DOE Sets 5-Year Plan to Harden US Grid Against Cyberattacks

The U.S. Department of Energy released a first-ever comprehensive strategy for securing the nation’s energy infrastructure, laying out a five-year roadmap that aims to translate broad White House cyber priorities into concrete action.

See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge

The plan, published Wednesday by the Office of Cybersecurity, Energy Security and Emergency Response, outlines how the government intends to strengthen grid resilience, accelerate the development of security technologies and improve the sector’s ability to respond to and recover from cyber incidents. Officials describe it as the office’s first formal effort to define its mission, goals and measurable outcomes in a single document.

The strategy comes amid heightened concerns over the security of the U.S. energy system, which underpins virtually every other critical infrastructure sector and is increasingly strained by rising demand tied to artificial intelligence. Energy officials say the plan is designed to align closely with the Trump administration’s broader national cyber strategy, which places critical infrastructure protection at the center of federal cybersecurity policy and calls for deeper collaboration between government and industry (see: Trump’s National Cyber Strategy Leaves Industry Role Unclear).

The strategy is organized around three priorities: developing advanced cybersecurity technologies tailored to energy systems, hardening infrastructure against both cyber and physical threats and improving the speed and effectiveness of incident response and recovery. Industry analysts told Information Security Media Group one of the most notable shifts included in the plan is not a new statutory authority, but clearer guidelines and a more detailed articulation of Energy’s operational role.

The plan “reinforces DOE as the sector risk manager responsible for resilience, response and coordination” and “meaningfully sharpens the federal approach to securing critical energy infrastructure,” said Louis Eichenbaum, former chief information security officer for the Department of Interior, who now serves as federal chief technology officer at ColorTokens.

“The real shift is toward a more action-oriented, resilience-first posture,” Eichenbaum said. “That said, it’s an aggressive plan that will require resources and execution capacity that may not fully exist today.”

The plan’s technology pillar focuses on accelerating research and deployment of tools capable of defending operational technology environments, which control the physical processes that keep energy flowing. The plan prioritizes embedding security into system design from the outset instead of layering it on after deployment.

The infrastructure hardening pillar similarly prioritizes reducing systemic risk across the grid, including strengthening defenses around generation, transmission and distribution systems as well as the supply chains that support them. Officials have warned that adversaries are targeting the broader web of vendors and service providers that underpin energy operations (see: Breach Roundup: CISA Flags OT Risks After Polish Grid Hack).

The third pillar centers on incident response and recovery, an area that has drawn scrutiny following a series of high-profile cyber incidents that exposed gaps in coordination, visibility and resilience across the public and private sectors. But the strategy’s ambitions are hampered in part by questions about execution capacity, according to analysts: Budget documents show the Office of Cybersecurity, Energy Security and Emergency Response requesting $150 million for fiscal 2026 – down from $200 million in each of the previous two fiscal years, even as its mission expands.

“The execution risk compounds outside CESER’s walls,” said Collin Hogue-Spears, senior director of solution management at Black Duck. CESER’s information-sharing model depends on the Cybersecurity and Infrastructure Security Agency as a conduit, despite CISA losing a significant portion of its staff in 2025.

“The plan assumes a partner agency operating at a capacity it no longer has,” Spears said. “Add the plan’s scope expansion across cybersecurity, physical security, counter-UAS and facility hardening, and CESER is asking 66 people to coordinate across more mission areas than 96 people managed before.”

Analysts say that mismatch could force DOE to rely more heavily on automation and AI to scale its capabilities, particularly through initiatives such as AI-FORTS, which is designed to detect threats, maintain operations during incidents and improve supply-chain oversight.

But that reliance can introduce its own risks, analysts noted, especially in operational technology environments where errors can have physical consequences. Autonomous defensive systems must operate with a high degree of precision, experts said, because false positives in energy systems can disrupt critical services in ways that mirror the impact of an actual cyberattack.

The strategy also highlights persistent disparities across the sector, particularly among smaller utilities that lack dedicated cybersecurity staff or resources. Energy has pointed to existing programs such as the Rural and Municipal Utility Cybersecurity initiative as a way to bridge that gap, but experts say adoption remains uneven.

The plan does not impose new regulatory requirements outside emergency scenarios, but directs utilities toward a set of voluntary practices focused on resilience, access control and risk reduction. Even basic measures such as enforcing multifactor authentication and limiting privileged access can significantly reduce risk without requiring major new investments, experts said.

“Large operators can take on new requirements quickly, but smaller and municipal utilities are often stretched thin,” said James Maude, field chief technology officer for BeyondTrust. The biggest challenge in improving the U.S. energy sector’s cyber resilience is uneven capability, he said. “Even the best strategy doesn’t help if a utility is struggling to patch systems or keep track of who can access what.”