The Federal Energy Regulatory Commission (FERC) and the North American Electricity Reliability Corporation (NERC) published a report this week on cyber planning for response and recovery that outlines best practices for the electric utility industry. The report includes observations on defensive capabilities and effectiveness of Incident Response and Recovery (IRR) plans. The report identifies common elements among the IRR plans and best practices of effective IRR plans. Not surprising, the report concludes that effective IRR plans are important resources for addressing cyber threats, and that effective IRR plans should be in place and response teams should be prepared to detect, contain, and, when appropriate, eradicate cyber threats before they can harm utility operations. While the report is no doubt valuable for IRR planning, security experts are critical of some of the recommendations. Read the CYPRES report at FERC.