NERC Proposes New Physical Reliability Standard

by Akin Gump Strauss Hauer & Feld LLP
Contact

Last Friday, the North American Electric Reliability Corporation (NERC) submitted for approval by the Federal Energy Regulatory Commission (FERC), in Docket No. RM14-15, a proposed new physical reliability standard.  The proposed new standard is intended to comply with FERC’s March 7, 2014 order directing NERC to propose one or more reliability standards to require certain entities to “take steps or demonstrate that they have taken steps to address physical security risks and vulnerabilities related to the reliable operation of the Bulk-Power System.”

Proposed Reliability Standard CIP-014-1 – Physical Security

Proposed Reliability Standard CIP-014-1 would require transmission owners and operators to protect critical transmission stations and substations and their associated primary control centers that if rendered inoperable or damaged as a result of a physical attack could result in widespread instability, uncontrolled separation, or cascading within an interconnection.  Specifically:

  • Requirement R1 requires applicable transmission owners1 to perform risk assessments on a periodic basis to identify their transmission stations and substations that if rendered inoperable or damaged could result in widespread instability, uncontrolled separation, or cascading within an interconnection.  The transmission owner must then identify  the  primary  control  center  that  operationally  controls  each  of the  identified transmission stations or substations.  Subsequent risk assessments must be performed:
    • At least once every 30  calendar months for a transmission owner that has identified in its previous risk assessment one or more transmission stations or substations that if rendered inoperable or damaged could result in widespread instability, uncontrolled separation, or cascading within an interconnection; or
    • At least once every 60 calendar months for a transmission owner that has not identified in its previous risk assessment any transmission stations or substations that if rendered inoperable or damaged could result in widespread instability, uncontrolled separation, or cascading within an interconnection.
  • Requirement  R2  provides  that  each  applicable  transmission  owner  shall  have  an unaffiliated third party with appropriate experience verify the risk assessment performed under Requirement R1.  The transmission owner must either modify its identification of facilities consistent with the verifier’s recommendation or document the technical basis for not doing so.
  • Requirement R3 requires the transmission owner to notify a transmission operator that operationally controls a primary control center identified under Requirement R1 of such identification. This requirement helps ensure that such a transmission operator has notice of the identification so that it may timely fulfill its resulting obligations  under Requirements R4 and R5 to protect that primary control center.
  • Requirement R4 requires each applicable transmission owner and transmission operator to conduct an evaluation of the potential threats and vulnerabilities of a physical attack to each of its respective transmission station(s), substation(s), and primary control center(s) identified in Requirement R1, as verified under Requirement R2.  The evaluation shall consider the following:
    • Unique characteristics of the transmission station(s), substation(s), and primary control center(s);
    • Prior history of attack on similar facilities taking into account the frequency, geographic proximity, and severity of past physical security related events; and
    • Intelligence or threat warnings received from sources such as law enforcement, the Electric Reliability Organization, the Electricity Sector Information Sharing and Analysis Center, U.S. federal and/or Canadian governmental agencies, or their successors.
  • Requirement R5 requires each transmission owner and transmission operator to develop and implement a documented physical security plan that covers each of its respective transmission stations, substations, and primary control centers identified in Requirement R1, as verified under Requirement R2.  The physical security plan(s) shall include the following attributes:
    • Resiliency or security measures designed collectively to deter, detect, delay, assess, communicate, and respond to potential physical threats and vulnerabilities identified during the evaluation conducted in Requirement R4.  These measures could include, for example: (i) modifications to system topology, (ii) the construction of a new transmission station or substation that would lessen the criticality of the facility, (iii) providing for access to spare or replacement equipment.
    • Law enforcement contact and coordination information.
    • A timeline for executing the physical security enhancements and modifications specified in the physical security plan.
    • Provisions to evaluate evolving physical threats, and their corresponding security measures, to the transmission station(s), substation(s), or primary control center(s).  An entity's physical security plan should include processes and responsibilities for obtaining and handling alerts, intelligence, and threat warnings from various sources
  • Requirement  R6  provides  that  each  transmission  owner  and  transmission  operator subject to Requirements R4 and R5 have an unaffiliated third party with  appropriate experience review its Requirement R4 evaluation and Requirement R5 security plan. The transmission owner and transmission operator must either modify its evaluation and security plan consistent with the recommendation of the reviewer or document its reasons for not doing so.

The proposed new standard also creates an affirmative obligation on each transmission owner and transmission operator to implement procedures for protecting sensitive or confidential information made available to the unaffiliated third party reviewer and to protect sensitive or confidential information from public disclosure.  Procedures for protecting confidential information may include, among other things: (1) the control and retention of information at the applicable entity’s facility for third party verifiers/reviewers; (2) restricting information to only those employees that need to know such information for purposes of carrying out their job functions; (3) marking all relevant documents as confidential; (4) securely storing and destroying information, both physical and electronically; and (5) requiring senior manager sign-off prior to releasing any sensitive or confidential information to an outside entity.

Proposed Implementation Plan

The proposed implementation plan would require transmission owners to complete their initial risk assessments on or before the effective date of the proposed new standard.  NERC has requested that FERC approve the proposed new standard to become effective on the first day of the first calendar quarter that is six months after Commission approval.

Potential Implications

If approved by FERC, the proposed new standard would hold transmission owners and operators potentially accountable if physical security measures later viewed as inadequate were to contribute to widespread instability, uncontrolled separation, or cascading within an interconnection.  Transmission owners and operators will want to carefully document compliance with the standard and prudent evaluation of the full range of options available to reduce physical threats, including the construction of new assets that would lessen the criticality of any one facility.  Entities with stated transmission rates (rather than formula rates) also may want to consider regulatory strategies to ensure full recovery of prudent costs incurred to comply with the new standard, including the costs of third party verifiers.


1 The proposed standard applies only to those transmission owners that own a transmission station or substation that meets the description of “Medium Impact” Transmission Facilities listed in Attachment 1 of Reliability Standard CIP-002-5.1.  NERC expects that a number of transmission owners required to perform risk assessments under Requirement R1 will not identify any transmission stations or substations that, if damaged or rendered inoperable as a result of physical attack, pose a risk of widespread instability, uncontrolled separation, or cascading within an interconnection. Nevertheless, NERC and the standard drafting team concluded that using the “Medium Impact” criteria was a prudent approach to balancing the need for a reliability standard that is broad enough to capture all critical transmission stations and substations while narrowing the scope of the reliability standard so as not to unnecessarily include entities that do not own or operate such critical facilities.

 

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Akin Gump Strauss Hauer & Feld LLP | Attorney Advertising

Written by:

Akin Gump Strauss Hauer & Feld LLP
Contact
more
less

Akin Gump Strauss Hauer & Feld LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Privacy Policy (Updated: October 8, 2015):
hide

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.

Security

JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.