Vermont utilities describe layered cybersecurity programs; DPS outlines annual review process

The House Energy and Digital Infrastructure Committee heard an overview of grid cybersecurity on May 13, 2025, as the Vermont Department of Public Service and representatives from Vermont Electric Power Company (VELCO), Green Mountain Power and Burlington Electric Department explained how they run and oversee cybersecurity programs and how they report incidents to state agencies.

Bill Jordan, director of engineering at the Vermont Department of Public Service, told the committee that a Public Utility Commission order issued Dec. 11, 2019, established a process for the Department to convene annual, in-person meetings with electric utilities to discuss cybersecurity programs and coordination. "This order…provides a final order approving a statement of principles relative to cybersecurity for electric utilities," Jordan said, and described the order’s requirements that each utility maintain a cybersecurity program, offer briefings to the Department on request, and report certain incidents to the commissioner.

The nut graf: the meeting combined a description of the formal process the Department follows under the PUC order with utility-level summaries of security practices — including private fiber and data centers, separation of business and control systems, external audits and employee training — and a discussion of how and when utilities notify state and federal agencies about cyber events.

VELCO’s chief technology…