farragutful，CC BY-SA 4.0（Wikimedia Commons）。Photo: the Utah State Capitol in Salt Lake City. Photo by Farragutful, CC BY-SA 4.0 (Wikimedia Commons).
