APPA Launches First-Ever Cybersecurity Committee to Defend America's Public Power Grid

The American Public Power Association has launched its first dedicated Cybersecurity Committee to unify digital defense strategies across public power utilities nationwide — a move officials say is critical to protecting millions of Americans from grid-disrupting cyberattacks.

The formation of this committee marks a significant turning point for a sector long criticized for fragmented and siloed security planning. Public power utilities operate interconnected physical assets alongside both information technology and operational technology networks — creating a complex attack surface that sophisticated adversaries have increasingly targeted. With this new governance body now in place, APPA is betting that centralized strategic coordination can raise the collective defensive barrier across the entire public power ecosystem.

---

A Centralized Command for a Fragmented Defense

Before this committee existed, APPA's cybersecurity resources were spread across disconnected working groups, training programs, and standalone playbooks. The new Cybersecurity Committee consolidates that architecture under a single governance body designed to align strategy, maximize resources, and establish a unified threat-response posture sector-wide.

The committee's mandate covers three core pillars:

• Oversight of the Cybersecurity Defense Community (CDC) — APPA's primary working group responsible for updating utility resources and planning the annual Cybersecurity & Technology Summit.
• Centralized deployment of two foundational documents — the Public Power Cyber Incident Response Playbook and the Public Power Cybersecurity Roadmap, both of which serve as operational cornerstones for member utilities navigating an evolving threat landscape.
• Advisory oversight of the Cyber Pathways program — operating under a cooperative agreement with the Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESER).

For utilities looking to benchmark their current posture against proven standards, understanding how to build a robust and structured cybersecurity strategy is an essential starting point before engaging with APPA's new governance framework.

Scott Corwin, President and CEO of APPA, underscored the urgency behind the launch. "It is vital that public power utilities have access to the latest tools and information they need to successfully meet ever-evolving cybersecurity threats," Corwin said. "The Committee will play a key role in helping APPA members make the most of the resources that APPA offers to them when it comes to cybersecurity vulnerabilities."

Leadership Driving the Committee Forward

Nick Lawler, General Manager at Littleton Electric Light & Water Department in Massachusetts, will serve as Committee chair. Mike Willetts, Director of Training and Safety at the Minnesota Municipal Utilities Association, will serve as Vice Chair.

"It's an honor to lead this Committee, and I am looking forward to working with Mike and the APPA team," Lawler said. "The Committee will work to ensure that APPA's cybersecurity efforts continue to effectively assist members as they tackle cybersecurity threats."

The appointment of utility-level practitioners — rather than federal appointees or policy generalists — signals a deliberate effort to keep the committee grounded in operational reality. Those closest to the grid's daily vulnerabilities will now be steering the sector's collective defensive posture.

---

Gamifying Grid Defense: The Cybersecurity Accelerator Program

One of the most tangible programs under the committee's strategic umbrella is the Cybersecurity Accelerator Program (CAP) — funded through the Cyber Pathways initiative and designed to help utilities evaluate and improve cybersecurity maturity across both IT and OT networks.

Rather than functioning as a pass/fail compliance audit, CAP uses a tiered designation structure that rewards demonstrated capability and establishes clear defensive benchmarks:

• Gold: Utilities validating foundational cybersecurity practices across governance, risk management, and incident response
• Platinum: Utilities demonstrating advanced cybersecurity execution positioned well above core practices
• Diamond: Utilities operating elite cybersecurity programs that exceed core practice standards by a significant margin

This ranking structure mirrors the kind of maturity-based progression frameworks used across leading industries — where capability is earned incrementally, publicly recognized, and held to objective standards. The evaluation covers cybersecurity governance, structured incident containment, grid risk prioritization, and training protocols.

Bridging the Executive and Technical Divide

Critically, the CAP application process requires collaboration between executive leadership and technical subject matter experts — directly addressing the historical divide between utility boards and IT/OT engineers who have long operated in separate conversations. This structural requirement is one of the program's most meaningful design decisions, forcing organizational alignment as a prerequisite for designation.

Utilities seeking CAP designation must submit their application — including program checklists, supplemental information, and supporting documentation — by June 30, 2026.

---

What This Means for Infrastructure, Utilities, and Everyday Americans

The stakes behind this governance shift extend well beyond boardrooms and CISO dashboards. Critical infrastructure is inherently interdependent, and a cyberattack on even a small municipal utility can trigger cascading failures into broader regional transmission networks — a reality that grid security professionals have long treated as a primary concern.

Extending Protection to Smaller Utilities

The committee's strategic reach includes smaller utilities through programs like OT Insight, which deploys sensor technologies to smaller plants that may lack the internal resources to monitor their own operational technology environments. By bringing these entities into a cooperative defense ecosystem, APPA significantly raises the cost of entry for adversarial threat actors targeting the North American bulk power system.

Smaller utilities have historically represented the path of least resistance for threat actors. Integrating them into a shared defensive architecture is not merely an inclusion exercise — it is a strategic necessity.

Grid Resilience as a Community Issue

For everyday consumers, this structural alignment translates directly into grid reliability. Public power utilities serve millions of Americans, and when an association audits supply chain risks, upgrades incident response playbooks, and aligns defensive standards, the likelihood of a catastrophic cyber-induced power outage decreases meaningfully. Local economic stability, public safety systems, and continuous electricity delivery all depend on that outcome.

Consumers are encouraged to engage with their local public power providers directly — asking what cybersecurity frameworks and incident response plans are currently in place. Grid resilience is a community issue, not solely a technical one.

Alignment With Industry-Vetted Frameworks

The committee's work aligns member utilities against industry-vetted frameworks including the Cybersecurity Capability Maturity Model (C2M2) and CISA Cross-Sector Performance Goals — giving utility CISOs a standardized baseline to measure current capabilities against proven benchmarks.

Understanding how established cybersecurity frameworks guide organizational risk decisions is increasingly important for utility leaders navigating both regulatory expectations and real-world threat actors. The C2M2 in particular offers a structured, self-assessment-friendly model that complements the CAP designation process directly.

For organizations that want to go further, developing a comprehensive information security strategy aligned to organizational risk provides the foundation upon which CAP compliance and maturity designations can be meaningfully built — rather than treated as isolated checkboxes.

For additional context on the federal frameworks underpinning grid cybersecurity efforts, the CISA Energy Sector security resource hub provides authoritative guidance on cross-sector performance goals and critical infrastructure protection priorities.

Practical Actions for Utility Professionals and Local Officials

Utility professionals and CISOs should review the CAP application guide immediately given the June 30, 2026 deadline and begin mapping their current cybersecurity posture against the program's tiered designation criteria. Early self-assessment against C2M2 benchmarks will reveal gaps that take time to remediate — time that is already running.

Local government officials and utility board members should use this committee's launch as a prompt to close the governance gap between executive leadership and technical security staff — a gap the CAP process is specifically designed to address. Boards that remain detached from cybersecurity planning are a structural vulnerability in their own right.