Almost all utilities indicated compliance with mandatory cybersecurity standards imposed by the Federal Energy Regulatory Commission. Some utilities indicated that the standards did not apply because their systems were isolated from the Internet. Security experts say system isolation helps drastically reduce the threat from external attacks. The Stuxnet worm, however, did not require the Internet to attack its target. It infected the Iranian facility using a USB thumb drive.