> ## Content Index
> Fetch the complete content index at: https://www.theamericanquorum.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Utah Audit Finds Cybersecurity Gaps at Municipal Utilities
- URL: https://www.theamericanquorum.com/state-news-utah-2026-10-21-a/
- Published: 2026-10-22T00:27:41.000Z
- Updated: 2026-10-22T00:27:41.000Z
- Description: A Utah legislative audit found mature cybersecurity at the state’s largest power provider but basic planning gaps at municipal utilities, prompting lawmakers to weigh baseline controls and a broader state oversight role.
- Author: News Desk
- Tags: Tech, Utah

Utah lawmakers are considering a larger state role in utility cybersecurity after legislative auditors found that the state’s biggest electric provider has mature defenses but municipal power systems lack some basic safeguards. The findings were presented Tuesday in [Report 2026-32, “A Performance Audit of Electricity and Natural Gas Cybersecurity”](https://utahnewsdispatch.com/wp-content/uploads/2026/10/2026-32-Final-Report-Energy-Cybersecurity-Report-Final.pdf?ref=theamericanquorum.com).

The audit drew a clear distinction between Rocky Mountain Power and locally run electric systems. Rocky Mountain Power, which supplies roughly 78% of Utah electricity sales, was assessed as having mature cybersecurity controls, according to [Utah News Dispatch’s account of the report](https://utahnewsdispatch.com/2026/10/21/utah-energy-providers-have-mature-cybersecurity-protocols-with-some-gaps/?ref=theamericanquorum.com). Municipal systems account for about 16% of sales, but the five systems interviewed by auditors had not used independent third-party assessments and had not developed, documented and routinely practiced incident-response plans.

Those gaps matter beyond a local utility’s own equipment. A prolonged power outage can disrupt hospitals, drinking-water and wastewater systems, schools and transportation. Auditors said municipal systems’ smaller service territories and access to manual controls may help them recover more quickly, but the absence of tested response procedures could lengthen an outage and complicate coordination.

Oversight is fragmented. Federal standards apply to large portions of generation and transmission, while states can supervise distribution networks that deliver electricity to customers. In Utah, the Public Service Commission is the state body with oversight of Rocky Mountain Power’s cybersecurity, but auditors described that role as limited by its rate-setting framework. The commission has previously held a public proceeding on the utility’s cyber planning; a [2023 state public notice](https://www.utah.gov/pmn/sitemap/notice/873183.html?ref=theamericanquorum.com) invited regulators, consumer officials and the public to a Rocky Mountain Power cybersecurity update.

Municipal utilities present a different policy challenge because they are governed locally. The audit did not direct lawmakers to a single remedy. Instead, it suggested options such as asking the Utah Cyber Center or Cybersecurity Commission to develop model response plans, requiring baseline cybersecurity controls, or limiting liability for systems that adopt recognized practices. The [American Public Power Association’s incident-response playbook](https://www.publicpower.org/resource/public-power-cyber-incident-response-playbook?ref=theamericanquorum.com) illustrates the kind of operational framework available to public utilities, covering detection, investigation, containment, recovery and coordination with government and industry partners.

The work was formally taken up by the Legislative Audit Subcommittee on Oct. 20\. Its [published agenda](https://le.utah.gov/interim/2026/pdf/00003588.pdf?ref=theamericanquorum.com) lists Audit Manager Jesse Martinson and Cyber Security Audit Supervisor Christopher McClelland as presenters. Any new statewide requirements would require legislative action or changes in agency practice; the audit itself does not impose rules.

The new report follows a broader series of Utah reviews of critical-infrastructure cyber risk. A January [legislative audit of drinking-water cybersecurity](https://le.utah.gov/interim/2026/pdf/00000993.pdf?ref=theamericanquorum.com) similarly recommended baseline practices, incident-response planning and regular briefings to governing boards. Together, the reports put a practical question before lawmakers: whether voluntary local improvement is sufficient for systems whose failure could cascade into other essential services.