A storm plan that assumes the control room's screens and phones still tell the truth may overstate how fast a facility can recover. Grid security specialists have been making that point for a year, and the threat warnings issued in 2026 give it more weight heading into winter.

At the SERC Reliability Corporation's fall seminar last October, a session led by Travis Moran titled Weather as an Attack Impact Multiplier argued that severe weather does not cause attacks but magnifies them. Storms strain power, water and communications at once, stretch emergency crews and make attribution harder. Since then, the Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies have warned in advisory AA26-097A, first issued April 7 and expanded July 22, that Iranian-affiliated actors are exploiting programmable logic controllers (PLCs) across U.S. critical infrastructure.

PLCs are industrial computers that control equipment such as pumps and valves. The July update expanded the advisory’s scope beyond Rockwell Automation/Allen-Bradley to include observed targeting of Schneider Electric and Siemens PLCs.

The Threats Overlap More Than the Plans Do

The SERC slides point to cases where an attacker's timing and grid stress converged. The Baltimore plot is the closest to home. In August 2025 a federal court sentenced Brandon Russell to 20 years in prison for conspiring to destroy electrical substations serving the Baltimore region, and his co-conspirator, Sarah Beth Clendaniel, had already received 18 years. Investigators disrupted the plan before any attack took place. According to the SERC presentation, the plotters favored freezing weather to deepen the harm. The deck also recalls the 2015 attack on Ukraine's grid, which struck in winter.

Volt Typhoon, a group linked to China, appears in the same deck. On that group, CISA and allied agencies have been specific. Their March 2024 fact sheet for critical infrastructure leaders says it has positioned itself inside energy, communications, transportation and water networks to enable disruption if geopolitical tensions escalate. The warning concerns conflict, not storms. Taken together, the sources support planning for a weather event and a security incident at the same time, without assuming any particular actor, date or likelihood.

Backup Power Answers Only One Question

Picture a manufacturing plant that loses utility power during an ice storm. The generators start as designed. Then remote monitoring drops out, the controls vendor is hard to reach, and the control system shows a fault nobody on site can confirm. Two decisions now sit with the plant manager. One is how long essential work can run on backup power. The other is which systems can be trusted to keep running or to restart, and restored electricity does nothing to settle it.

The PLC advisory makes that second question concrete. Its July mitigations include taking controllers off direct internet exposure, changing default passwords and validating project files before switching a device back to run mode, which is exactly the step a team faces when a restart follows a suspected compromise.

Apparent redundancy is the trap. When generator controls, building access and incident communications all depend on one network or one service provider, a single failure can disable protections that looked independent on paper. Conventional risk models were not built for infrastructure that fails together, and site continuity plans often inherit the same blind spot.

Run the Storm and the Incident in One Exercise

CISA's leadership fact sheet asks executives to hold regular tabletop exercises, to test operational technology (OT) systems and manual modes, and to get IT, OT, cybersecurity, supply chain and business units working together. A combined exercise applies that advice to a facility's real decisions. Begin with a weather outage, then add a loss of trusted communications or a suspected compromise, and find out who can authorize a safe shutdown, cut off remote access, call in a vendor and approve a restart.

Manual operation belongs in the scenario only where equipment design, written procedures and staff training support it. Supplier support deserves its own test, because a vendor's remote access may be suspended during a security investigation while icy roads delay the technician who would otherwise drive in. Energy companies have increasingly folded cyber resilience into climate and energy planning, and the businesses they serve can apply the same discipline at the site level.

Fund What the Exercise Breaks

The budget request should follow the findings. One site may need independent communications for incident leads. Another may need operating documents stored locally, verified restart procedures or firmer terms with specialist contractors. A gap with a named owner and a tested fix gives finance something concrete to weigh against the cost of a delayed restart, and it is a stronger case than a general claim that the plant is resilient.

Recovery milestones also deserve a rethink. Power restoration, trusted communications and the decision to resume operations can arrive on different days, and a plan that tracks only the first will report recovery before the plant is actually ready to run.

Dates to Watch Before the First Storm

The electricity sector's own calendar offers checkpoints. GridSecCon, the grid security conference organized by the North American Electric Reliability Corporation (NERC), its Electricity Information Sharing and Analysis Center (E-ISAC) and SERC, meets in Orlando from October 20 to 23 under the theme Unified Resilience. SERC's 2026 fall seminar follows on November 4 and 5. Any further revision to the CISA controller advisory is worth checking against the equipment a site actually runs. A combined exercise held before those dates gives operations and security teams their own list of shared dependencies to test against what they hear, and a reminder that trouble in tightly linked systems rarely arrives one problem at a time.