This GAO report, released in January 2011, suggests the voluntary standards and guidelines developed through NIST and FERC offer promise with regard to smart grid regulation, with efforts planned and under way to carry out their smart grid roles and responsibilities. However, the report also finds limitations exist in the planning and coordination efforts of these two key agencies.

Specifically, NIST does not have a definitive plan and schedule, including specific milestones, for updating and maintaining its cybersecurity guidelines to address key missing elements. Furthermore, FERC has not established an approach coordinated with other regulators to monitor the extent to which industry is following the smart grid standards it adopts.
A voluntary approach poses some risks when applied to smart grid investments, particularly given the fragmented nature of regulatory authority over the electricity industry, the report concludes.