Agenda Standards Oversight and Technology Committee August 13, :15 a.m. 12:15 p.m. Pacific

Transcription

1 Agenda Standards Oversight and Technology Committee August 13, :15 a.m. 12:15 p.m. Pacific The Westin Bayshore 1601 Bayshore Drive Vancouver, BC V6G 2V4 Canada Call to Order and Chair s Remarks NERC Antitrust Compliance Guidelines and Public Announcement Agenda 1. Minutes* Approve a. May 6, 2014 Meeting 2. CIP Version 5 Standard Development Process* Information 3. ERO Enterprise IT Application Strategy* Information 4. Geomagnetic Disturbance Mitigation Standard* Information 5. Definition of Bulk Electric System ( BES ) Implementation* Information 6. Reliability Standard Audit Worksheet Revision Process* Update 7. Reliability Standards Quarterly Status Report (including Standards Committee Report)* Information 8. Adjournment *Background materials included.

2 Antitrust Compliance Guidelines I. General It is NERC s policy and practice to obey the antitrust laws and to avoid all conduct that unreasonably restrains competition. This policy requires the avoidance of any conduct that violates, or that might appear to violate, the antitrust laws. Among other things, the antitrust laws forbid any agreement between or among competitors regarding prices, availability of service, product design, terms of sale, division of markets, allocation of customers or any other activity that unreasonably restrains competition. It is the responsibility of every NERC participant and employee who may in any way affect NERC s compliance with the antitrust laws to carry out this commitment. Antitrust laws are complex and subject to court interpretation that can vary over time and from one court to another. The purpose of these guidelines is to alert NERC participants and employees to potential antitrust problems and to set forth policies to be followed with respect to activities that may involve antitrust considerations. In some instances, the NERC policy contained in these guidelines is stricter than the applicable antitrust laws. Any NERC participant or employee who is uncertain about the legal ramifications of a particular course of conduct or who has doubts or concerns about whether NERC s antitrust compliance policy is implicated in any situation should consult NERC s General Counsel immediately. II. Prohibited Activities Participants in NERC activities (including those of its committees and subgroups) should refrain from the following when acting in their capacity as participants in NERC activities (e.g., at NERC meetings, conference calls and in informal discussions): Discussions involving pricing information, especially margin (profit) and internal cost information and participants expectations as to their future prices or internal costs. Discussions of a participant s marketing strategies. Discussions regarding how customers and geographical areas are to be divided among competitors. Discussions concerning the exclusion of competitors from markets. Discussions concerning boycotting or group refusals to deal with competitors, vendors or suppliers.

3 Any other matters that do not clearly fall within these guidelines should be reviewed with NERC s General Counsel before being discussed. III. Activities That Are Permitted From time to time decisions or actions of NERC (including those of its committees and subgroups) may have a negative impact on particular entities and thus in that sense adversely impact competition. Decisions and actions by NERC (including its committees and subgroups) should only be undertaken for the purpose of promoting and maintaining the reliability and adequacy of the bulk power system. If you do not have a legitimate purpose consistent with this objective for discussing a matter, please refrain from discussing the matter during NERC meetings and in other NERC-related communications. You should also ensure that NERC procedures, including those set forth in NERC s Certificate of Incorporation, Bylaws, and Rules of Procedure are followed in conducting NERC business. In addition, all discussions in NERC meetings and other NERC-related communications should be within the scope of the mandate for or assignment to the particular NERC committee or subgroup, as well as within the scope of the published agenda for the meeting. No decisions should be made nor any actions taken in NERC activities for the purpose of giving an industry participant or group of participants a competitive advantage over other participants. In particular, decisions with respect to setting, revising, or assessing compliance with NERC reliability standards should not be influenced by anti-competitive motivations. Subject to the foregoing restrictions, participants in NERC activities may discuss: Reliability matters relating to the bulk power system, including operation and planning matters such as establishing or revising reliability standards, special operating procedures, operating transfer capabilities, and plans for new facilities. Matters relating to the impact of reliability standards for the bulk power system on electricity markets, and the impact of electricity market operations on the reliability of the bulk power system. filings or other communications with state or federal regulatory authorities or other governmental entities. Matters relating to the internal governance, management and operation of NERC, such as nominations for vacant committee positions, budgeting and assessments, and employment matters; and procedural matters such as planning and scheduling meetings. NERC Antitrust Compliance Guidelines 2

4 DRAFT Minutes Standards Oversight and Technology Committee May 6, :15 a.m. - 12:15 p.m. Eastern Agenda Item 1.a Hyatt Regency Philadelphia at Penn s Landing 201 S. Columbus Bvd. Philadelphia, PA Call to Order and Chair s Remarks Kenneth G. Peterson, Chair, convened a duly noticed open meeting of the Standards Oversight and Technology Committee (the Committee ) of the North American Electric Reliability Corporation ( NERC ) on May 6, 2014 at 11:10 a.m. Eastern, and a quorum was declared present. The agenda is attached as Exhibit A. Committee Members: Kenneth G. Peterson, Chair Paul F. Barber Frederick W. Gorbet David Goulding Douglas Jaeger Bruce A. Scherr Board of Trustees Members: Janice B. Case Gerald W. Cauley, President and Chief Executive Officer Robert G. Clarke Jan Schori Roy Thilly NERC Staff: Valerie Agnew, Director of Standards Charles A. Berardesco, Senior Vice President, General Counsel, and Corporate Secretary Thomas Burgess, Vice President and Director of Reliability Assessment and Performance Analysis Holly A. Hawkins, Assistant General Counsel Jerry Hedrick, Director of Regional Oversight Compliance Mark G. Lauby, Vice President and Director of Standards Development Steven Noess, Associate Director of Standards Development Janet Sena, Senior Vice President and Director of Policy and External Affairs Brady Walker, Associate Counsel Michael Walker, Senior Vice President, Chief Financial and Administrative Officer, and Corporate Treasurer Other: Mr. Brian Murphy, Chair, Standards Committee

5 NERC Antitrust Compliance Guidelines Mr. Peterson directed the participants attention to the NERC Antitrust Compliance Guidelines included in the agenda, and stated that any additional questions regarding these guidelines may be directed to himself or to Mr. Berardesco. Minutes Upon motion duly made and seconded, the February 5, 2014 meeting minutes were approved in the form as presented to the Committee at the meeting. CIP Version 5 Mr. Noess provided an update on NERC s response to the directives in FERC Order No He indicated there are four major directives and outlined the near-term activities of the standard drafting team. Mr. Hedrick reports on the CIP Version 5 transition program design. He summarized development work to date which includes (i) development of the implementation study, (ii) compliance and enforcement process design, and (iii) outreach and communication to industry stakeholders. Committee members engaged in an active discussion. Stage 2 GMD Standard Mr. Lauby summarized the work of the standard drafting team and NERC staff on the GMD standard over the past several months. He stated that the proposed Reliability Standard completed during Stage 1 of the project has been filed with FERC and that work on Stage 2, which involved the development of a benchmark GMD event, is ongoing. He highlighted the intense technical nature of the work required to develop the benchmark event and thanked NERC staff and stakeholders for their continued efforts. Mr. Lauby stated that the proposed Reliability Standard is targeted for presentation to the Board in. The Committee members and stakeholders engaged in a discussion of various aspects of the development process. Physical Security Standard Project Mr. Noess reported that the proposed Physical Security Reliability Standard was on final ballot for approval by industry. He commended the collaborative nature of the development process and thanked industry stakeholders and FERC Staff for their involvement. Mr. Noess indicated that the proposed Reliability Standard would be presented to the Board of Trustees for approval during its May 13, 2014 conference call and filed with FERC by the June 5, 2014 deadline prescribed in FERC s Order. ERO Enterprise IT Applications Mr. Cauley reported on the status of strategic development of the ERO s core applications. He noted the data-intensive nature of the work of the ERO Enterprise and emphasized that a key factor in achieving success is the development of adequate tools for common use. Mr. Cauley stated that, while the vision and development structure of the EIDS tools project are sound, the development process is being reevaluated. He stated that he has undertaken an effort to ensure continued management oversight and expertise is in place as other IT Application development projects are considered. 2

6 Committee members and stakeholders engaged in a discussion of various aspects of the development process and next steps. TOP/IRO Response Update Mr. Lauby thanked FERC for the opportunity to revise the proposed TOP/IRO Reliability Standards. He noted that NERC has hosted two technical conferences and that each was attended by more than 100 industry stakeholders. Mr. Lauby reported that the revised Reliability Standards is targeted for presentation to the Board in. Reliability Standards Quarterly Status Report (including Standards Committee Report) Mr. Lauby presented the Reliability Standards Quarterly Status Report which (i) outlined Reliability Standards that will be presented to the Board for approval, (ii) updated the number of outstanding FERC directives, and (iii) provided an update on projects slated for development as outlined in the Reliability Standards Development Plan. Mr. Murphy presented a summary of the policy input letter he submitted on behalf of the Standards Committee. Periodic Review of NERC ANSI Accreditation Ms. Hawkins reviewed NERC s ANSI Accreditation status as required by the Committee mandate. NERC received its original accreditation in NERC was recertified most recently in May 2013 and continues to operate in accordance with ANSI requirements. Adjournment There being no further business, and upon motion duly made and seconded, the meeting was adjourned at 12:15 p.m. Eastern. Submitted by, Charles A. Berardesco Corporate Secretary 3

7 Agenda Item 2 Standards Oversight and Technology Committee Meeting August 13, 2014 CIP Version 5 Revision Standard Development Process Action Information Background On November 22, 2013, the Federal Energy Regulatory Commission (FERC) issued Order No. 791, Version 5 Critical Infrastructure Protection Reliability Standards, in which FERC approved Version 5 of the Critical Infrastructure Protection (CIP) standards and directed several modifications. Summary In Order No. 791, FERC approved Version 5 of the CIP standards and directed several modifications, including the following: 1. Modify or remove the identify, assess, and correct (IAC) language found in 17 of the 32 CIP Version 5 requirements. 2. Develop modifications to the CIP standards to address security controls for Low Impact assets. 3. Develop requirements that protect transient electronic devices. 4. Create a definition of communication networks and develop new or modified Reliability Standards that address the protection of communication networks. 5. Modify certain Violation Severity Levels (VSLs) and Violation Risk Factors (VRFs). NERC must submit new or revised standards responding to the directives related to the IAC language and communication networks by February 3, 2015, one year from the effective date of Order No FERC did not place a timeframe on responding to the other directives. FERC also directed NERC to survey responsible entities to gain a better understanding of the Bulk Electric System (BES) Cyber Asset definition and submit an informational filing on the results from this survey by February 3, FERC also directed FERC staff to convene a technical conference, within 180 days from the date of the final rule, to address the technical issues identified in the Order concerning communications security, remote access, and the National Institute of Standards and Technology Risk Management Framework. Finally, FERC approved both the implementation approach to bypass CIP Version 4 and to move directly to CIP Version 5, as well as the implementation timeframes proposed by NERC. NERC initiated a few courses of action to address the directives from Order No First, NERC initiated Project and formed a Standard Drafting Team (SDT) to revise the CIP 1

8 standards consistent with the directives in Order No The SDT focused on four directive areas: the IAC directive, the communication networks directive, the transient electronic devices directive, and the security controls for Low Impact assets directive. An update on the SDT s activities is included below. Second, NERC filed revised VRFs and VSLs in response to the directive on May 15, Finally, NERC will request the Board of Trustees (Board) at their August 14, 2014 meeting to approve a data request to industry in order to meet the directive to conduct a survey on the BES Cyber Asset definition. Pertinent Directives from the FERC Order No. 791, Version 5 Critical Infrastructure Protection Reliability Standards, 145 FERC 61,160 (2013): Paragraph 67 For the reasons discussed below, the Commission concludes that the identify, assess, and correct language, as currently proposed by NERC, is unclear with respect to the obligations it imposes on responsible entities, how it would be implemented by responsible entities, and how it would be enforced. Accordingly, we direct NERC, pursuant to section 215(d)(5) of the FPA, to develop modifications to the CIP version 5 Standards that address our concerns. Preferably, NERC should remove the identify, assess, and correct language from the 17 CIP version 5 requirements, while retaining the substantive provisions of those requirements. Alternatively, NERC may propose equally efficient and effective modifications that address the Commission s concerns regarding the identify, assess, and correct language. The Commission directs NERC to submit the modifications to the CIP Reliability Standards within one year from the effective date of this Final Rule. (internal citations omitted). Paragraph 108 In addition, the absence of objective criteria to evaluate the controls chosen by responsible entities for Low Impact assets introduces an unacceptable level of ambiguity and potential inconsistency into the compliance process, and creates an unnecessary gap in reliability. This ambiguity will make it difficult for registered entities to develop, and NERC and the regions to objectively evaluate, the effectiveness of procedures developed to implement Reliability Standard CIP-003-5, Requirement R2. Therefore, pursuant to section 215(d)(5) of the FPA, we direct NERC to develop modifications to the CIP version 5 Standards to address this concern. We believe that NERC can effectively address this concern in a number of ways, including: (1) requiring specific controls for Low Impact assets, including subdividing the assets into different categories with different defined controls applicable to each subcategory; (2) developing objective criteria against which the controls adopted by responsible entities can be compared and measured in order to evaluate their adequacy, including subdividing the assets into different categories with different defined control objectives applicable to each subcategory; (3) defining with greater specificity the processes that responsible entities must have for Low Impact facilities under Reliability Standard CIP-003-5, Requirement R2; or (4) another equally efficient and effective solution. We believe that this approach allows NERC the flexibility to develop appropriate modification(s), while also considering the stakeholder concerns expressed in NOPR comments regarding the possible rigidity of requiring a one-size-fits-all set of controls. 2

9 Paragraph 124 Accordingly, the Commission directs NERC to conduct a survey of Cyber Assets that are included or excluded under the new BES Cyber Asset definition during the CIP version 5 Standards implementation periods. Such data will help provide a better understanding of the BES Cyber Asset definition. Based on the survey data, NERC should explain in an informational filing the following: (1) specific ways in which entities determine which Cyber Assets meet the 15 minute parameter; (2) types or functions of Cyber Assets that are excluded from being designated as BES Cyber Assets and the rationale as to why; (3) common problem areas with entities improperly designating BES Cyber Assets; and (4) feedback from each region participating in the implementation study on lessons learned with the application of the BES Cyber Asset definition. The informational filing should not provide a level of detail that divulges CEII data. This filing should also help other entities implementing CIP version 5 in identifying BES Cyber Assets. Paragraph 132 Based on the explanation provided by NERC and other commenters, we will not direct modifications regarding the 30-day exemption in the definition of BES Cyber Asset. While we are persuaded that it would be unduly burdensome for responsible entities to treat all transient devices as BES Cyber Assets, we remain concerned whether the CIP version 5 Standards provide adequately robust protection from the risks posed by transient devices. Accordingly, as discussed below, we direct NERC to develop either new or modified standards to address the reliability risks posed by connecting transient devices to BES Cyber Assets and Systems. Paragraph 150 We direct NERC to create a definition of communication networks and to develop new or modified Reliability Standards to address the reliability gap discussed above. The definition of communications networks should define what equipment and components should be protected, in light of the statutory inclusion of communication networks for the reliable operation of the Bulk-Power System. The new or modified Reliability Standards should require appropriate and reasonable controls to protect the nonprogrammable aspects of communication networks. The Commission directs NERC to submit these modifications for Commission approval within one year from the effective date of this final rule. We also direct Commission staff to include this issue in the staff-led technical conference discussed herein. (internal citation omitted). Paragraph 181 We adopt the NOPR proposal and direct NERC to modify the VRF assignment for CIP-006-5, Requirement R3 from Lower to Medium. This modification will ensure that the CIP version 5 Standards afford similar treatment to the testing and monitoring of Physical Access Control Systems (PACS) as the CIP version 4 Standards. We are not persuaded by commenters arguments that a Lower VRF assignment is appropriate for CIP-006-5, Requirement R3. Paragraph 192 The Commission adopts the NOPR proposal and directs NERC to modify the VRF assignment for CIP-004-5, Requirement R4 from Lower to Medium. This modification is necessary to reflect that access to operationally sensitive computer equipment should be strictly limited to employees or 4

10 contractors who utilize the equipment in performance of their job responsibilities, and to prevent or mitigate disclosure of sensitive information consistent with Recommendations 40 and 44 of the 2003 Blackout Report. In addition, a Medium VRF assignment ensures consistency with the Commission s VRF guidelines. Paragraph 205 Consistent with the NOPR proposal, we direct NERC to develop modifications to the VSLs for certain CIP version 5 Standard requirements to: (1) remove the identify, assess, and correct language from the text of the VSLs for the affected requirements; (2) address typographical errors; and (3) clarify certain unexplained elements. For the VSLs that include identify, assess, and correct language, we direct NERC to ensure that these VSLs are modified to reflect any revisions to the requirement language in response to our directives. We grant NERC the discretion to decide how best to address these modifications be it through an errata filing to this proceeding or separate filing. Paragraph 206 With respect to the VSL language for CIP-003-5, Requirements R1 and R2, the Commission notes that the language as required by R[1 or 2] and according to Requirement R[1 or 2] is redundant and potentially confusing and hereby directs NERC to provide clarification to this language. Paragraph 207 With respect to the VSL language for CIP-003-5, Requirement R4, the Commission agrees with NERC that basing the VSL language on a timeline is appropriate, but notes that the VSL language does not match the table and analysis documents within Appendix E of the CIP version 5 Petition. After considering NERC s comments, the Commission understands that the correct VSL for this requirement includes timeline gradations. We therefore direct NERC to clarify the VSL language for this requirement to reflect this understanding. Paragraph 208 We direct NERC to change the VSL gradation for CIP-004-5, Requirement R4 to be percentage based, instead of using the number of BES Cyber Systems or sites for storing BES Cyber System information. This change will allow for fair treatment for entities that may only have a single BES Cyber system or storage location. Paragraph 209 With respect to the VSL language for CIP-008-5, Requirement R2, the Commission believes that NERC inserted a typographical error into the petition, creating a gap between 18 months and 19 months in the VSLs. We therefore direct NERC to clarify this language in a further filing. Paragraph 210 With respect to the VSL language in CIP Part 3.1, we believe that the number of days listed in the VSLs is inconsistent. For example, the moderate VSL for Part has a timeframe of calendar days, while the High VSL has a timeframe of greater than 120 calendar 5

11 days. The Commission believes that the 120 day metric is appropriate for these time-based VSL gradations and directs NERC to change the 210 calendar days language to 120 calendar days where appropriate. In short, notwithstanding any changes the Commission requires for VRFs and VSLs, the Commission clarifies that any penalties for violations of the CIP Standards must be tailored to each responsible entity s effect on the BES, with particular consideration given to small utilities that individually pose less of a reliability and security risk. Standards Development Process Update On June 2, 2014, the SDT posted CIP-003-6, CIP-004-6, CIP-006-6, CIP-007-6, CIP-009-6, CIP-010-2, and CIP for a 45-day initial comment and ballot period ending on July 16, The ballot was conducted from July 7 to July 16, The ballot results were not available at the time these materials were prepared and NERC staff will provide an update of the final results at the August 14, 2014 Board meeting. NERC staff and the SDT focused on industry outreach during development and the initial comment period and will continue these efforts during the next phase of development. In addition, NERC posted the standards corresponding Reliability Standards Audit Worksheets (RSAWs) for industry comment from June 17 to July 16, NERC also posted RSAWs for CIP , CIP-005-5, and CIP-008-5, which the SDT did not revise during Project standard development activity. Stakeholders submitted comments to the RSAW drafting team. Prior to posting, NERC presented some of these RSAWs to the SDT for input to ensure that the RSAW drafting team s product aligned with the SDT s intent behind the Project revisions. Similarly, the RSAW drafting team provided feedback to the SDT prior to the June 2, 2014 posting of the standards. This concurrent posting and coordination provides transparency during the RSAW and standard development processes. The SDT anticipates the following milestones to meet the four directives the SDT is addressing: 1. July and August: In-person SDT meetings in St. Paul, MN and San Francisco, CA. 2. September and October: Additional posting (if needed) of standards and related development materials for a 45-day formal comment and concurrent additional ballot period. 3. Late October to early November: Post for 10-day final ballot. 4. November to December: Adoption by the Board and NERC staff filing proposed standards with applicable regulatory authorities. Additional Information A link to the project history and files is included here for reference: [Project CIP Version 5 Revisions] 6

12 Agenda Item 3 Standards Oversight and Technology Committee Meeting August 13, 2014 ERO Enterprise IT Application Strategy Update Action Information Background In late 2012, NERC and the Regional Entities collaboratively developed a framework to oversee the development and execution of a strategy governing the identification, development, and implementation of software applications supporting common NERC and Regional Entity operations including data collection, management, and analysis. This strategy (ERO Enterprise IT Strategy) and associated application development is a multi-year initiative tailored to improve productivity and visibility to data, and reduce the complexity of managing multiple applications. Detailed information regarding the ERO Enterprise IT Strategy, applications, and budget was included in NERC s 2014 business plan and budget and has been updated in NERC s 2015 business plan and budget. The Standards Oversight and Technology Committee (SOTC) also formed a subgroup comprised of three committee members to provide additional oversight to this effort as well as feedback to the SOTC on the development and execution of the ERO Enterprise IT Strategy. During the May 2014 SOTC meeting, NERC management provided an update on the ERO Enterprise IT Strategy, identifying a need to refine the ERO Enterprise Strategy and improve project execution. This enhancement in strategy is necessary in light of the lessons learned in connection with the development of the Events Information Data System (EIDS) and Bulk Electric System (BESnet) applications, as well as preliminary assessment of existing software applications supporting compliance, registration and enforcement operations, and work underway to replace the existing standards balloting system (SBS) application. A presentation will be made at the August 2014 meeting on changes in the governance structure that NERC and the Regional Entities have put in place to oversee the selection, development and execution of Enterprise IT applications, a list of the priority applications for development during the time frame, and an update on the costs incurred to date in connection with the development of the EIDS, BESnet, and SBS applications.

13 Agenda Item 4 Standards Oversight and Technology Committee Meeting August 13, 2014 Project Geomagnetic Disturbance Mitigation Action Information Background On May 16, 2013, FERC issued Order No. 779 directing NERC to develop Reliability Standards to address the potential impact of geomagnetic disturbances (GMD) in two stages. A Stage 1 standard requiring applicable entities to implement Operating Procedures to mitigate the effects of GMDs was approved by FERC in Order No. 797, issued on June 19, A Stage 2 standard, currently in development, to require applicable entities to conduct assessments of the impacts of benchmark GMD events on their systems and requiring the development and implementation of a plan to mitigate the risks of instability, uncontrolled separation, or cascading, if impacts are identified. FERC established a filing deadline of January 21, FERC further directed that NERC identify, through its standards development process, the benchmark GMD event (including a technical justification for the selected benchmark) that entities will use in their GMD assessments. Summary In June 2014, FERC approved the Stage 1 standard, EOP Geomagnetic Disturbance Operations. The standard requires Reliability Coordinators and Transmission Operators with grounded transformers above 200 kv to develop and implement operating plans, processes, or procedures to mitigate the effects of GMD. EOP becomes effective in the United States on April 1, 2015, although Requirement 2 of Reliability Standard EOP will not become effective until the first day following retirement of Reliability Standard IRO a. In other jurisdictions, EOP becomes effective six months after regulatory approval, or as otherwise provided for in that jurisdiction. The Stage 2 standard, TPL Transmission System Planned Performance for Geomagnetic Disturbance Events, and benchmark GMD event description were posted for a 45-day comment and initial ballot from June 13 to July 30, The proposed standard applies to Planning Coordinators, Transmission Planners, Transmission Owners, and Generator Owners with grounded power transformers connected at 200 kv or higher and will require these entities to conduct assessments of the impacts of a 1-in-100 year GMD event on their systems. If the assessments identify impacts from the benchmark GMD event, entities are required to develop and implement plans to mitigate the risk of instability, uncontrolled separation, or cascading.

14 Agenda Item 4 Standards Oversight and Technology Committee Meeting August 13, 2014 Additional Information A link to the project history and files is included here for reference: [ Mitigation.aspx]

15 Agenda Item 5 Standards Oversight and Technology Committee Meeting August 13, 2014 BES Implementation Status Update Action Information Background On December 13, 2013 NERC filed a petition for approval of revisions to the definition of the Bulk Electric System (BES) resulting from Order Nos. 773 and 773-A, and requested expedited FERC action to support implementation beginning on July 1, The revisions to the BES definition encompassed all elements and facilities necessary to the reliable operation and planning of the interconnected transmission network. In response to NERC s petition, FERC issued an Order on March 20, 2014, approving the revised definition which allowed for an effective date of July 1, The ERO implementation of the revised BES definition involves processes developed by NERC and the Regional Entities to determine inclusion and exclusions to the definition, and an enterprise-wide software application to support that process, called the BES Notifications and Exceptions tool (BESnet). The ERO developed processes and tools to provide a uniform, clear way of determining asset inclusions, exclusions and self-determinations under the revised BES definition. These provide a consistent way to identify assets and manage workflow, which will ultimately enhance the reliability of the Bulk-Power System. Communication, education, and outreach regarding the implementation of the BES definition has been extensive. NERC and the Regional Entities participated in over 25 events in order to inform stakeholders about the implementation of the revised BES definition. These included NERC-sponsored standing committee meetings, regional workshops and conferences, trade association meetings, and on-line training webinars. An easily accessible BES Definition Project Page is available on the NERC website, where key information about the project is shared and frequently updated. This has included (i) a master schedule of activities; (ii) the posting of reference documents, training videos, software guides, and similar materials; (iii) announcements of key milestones and training events held by the Regional Entities and NERC; and (iv) providing regional points-of-contact for stakeholders as needed. NERC and the Regional Entities have strongly encouraged registered entities to use these resources and engage their respective Regional Entity contacts or NERC staff for further guidance and information. Implementation and Deployment Status In anticipation of the July 1 effective date, NERC and the Regional Entities took a variety of implementation steps designed to make the initial launch of the processes and tools both efficient and effective. NERC and the Regional Entities undertook a slow roll approach to the deployment in order to lessen the load on the system at launch as well as provide the registered entities ample opportunity to become comfortable with the new processes. The initial registration of the users of the BESnet application began in April, giving entities time prior to the effective date to gain access to the tool. Since then, system access for over 850 distinct

16 Agenda Item 5 Standards Oversight and Technology Committee Meeting August 13, 2014 entities has been granted, and the steady pace of registrations has enabled the ERO to address questions and other issues in a measured fashion. Similarly, NERC and the Regional Entities extended this slow roll approach to address the initial submittal of self-determined notifications of exclusion. By creating a window of approximately 60 days for these submittals during which they will be treated from a compliance perspective as if received on the first day of July, the potential sense of urgency to submit has been reduced, allowing for a more deliberately paced level of activity. Based on the initial results of the registration and early registered entity submittals to date, this strategic and deliberate approach to the deployment has been very successful, both with the registered entity interface and the tool functionality. Within the first ten days of the application being able to accept submissions, roughly a dozen of these notifications have actually been submitted, with approximately 90 additional notifications in the process of being prepared for submission at some point in the future. This has resulted in a measured pace for NERC and the Regional Entities, allowing efficient and effective responses to address questions. Finally, the early results are in line with NERC expectations about the pace, scope, and volume of submittals for changes to conform to the overall bright-line BES definition. These submittals represent measureable refinements associated with the implementation of the bright-line BES definition, and reflect excellent integration of the various reference materials and training initiatives provided to stakeholders, resulting in very high quality submittals. While there may still be significant work ahead for the receipt and evaluation of the balance of the submittals, these early results are very encouraging.

17 Agenda Item 6 Standards Oversight and Technology Committee Meeting August 13, 2014 RSAW Review and Revision Process Action Update Background During the February 2014 Member Representatives Committee (MRC) meeting, a concern was raised about changes made to a Reliability Standards Audit Worksheet (RSAW) after a standard has been approved and whether a review and approval process is needed to ensure that a change does not effectuate a material change in the scope or intent of the standard. A small working group was formed with representation from the MRC, NERC staff, and the NERC Board to develop a proposal for a RSAW revision process, which was presented to the Board s Compliance Committee at the May 2014 meetings. Based on that proposal and the feedback from the Compliance Committee and Board of Trustees, management finalized the NERC Reliability Audit Worksheet Review and Revision Process, which was vetted with the small working group noted above. The Process is now posted on NERC s website in the Compliance and Enforcement section. In addition, the Corporate Governance and Human Resources Committee intends to recommend a revision to the SOTC mandate to reflect the SOTC s potential role in RSAW revisions. Additional Information Reliability Standard Audit Worksheet Review and Revision Process

18 Agenda Item 7 Standards Oversight and Technology Committee Meeting August 13, 2014 Reliability Standards Quarterly Status Report Attached is the Reliability Standards Quarterly Status Report. Key subject matters and points of the report include: Draft Reliability Standard Development Plan (RSDP) The Standards Committee and NERC staff have initiated work on the RSDP and an enhanced approach to conducting periodic reviews that will fulfill both the requirements of the Appendix 3A of the NERC Rules of Procedure (the NERC Standard Processes Manual) and provides a means to evaluate the quality and content of Reliability Standards. Standards Development Forecast Provides a forecast of the standards anticipated to go to the NERC Board of Trustees (Board) for approval through February Paragraph 81 Phase 2 Recommendations and Independent Experts Quarterly Update Provides an update on the Phase 2 portion of the Paragraph 81 project and an overview of the trends identified with regard to the total number of Board-approved requirements in effect. Regulatory Directives Update Provides a report on the progress made in addressing FERC directives and guidance. Standards Committee (SC) Report SC overview of key activities and progress from the previous quarter, including an update regarding the draft RSDP, the draft enhanced periodic review process, and the standards metric for 2016 and beyond. Update on CIP Version 3 Interpretations Provides an update on three Board-approved interpretations of CIP Version 3 Reliability Standards. Additional Information for Selected Projects Protection and Control (PRC) Reliability Standards Project : Revisions to TOP and IRO Reliability Standards

19 Reliability Standards Standards Oversight and Technology Committee Quarterly Status Report August 13, Peachtree Road NE Suite 600, North Tower SOTC Quarterly Reliability Standards Status Report May 2014 Atlanta, GA of

20 Table of Contents Preface... 3 Draft Reliability Standards Development Plan... 4 Standards Development Forecast (Continent wide)... 5 Board Forecast for Standard Projects in Active Development February Additional Information for Selected Projects... 5 Projects with Regulatory Deadlines... 6 Paragraph 81 and Independent Experts Quarterly Update... 7 Progress to Date... 7 Trend in Number of Requirements... 7 Regulatory Directives Update Pre 2013 Directives Post 2012 Directives Summary of Total Directives Standards Committee Report Update on CIP Version 3 Interpretations Background on the Interpretations Addendum SOTC Reliability Standards Quarterly Status Report August of 34

21 Preface The North American Electric Reliability Corporation (NERC) is a not for profit international regulatory authority whose mission is to ensure the reliability of the Bulk Power System (BPS) in North America. NERC develops and enforces Reliability Standards; annually assesses seasonal and long term reliability; monitors the BPS through system awareness; and educates, trains, and certifies industry personnel. NERC s area of responsibility spans the continental United States, Canada, and the northern portion of Baja California, Mexico. NERC is the electric reliability organization (ERO) for North America, subject to oversight by the Federal Energy Regulatory Commission (FERC) and governmental authorities in Canada. NERC s jurisdiction includes users, owners, and operators of the BPS, which serves more than 334 million people. The North American BPS is divided into several assessment areas within the eight Regional Entity (RE) boundaries, as shown in the map and corresponding table below. FRCC MRO NPCC RF SERC SPP RE TRE WECC Florida Reliability Coordinating Council Midwest Reliability Organization Northeast Power Coordinating Council ReliabilityFirst SERC Reliability Corporation Southwest Power Pool Regional Entity Texas Reliability Entity Western Electric Coordinating Council SOTC Reliability Standards Quarterly Status Report August of 34

22 Draft Reliability Standards Development Plan The Standards Committee (SC) and NERC staff have initiated work on the Reliability Standards Development Plan (RSDP) and an enhanced approach to conducting periodic reviews that will fulfill both the requirements of the Appendix 3A of the NERC Rules of Procedure (the NERC Standard Processes Manual) to conduct periodic reviews, as well as evaluate the quality and content of Reliability Standards. Both the RSDP and the enhanced approach to conducting periodic reviews are on schedule to be delivered to the NERC Board of Trustees (Board) in. For additional details, please see the SC Report on page 12 of this report. SOTC Quarterly Reliability Standards Status Report May of 34

23 Standards Development Forecast (Continent-wide) Board Forecast for Standard Projects in Active Development Project : System Protection Coordination (PRC 027 1, PRC 001 1) Project : Disturbance Monitoring (PRC 002 2) Project : Phase 3 Protection Systems: Sudden Pressure Relays (PRC 005 ) Project : Phase 2 Protection Systems: Special Protection Systems (Definition) Project : Phase 3 of Relay Loadability: Stable Power Swings (PRC 026 1) Project : Phase 1 of Balancing Authority Reliability based Controls: Reserves (BAL 002) Project : Geomagnetic Disturbance Mitigation (TPL 007 1) Project : Standards Applicability for Dispersed Generation Resources (high priority standards) Project : Critical Infrastructure Protection Standards Version 5 Revisions Project : Revisions to TOP and IRO Standards (TOP 001 3, TOP 002 4, TOP 003 3, IRO 001 4, IRO 002 4, IRO 008 2, IRO 010 2, IRO 014 3, and IRO 017 1) February 2015 Project : Undervoltage Load Shedding (UVLS) & Underfrequency Load Shedding (UFLS)(PRC 10 1 and PRC 006 1) Project : Emergency Operations (EOP 011 1) Project : Periodic Review of BAL Standards (BAL 005, BAL 006) Project : Implementation of IRO Five year Review Recommendations Project : Standards Applicability for Dispersed Generation Resources (medium priority standards) Additional Information for Selected Projects 1 Revisions to Protection System (PRC) Standards Project : Revisions to TOP and IRO Standards 1 See Addendum 1, p. 14 of this report. SOTC Reliability Standards Quarterly Status Report August of 34

24 Standards Development Forecast (Continent wide) Projects with Regulatory Deadlines Some of the above projects are subject to regulatory deadlines, as indicated in the table below: Project Regulatory Deadline Project Relay Loadability Stable Power Swings December 31, 2014 Project Protection System Maintenance and Testing Phase 3 December 31, 2014 Project Geomagnetic Disturbance Mitigation Stage 2 January 21, 2015 Project Real time Reliability Monitoring and Analysis Capabilities January 31, 2015 Project TOP/IRO Revisions January 31, 2015 Project CIP Version 5 Revisions February 3, 2015 SOTC Reliability Standards Quarterly Status Report August of 34

25 Paragraph 81 and Independent Experts Quarterly Update Progress to Date On November 21, 2013, FERC issued Order No. 788 approving the retirement of the requirements proposed for retirement under Phase 1 of the Paragraph 81 (P81) project. At the conclusion of Phase 1, 217 requirements remained for consideration in Phase 2 of the project. In addition, the Independent Expert Review Panel (IERP) recommended a total of 257 requirements for retirement. Some requirements were included in both sets of recommendations, and eliminating these duplications results in a total of 281 requirements proposed for retirement. Of these, all except six candidates have either been addressed or are in the process of being addressed in either a current project or five year review. P81 and IERP Current Status Recommendations for Retirement Total* 281 Addressed 202 In current projects 72 Not assigned 7 *Requirements (duplication eliminated) There are three possible ways in which one of the requirements proposed for retirement (above) may have been addressed. The requirement may have been retired in its entirety, it may have been modified, or it may have been retained in its entirety. The analysis is qualitative and was conducted with a conservative approach; thus a categorization of modified indicates that a portion, but not all, of the requirement, sub requirement or part was retired. If any action in the original requirement was retained, the requirement received a categorization of modified. Of the 1202 requirements that have been addressed to date: 47 percent (95) have been retired, 2 44 percent (88) have been modified, 3 and 9 percent (19) have been retained. A table outlining the proposed candidates, their status and resolutions is attached as Addendum 2. Trend in Number of Requirements As drafting teams continue to revise standards and apply Paragraph 81 criteria to eliminate requirements that are redundant or do not contribute to reliability, there is an expectation that the total number of requirements subject to enforcement will be reduced over time. To verify this was occurring, NERC staff used the US Enforcement 2 Twelve of these were retired in the Paragraph 81 Phase 1, but were included on the list as they were recommended for retirement by the Independent Expert Review Panel. 3 Two requirements, CIP R1 and CIP 007 4, had a sub requirement retired in the Paragraph 81 Phase 1 project. These have been categorized as modified. SOTC Reliability Standards Quarterly Status Report August of 34

26 Paragraph 81 and Independent Experts Quarterly Update Status/Functional Applicability spreadsheet 4 to analyze the trend in the total number of Board approved requirements at the end of each year since standards became enforceable in the United States in The number of Board approved requirements at year end for each year was determined by the total number of requirements that were approved by the Board on or before December 31 of that year, minus the total number of requirements retired by the Board on or before December 31 of that same year. Since Board adoption of a Reliability Standard generally includes retirement of the previous version of the same standard, this approach to counting requirements should provide a clear indication of the trend in the number of requirements when charted over time. The analysis categorized requirements as either Order 693, Emerging Risk (currently CIP, physical security, and GMD), or Regional (requirements that do not apply continent wide, including regional standards or variances in continent wide standards). In some years, the number of requirements that were retired were offset by new or additional requirements. For example, some requirements in early standards assigned responsibility to multiple functional entities, within a single requirement. In cases where the responsibilities of these entities differ, clarity may be enhanced by separating the single requirement into two or more requirements that each assign responsibilities, consistent with the functional model, to a single functional entity. Requirements have also been added to address emerging issues such as cyber security (CIP), physical security, and geomagnetic disturbances (GMD). Chart 1 illustrates the trend in the number of requirements. The total number of requirements grew slightly between 2007 and 2011, before beginning to decline in The number of Order 693 requirements showed the most significant reduction, from a total of 447 requirements in 2007 to 385 as of June 30, 2014 (about a 14 percent reduction). In contrast, requirements to address emerging risks remained relatively flat, with a decrease in 2012 and The most significant increase in requirements has been in the Regional category, which increased from 20 requirements in 2007 to 92 requirements as of June 30, 2014 nearly a five fold increase. The Regional standards have not been included in the Total R line in the chart on the following page. 4 Available from the Standards section of the NERC website: 5 Because of differences in regulatory authority in non U.S. jurisdictions, it is not possible to prepare comparable analysis for those jurisdictions. SOTC Quarterly Reliability Standards Status Report May of 34

27 Paragraph 81 and Independent Experts Quarterly Update Trend in Number of Requirements Number of Requirements Order Emerging Risks Regional Total R Order 693 Emerging Risks Regional Total R Chart 1 Trend in Number of Requirements SOTC Quarterly Reliability Standards Status Report May of 34

28 Paragraph 81 and Independent Experts Quarterly Update Chart 2 illustrates the fraction of total requirements that are each of the three types by year Order 693, Emerging Risks, or Regional requirements. Number of Requirements by Type Order 693 Emerging Risks Regional Chart 2 Number of Requirements by Type SOTC Quarterly Reliability Standards Status Report May of 34