Smart Grid Stimulus: Investment Grant Phase 3 Canceled. Bumpy Ride Ahead?

Early birds win again! Looks like the interest and enthusiasm for Smart Grid stimulus programs has rapidly outstripped even the government's own $3.4B largess. In an amendment dated Sept. 21, the DOE announced that:

The Department of Energy has received a significant number of high quality applications and our review continues. The dollar value of applications far exceeds the funding available under this Funding Opportunity Announcement. As a result, Phase III is canceled.

And …

Given the facts cited above, the Department may decide to cancel Phase II following final selection decisions made on applications currently under review.

So, what was intended to be a three-phase investment program in new approaches to energy and grid management has become at best a two-phase program, and likely a single shot of stimulus into the grid. Taking the amendment on its face, that the dollar value of applications already received far exceeds the funding available, we can conclude:

In the planned Phase I application period, running from the initial solicitation date of June 25 to Aug. 6, 2009, there were requests for grants far exceeding $3.4B. This means that, on average, the DOE received grant requests far exceeding $113M every business day of the Phase I application period.

Each of these applications was expected to include many things, not least among them a well-articulated security plan. You will remember, from the cyber security requirements description:

Submitted project plans are also required to include a section on the technical approach to cyber security. Cyber security should be addressed in every phase of the engineering lifecycle of the project, including design and procurement, installation and commissioning, and the ability to provide ongoing maintenance and support. Cyber security solutions should be comprehensive and capable of being extended or upgraded in response to changes to the threat or technological environment.

Yikes. And more specifically applications must include:

• A summary of the cyber security risks and how they will be mitigated at each stage of the lifecycle (focusing on vulnerabilities and impact).
• A summary of the cyber security criteria utilized for vendor and device selection.
• A summary of the relevant cyber security standards and/or best practices that will be followed.
• A summary of how the project will support emerging smart grid cyber security standards.

In 20ish years of working in security, I have seldom found an organization that could create this level of cyber security detail within six months for an existing system, much less create it in 30 business days for a brand new project.

The infusion of Smart Grid stimulus capital has definitely gotten things moving, but we should all hang on. This looks to be a bumpy ride.

Jack Danahy and Andy Bochman are authors of the Smart Grid Security Blog.