Work Assignment 4: Cybersecurity in Latin America and the Caribbean

The goal of Work Assignment 4 is to support energy sector resilience in the Caribbean region and potentially in the Northern Triangle region. The scope of the work will be across nations participating in USAID's Caribbean Energy Initiative, with target countries identified depending on their capacity, interest, and ability to engage. Primary stakeholders will include utilities, government agencies, regulators, and national and regional industry groups throughout the Caribbean. Additional stakeholders will include energy consumers and the private sector in those regions. The work will build on the related past and ongoing work implemented through USAID's partnership with the U.S. Department of Energy's National Renewable Energy Laboratory (NREL). The purpose of this Work Assignment is to improve the ability of electric utilities, regulators, energy authorities, regional organizations, and other energy sector stakeholders to anticipate and manage cybersecurity challenges. The objectives of the Work Assignment are to analyze stakeholders' cybersecurity challenges, support energy stakeholders to develop or update policies, protocols, and practices to prevent cybersecurity vulnerabilities and respond to cybersecurity events, build capacity of the region and its member countries, and strengthen regional mechanisms for sharing knowledge and managing cybersecurity issues. The methodology for this Work Assignment describes the structure of activities, outputs from the activities, and formal deliverables over the next two years. The activities are assigned across two tracks, with supporting project management activities included as well. Track 1: Assessments, Road Maps, and Implementation for Utilities will focus on conducting baseline assessments and technical capacity building activities. Track 1 is broken into three sub-components: Digitalization and Cybersecurity Assessment and Planning, Cyber and Digitalization Roadmaps and Plans, and Technical Activities to Address Cybersecurity, Resiliency, and Digitalization for regulators and other national or regional entities. The work will be delivered under the U.S. Agency for International Development (USAID) SUPER Task Order, implemented by Deloitte Consulting LLP. This Work Assignment began in September 2021 and is scheduled to end in September 2023. The work will focus on engagement with counterparts, building a regional cyber culture, and planning for the long-term health and stability of the regional energy sector. Cybersecurity is a complex topic, and each utility, regulator, and government has a different emphasis and understanding of cybersecurity for the energy sector for their specific circumstances. Consistently, though, Deloitte found that most energy sector participants are not prioritizing cybersecurity as highly as they should, especially given the increasing number of attacks and amount of vulnerability that inherently come with grid modernization and increased renewable energy generation. The Caribbean Council has looked at studies estimating the costs of cyber incidents in the LAC region totaling $90B annually. Counterparts at one utility in the region, SKELEC, reported that since the start of the pandemic their attacks increased by 650%. Given the increasingly critical need for strengthening the electric utilities' cyber security systems in the region, Deloitte has structured our activities to focus on engagement with our counterparts, building a regional cyber culture, and planning for the long-term health and stability of the regional energy sector. The work will involve collaborating with NREL to conduct utility cybersecurity assessments and reviewing the capacity and approaches of regulators and other government officials. The activities will continue into Year 2 and involve introducing technical activities to address cybersecurity, resiliency, and digitalization for regulators and other national or regional entities. The work will also focus on planning the technical assistance activities that will benefit utilities resulting from cybersecurity assessments and any other initial engagement with the utilities on cyber matters to date.