APPA and TVA Host MAX 2026 Cybersecurity and Mutual Aid Exercise

The American Public Power Association (APPA) and the Tennessee Valley Authority (TVA) recently conducted a large-scale tabletop exercise in Huntsville, Alabama, to test how public power utilities coordinate during simultaneous natural disasters and cyberattacks.

According to a report from the American Public Power Association, the event, known as MAX 2026, marked the first time a public power utility and a military facility collaborated on an exercise designed to examine emergency coordination.

The scenario simulated a severe ice storm striking northern Alabama and south-central Tennessee. While the storm caused widespread power outages and dangerous conditions for field crews, the exercise added a layer of complexity: an opportunistic cyberattack that undermined trusted operational data during the restoration process.

This dual-threat model forced participants to manage the physical challenges of a massive outage while simultaneously defending the digital infrastructure required to fix it.

A primary focus of the MAX 2026 exercise was the intersection of civilian utility reliability and national security. The simulation specifically looked at how outages affecting public power utilities might impact military installations like Redstone Arsenal.

By bringing together representatives from the U.S. Army, the U.S. National Guard, and the FBI, the workshop aimed to strengthen the lines of communication between local utility providers and federal defense assets. This coordination is critical when a localized weather event threatens the operational readiness of high-security military sites.

The exercise participants focused on three specific operational pillars:

Mutual Aid: The process of rapidly receiving, onboarding, and safely integrating repair crews from multiple different utilities.
Cyber Mutual Assistance: The identification of cyber response needs and the integration of external cybersecurity resources into the recovery effort.
Military Facility Coordination: The strengthening of partnerships between public power utilities and government entities when outages threaten military infrastructure.

The workshop and subsequent exercise drew many stakeholders from the public power and emergency management sectors. The scale of the event reflected the complexity of modern grid security.

Event Component	Total Attendees	Organizations Represented
MAX 2026 Workshop	60	22
MAX 2026 Exercise	64	26

The participating organizations included Huntsville Utilities, Electric Cities of Alabama, CISA, the FBI, and various state and local emergency management agencies.

The integration of these groups is intended to build a shared understanding of how different agencies can function as a single unit during complex utility incidents. This is especially vital when a cyberattack targets the very data crews rely on to move through storm-damaged areas.

The American Public Power Association stated it will use the lessons learned from the Huntsville exercise to improve emergency preparedness, cyber coordination, and the resources available to public power utilities nationwide.