The Feds are trying to create a perception that the electric sector does not take cyber security seriously. The truth is, the take it very seriously (what revenues would they have if they were shut down by a hack?). This sector, like many others is opposed to regulations by bureaucrats that are influenced by the lobby of security vendors. To say that NIST is the gold standard is STUPID. NIST does not apply to a SCADA environment and would have a negative affect on reliability if enforced in this sector.

TVA is just an old fashioned organization. The folks there have been in place for a long time and are resistent to change. They need to get caught up.