2014-27908. Physical Security Reliability Standard

AGENCY:

Federal Energy Regulatory Commission, Energy.

ACTION:

Final rule.

SUMMARY:

The Federal Energy Regulatory Commission (Commission) approves Reliability Standard CIP-014-1 (Physical Security). The North American Electric Reliability Corporation, the Commission-certified Electric Reliability Organization, submitted Reliability Standard CIP-014-1 for Commission approval in response to a Commission order issued on March 7, 2014. The purpose of Reliability Standard CIP-014-1 is to enhance physical security measures for the most critical Bulk-Power System facilities and thereby lessen the overall vulnerability of the Bulk-Power System against physical attacks. In addition, the Commission directs NERC to develop one modification to Reliability Standard CIP-014-1 and submit an informational filing.

DATES:

This rule is effective January 26, 2015.

FOR FURTHER INFORMATION CONTACT:

Regis Binder (Technical Information), Office of Electric Reliability, Division of Reliability Standards and Security, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, Telephone: [phone], [e-mail].

Matthew Vlissides (Legal Information), Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426, Telephone: [phone], [e-mail].

SUPPLEMENTARY INFORMATION:

Order No. 802

Final Rule

(Issued November 20, 2014)

1. Pursuant to section 215 of the Federal Power Act (FPA), the Commission approves Reliability Standard CIP-014-1 (Physical Security).^[1] The North American Electric Reliability Corporation (NERC), the Commission-certified Electric Reliability Organization (ERO), submitted Reliability Standard CIP-014-1 for Commission approval in response to a Commission order issued on March 7, 2014.^[2] The purpose of Reliability Standard CIP-014-1 is to enhance physical security measures for the most critical Bulk-Power System facilities and thereby lessen the overall vulnerability of the Bulk-Power System facilities against physical attacks. In addition to approving Reliability Standard CIP-014-1, as discussed below, the Commission directs NERC to submit an informational filing and, pursuant to FPA section 215(d)(5), directs NERC to develop a modification to Reliability Standard CIP-014-1.^[3]

I. Background

A. Section 215 and Mandatory Reliability Standards

2. Section 215 of the FPA requires the Commission to certify an ERO to develop mandatory and enforceable Reliability Standards, subject to Commission review and approval. Once approved, the Reliability Standards may be enforced in the United States by the ERO, subject to Commission oversight, or by the Commission independently.^[4]

B. March 7 Order

3. In the March 7 Order, the Commission determined that physical attacks on the Bulk-Power System could adversely impact the reliable operation of the Bulk-Power System, resulting in instability, uncontrolled separation, or cascading failures. Moreover, the Commission observed that the then current Reliability Standards did not specifically require entities to take steps to reasonably protect against physical security attacks on the Bulk-Power System. Accordingly, to carry out section 215 of the FPA and to provide for the reliable operation of the Bulk-Power System, the Commission directed NERC, pursuant to FPA section 215(d)(5), to develop and file for approval proposed Reliability Standards that address threats and vulnerabilities to the physical security of critical facilities on the Bulk-Power System.

4. The March 7 Order indicated that the Reliability Standards should require owners or operators of the Bulk-Power System to take at least three steps to address the risks that physical security attacks pose to the reliable operation of the Bulk-Power System. Specifically, the March 7 Order directed that the Reliability Standards should require: (1) Owners or operators of the Bulk-Power System to perform a risk assessment of their systems to identify their “critical facilities”; (2) owners or operators of the identified critical facilities to evaluate the potential threats and vulnerabilities to those identified facilities; and (3) those owners or operators of critical facilities to develop and implement a security plan designed to protect against attacks to those identified critical facilities based on the assessment of the potential threats and vulnerabilities to their physical security.

5. The March 7 Order stated that the risk assessment used by an owner or operator to identify critical facilities should be verified by an entity other than the owner or operator, such as by NERC, the relevant Regional Entity, a reliability coordinator, or another entity.^[5] In addition, the March 7 Order indicated that the Reliability Standards should include a procedure for the verifying entity, as well as the Commission, to add or remove facilities from an owner's or operator's list of critical facilities.^[6] The March 7 Order further stated that the determination of threats and vulnerabilities and the security plan should be reviewed by NERC, the relevant Regional Entity, the reliability coordinator, or another entity with appropriate expertise.

6. The March 7 Order stated that, because the three steps of compliance with the contemplated Reliability Standards could contain sensitive or confidential information that, if released to the public, could jeopardize the reliable operation of the Bulk-Power System, NERC should include in the Reliability Standards a procedure that will ensure confidential treatment of sensitive or confidential information but still allow for the Commission, NERC and the Regional Entities to review and inspect any information that is needed to ensure compliance with the Reliability Standards.^[7]

7. The Commission directed NERC to submit the proposed Reliability Standards to the Commission for approval within 90 days of issuance of the March 7 Order (i.e., June 5, 2014).

C. NERC Petition

8. On May 23, 2014, NERC petitioned the Commission to approve Reliability Standard CIP-014-1 and its associated violation risk factors and violation severity levels, implementation plan, and effective date.^[8] NERC maintains that the Reliability Standard is just, reasonable, not unduly discriminatory, or preferential, and in the public interest. In addition, NERC asserts that the proposed Reliability Standard complies with the Commission's directives in the March 7 Order.

9. NERC explains that Reliability Standard CIP-014-1 “serves the vital reliability goal of enhancing physical security measures for the most critical Bulk-Power System facilities and lessening the overall vulnerability of the Bulk-Power System to physical attacks.” ^[9] NERC maintains that the “appropriate focus of the proposed Reliability Standard is Transmission stations and Transmission substations, which are uniquely essential elements of the Bulk-Power System.” ^[10] The Reliability Standard is applicable to transmission owners that satisfy the Applicability Sections 4.1.1.1, 4.1.1.2, 4.1.1.3, or 4.1.1.4, and to transmission operators. NERC states that the transmission facilities covered by Applicability Sections 4.1.1.1 through 4.1.1.4 match the “Medium Impact” transmission facilities listed in Attachment 1 (Impact Rating Criteria), specifically, the “Medium Impact” facilities described in Sections 2.4, 2.5, 2.6, and 2.7, of Reliability Standard CIP-002-5.1,^[11] According to NERC, the “standard drafting team determined that using the criteria for `Medium Impact' Transmission Facilities set forth in Reliability Standard CIP-002-5.1 is an appropriate applicability threshold as the Commission has acknowledged that it is a technically sound basis for identifying Transmission Facilities, which, if compromised, would present an elevated risk to the Bulk-Power System.” ^[12]

10. Reliability Standard CIP-014-1 has six requirements. Requirement R1 requires applicable transmission owners to perform risk assessments on a periodic basis to identify their transmission stations and transmission substations that, if rendered inoperable or damaged, could result in widespread instability, uncontrolled separation, or cascading within an Interconnection. Requirement R1 also requires transmission owners to identify the primary control center that operationally controls each of the identified transmission stations or transmission substations.

11. Requirement R2 requires that each applicable transmission owner have an unaffiliated third party with appropriate experience verify the risk assessment performed under Requirement R1. Requirement R2 states that the transmission owner must either modify its identification of facilities consistent with the verifier's recommendation or document the technical basis for not doing so. In addition, Requirement R2 requires each transmission owner to implement procedures for protecting sensitive or confidential information made available to third-party verifiers or developed under the Reliability Standard from public disclosure.

12. Requirement R3 requires the transmission owner to notify a transmission operator that operationally controls a primary control center identified under Requirement R1 of such identification to ensure that the transmission operator has notice of the identification so that it may timely fulfill its obligations under Requirements R4 and R5 to protect the primary control center.

13. Requirement R4 requires each applicable transmission owner and transmission operator to conduct an evaluation of the potential threats and vulnerabilities of a physical attack on each of its respective transmission stations, transmission substations, and primary control centers identified as critical in Requirement R1.

14. Requirement R5 requires each transmission owner and transmission operator to develop and implement documented physical security plans that cover each of their respective transmission stations, transmission substations, and primary control centers identified as critical in Requirement R1.

15. Requirement R6 requires that each transmission owner and transmission operator subject to Requirements R4 and R5 have an unaffiliated third party with appropriate experience review its Requirement R4 evaluation and Requirement R5 security plan. Requirement R6 states that the transmission owner or transmission operator must either modify its evaluation and security plan consistent with the recommendation, if any, of the reviewer or document its reasons for not doing so. In addition, Requirement R6 requires each transmission owner to implement procedures for protecting sensitive or confidential information made available to third-party reviewers or developed under the Reliability Standard from public disclosure.

D. Notice of Proposed Rulemaking

16. On July 17, 2014, the Commission issued a Notice of Proposed Rulemaking proposing to approve Reliability Standard CIP-014-1 as just, reasonable, not unduly discriminatory or preferential, and in the public interest.^[13] In addition, the NOPR proposed to direct NERC to develop two modifications to the Reliability Standard. First, the NOPR proposed to direct NERC to develop a modification to allow applicable governmental authorities (i.e., the Commission and any other appropriate federal or provincial authorities) to add or subtract facilities from an applicable entity's list of critical facilities under Requirement R1.^[14] Second, the NOPR proposed to direct NERC to modify the Reliability Standard to remove the term “widespread” as it appears in the phrase “widespread instability” in Requirement R1.^[15] The NOPR also proposed to direct NERC to submit two informational filings, one addressing the protection of “High Impact” control centers and the other addressing resiliency measures, to be submitted, respectively, within six months and one year following the effective date of a final rule in this proceeding.^[16]

17. In response to the NOPR, the Commission received 33 sets of initial comments and six sets of reply comments. We address below the issues raised in the NOPR and comments. The Appendix to this final rule lists the entities that filed comments in response to the NOPR.

II. Discussion

18. Pursuant to FPA section 215(d)(2), we approve Reliability Standard CIP-014-1 as just, reasonable, not unduly discriminatory or preferential, and in the public interest. The Commission also approves the associated violation risk factors, violation severity levels, implementation plan, and effective date proposed by NERC (i.e., the “first day of the first calendar quarter that is six months beyond” the effective date of the final rule in this proceeding).^[17] As discussed below, the Commission determines that Reliability Standard CIP-014-1 satisfies the directives in the March 7 Order concerning the development and submittal of physical security Reliability Standards.

19. In addition to approving Reliability Standard CIP-014-1, the Commission adopts in part the NOPR proposal directing NERC to develop and submit modifications to the Reliability Standard concerning the use of the term “widespread” in Requirement R1. The Commission determines that the term “widespread” is unclear with respect to the obligations it imposes on applicable entities; how it would be implemented by applicable entities; and how it would be enforced. Accordingly, the Commission directs NERC, pursuant to FPA section 215(d)(5), to remove the term “widespread” from Reliability Standard CIP-014-1 or, alternatively, to propose modifications to the Reliability Standard that address the Commission's concerns. We direct that NERC submit a responsive modification within six months from the effective date of this final rule.

20. The Commission does not adopt the NOPR proposal that would have required NERC to develop and submit modifications to Reliability Standard CIP-014-1 to allow applicable governmental authorities (i.e., the Commission and any other appropriate federal or provincial authorities) to add or subtract facilities from an applicable entity's list of critical facilities under Requirement R1. We determine that the Commission's enforcement authority under FPA section 215(e), and particularly the use of targeted auditing following implementation of Reliability Standard CIP-014-1, will allow us to address the concerns raised in the NOPR.

21. With respect to the informational filings proposed in the NOPR, the Commission adopts the proposal to direct NERC to make an informational filing addressing whether Reliability Standard CIP-014-1 provides physical security for all “High Impact” control centers, as that term is defined in Reliability Standard CIP-002-5.1, necessary for the reliable operation of the Bulk-Power System. However, the Commission extends the deadline for that informational filing until two years following the effective date of Reliability Standard CIP-014-1. The Commission, at this time, does not adopt the NOPR proposal to direct NERC to make an informational filing addressing resiliency. Instead, the Commission will continue to consider ways for industry to best inform the Commission of its current and future resiliency efforts, which could take the form of reports and/or technical conferences to address specific areas of concern (e.g., spare parts, fuel security, and advanced technologies).

22. We address below the following issues raised in the NOPR and in the comments: (A) Removal of the term “widespread”; (B) applicable governmental authorities' ability to add or subtract facilities from an entity's list of critical facilities; (C) informational filing on “High Impact” control centers; (D) informational filing on resiliency; (E) third-party verification and review; (F) exclusion of generators from the applicability section of Reliability Standard CIP-014-1; (G) confidentiality; (H) other issues raised in comments; (I) violation risk factors and violation severity levels; and (J) implementation plan and effective date.

A. Removal of the Term “Widespread”

March 7 Order

23. The March 7 Order stated that a critical facility is “one that, if rendered inoperable or damaged, could have a critical impact on the operation of the interconnection through instability, uncontrolled separation or cascading failures on the Bulk-Power System.” ^[18]

NERC Petition

24. Reliability Standard CIP-014-1 states that its purpose is to “identify and protect Transmission stations and Transmission substations, and their associated primary control centers, that if rendered inoperable or damaged as a result of a physical attack could result in widespread instability, uncontrolled separation, or Cascading within an Interconnection.” ^[19] Requirement R1 states that the “initial and subsequent risk assessments shall consist of a transmission analysis or transmission analyses designed to identify the Transmission station(s) and Transmission substation(s) that if rendered inoperable or damaged could result in widespread instability, uncontrolled separation, or Cascading within an Interconnection.”

NOPR

25. The NOPR proposed to direct NERC to modify Reliability Standard CIP-014-1 to remove the term “widespread” as it appears in the phrase “widespread instability.” The NOPR stated that the phrase “widespread instability” is undefined by NERC and is inconsistent with the March 7 Order's explanation of “critical facility” and the definition of “reliable operation” in FPA section 215(a)(4).^[20]

26. The NOPR stated that the use of “widespread instability” in Requirement R1 could, depending on the meaning of “widespread,” narrow the scope (and number) of identified critical facilities under Reliability Standard CIP-014-1 beyond what was contemplated in the March 7 Order. The NOPR also stated that the use of the term “widespread” could potentially render the Reliability Standard unenforceable or lead to an inadequate level of reliability by omitting facilities that are critical to the reliable operation of the Bulk-Power System.

Comments

27. NERC comments that it does not oppose the NOPR directive but that the modification should be developed through NERC's standards development process and NERC should be allowed to propose alternative clarifying language “to ensure the proposed Reliability Standard remains focused on Interconnection impacts and not local impacts.” ^[21] NERC states that the term “widespread” was used to focus applicable entities' security efforts on facilities whose loss would have more than a local area impact.

28. SIA, Idaho Power, Pa PUC, SmartSenseCom, Foundation and Pepco support the NOPR proposal because they believe that the term “widespread” is vague or inconsistent with the definition of “reliable operation” in FPA section 215.^[22] Pepco, for example, states that the term “widespread” is ambiguous, will require requests for clarification or interpretation and will expose applicable entities to “second-guessing” from auditors. KCP&L, while it does not state that it supports the proposal, acknowledges that the term “widespread” is vague and that the term “introduces interpretive language that may be problematic for compliance and enforcement interpretations as well as unintentionally narrow the scope of facilities.” ^[23]

29. Other commenters do not support the proposed directive largely because they contend that the proposal may have the unintended consequence of expanding the scope of Reliability Standard CIP-014-1 to include localized events that have no impact on an Interconnection.^[24] APS, SCE, SDG&E, and G&T Cooperatives also maintain that while the term “widespread” is not defined by NERC, it appears elsewhere in the Reliability Standards, including in NERC's definition of “Cascading” and in the TPL Reliability Standards, and is understood by industry. Associations also state that the Commission should withdraw the NOPR proposal; however, Associations state that, in the alternative, the Commission should clarify that removal of the term “widespread” is not intended to bring within the scope of Reliability Standard CIP-014-1 “a substation or station unless the applicable Transmission Owner determines through technical studies and analyses that include the application of engineering judgment and practice that the loss of such facility would have a critical impact on the operation of the [bulk electric system] in the event the asset is rendered inoperable or damaged.” ^[25] NARUC states that the proposal will add costs without necessarily improving reliability.

30. ITC, while agreeing that the term “widespread” is not well-defined and would render the Reliability Standard vague, contends that the definition of critical facility in Requirement R1 should be replaced by defining as critical all physical facilities that contain “High Impact” or “Medium Impact” BES Cyber Systems as those terms are defined in Reliability Standard CIP-002-5.1.

Commission Determination

31. The Commission adopts the NOPR proposal in part and directs NERC to remove the term “widespread” from Reliability Standard CIP-014-1 or, alternatively, to propose modifications to the Reliability Standard that address the Commission's concerns. The differing views expressed in the comments validate the concern raised in the NOPR that the meaning of the term “widespread” is unclear and subject to interpretation.

32. We stated in the March 7 Order that “the Reliability Standards that we are ordering today apply only to critical facilities that, if rendered inoperable or damaged, could have a critical impact on the operation of the interconnection through instability, uncontrolled separation or cascading failures on the Bulk-Power System.^[26] We affirm the March 7 Order's statement that “[m]ethodologies to determine these facilities should be based on objective analysis, technical expertise, and experienced judgment.” ^[27]

33. However, incorporating the undefined term “widespread” in Reliability Standard CIP-014-1 introduces excessive uncertainty in identifying critical facilities under Requirement R1.^[28] As the Commission stated in the March 7 Order, only an instability that has a “critical impact on the operation of the interconnection” warrants finding that the facility causing the instability is critical under Requirement R1. The March 7 Order did not intend to suggest that the physical security Reliability Standards should address facilities that do not have a “critical impact on the operation of the interconnection.” This understanding is, we believe, unintentionally absent in Requirement R1 because the requirement only deems a facility critical when, if rendered inoperable or damaged, it could result in widespread instability, uncontrolled separation, or Cascading within an Interconnection. The definition in Requirement R1 should not be dependent on how an applicable entity interprets the term “widespread” but instead should be modified to make clear that a facility that has a critical impact on the operation of an Interconnection is critical and therefore subject to Requirement R1.

34. While some commenters contend that the meaning of the term “widespread” is well-understood by industry, we find that there is ample evidence in the record to support the conclusion that the term is susceptible to different interpretations by applicable entities. Notably, KCP&L states that, while it was a participant in the standards drafting process for Reliability Standard CIP-014-1, it agrees that the term requires interpretation. Moreover, KCP&L and Pepco share our concern that compliance enforcement authorities may find it difficult to consistently enforce compliance with Requirement R1 without a clear understanding of the term's meaning.

35. Accordingly, pursuant to FPA section 215(d)(5), the Commission directs NERC to develop a modification to Reliability Standard CIP-014-1 that either removes the term “widespread” from Requirement R1 or, in the alternative, proposes changes that address the Commission's concerns. Further, we direct that NERC submit a responsive modification within six months from the effective date of this final rule. We recognize that certain entities commented on how NERC could modify Reliability Standard CIP-014-1 to address the Commission's stated concerns.^[29] However, we conclude that it is appropriate to allow NERC to develop and propose a modification in the first instance. With respect to ITC's more general comments regarding the scope of critical facilities in Requirement R1, we address the potential for applying the impact designations in Reliability Standard CIP-002-5.1 to Reliability Standard CIP-014-1, Requirement R1 in the section below regarding the NOPR's proposed informational filing on “High Impact” control centers.

B. Applicable Governmental Authority's Ability To Add or Subtract Facilities From an Entity's List of Critical Facilities

March 7 Order

36. In the March 7 Order, the Commission stated that:

[T]he risk assessment used by an owner or operator to identify critical facilities should be verified by an entity other than the owner or operator. Such verification could be performed by NERC, the relevant Regional Entity, a Reliability Coordinator, or another entity. The Reliability Standards should include a procedure for the verifying entity, as well as the Commission, to add or remove facilities from an owner's or operator's list of critical facilities. . . .^[30]

NERC Petition

37. Reliability Standard CIP-014-1 does not include a procedure that allows the Commission to add or subtract facilities from an applicable entity's list of critical facilities under Requirement R1. Instead, NERC states that the Commission has the existing authority to enforce NERC Reliability Standards pursuant to FPA section 215(e)(3).^[31] NERC explains that a transmission owner must be able to demonstrate that its method for performing its risk assessment under Requirement R1 “was technically sound and reasonably designed to identify its critical Transmission stations and Transmission substations.” ^[32] NERC maintains that if “in the course of assessing an entity's compliance with the proposed Reliability Standard, NERC, a Regional Entity or [the Commission] finds that the entity's transmission analysis was patently deficient and the Requirement R2 verification process did not cure those deficiencies, they could use their enforcement authority to compel Transmission Owners to re-perform the risk assessment using assumptions designed to identify the appropriate critical facilities.” ^[33]

NOPR

38. The NOPR stated that Reliability Standard CIP-014-1 does not include a procedure that allows the Commission to add or subtract facilities from an applicable entity's list of critical facilities. The NOPR stated that if the Commission determined through an audit of an applicable entity, or through some other means, that a critical facility does not appear on the entity's list of critical facilities, there is no provision in Reliability Standard CIP-014-1 to allow the Commission to require its inclusion. In the NOPR, the Commission proposed to direct NERC to modify the physical security Reliability Standard to “include a procedure that would allow applicable governmental authorities, i.e., the Commission and any other appropriate federal or provincial authorities, to add or subtract facilities from an applicable entity's list of critical facilities.” ^[34]

Comments

39. NERC asserts that the Commission should not adopt the NOPR proposal. NERC maintains that the proposal is unnecessary because it duplicates existing Commission compliance monitoring and enforcement authority.^[35] Moreover, NERC contends that the NOPR's concerns surrounding the use of existing compliance and enforcement methods to ensure compliance with Requirement R1 are unsubstantiated. NERC states that if the NOPR proposal is adopted, then the Commission must better justify the reasons for the directive and limit and clarify the scope and content of the proposed directive.

40. Pa PUC, Foundation, SmartSenseCom and Paschall state that they support the NOPR proposal.^[36] Other commenters do not oppose the proposal but maintain that it should be clarified or modified if adopted by the Commission.^[37]

41. The majority of commenters do not support the NOPR proposal for various legal and policy reasons.^[38] Associations' comments are representative of this viewpoint in that they address: (1) The statutory authority to modify critical facility lists or otherwise allow the Commission (or any other governmental authority) an operational role in the performance of a Reliability Standard; (2) how the Commission would afford entities due process in determining whether to direct the addition or removal of facilities while still maintaining confidentiality; and (3) what constitutes “any other appropriate federal or provincial authorities” and the legal authority and advisability of delegating responsibility to another government entity. Like NERC, Associations contend that the Commission already possesses the compliance and enforcement authority to ensure that applicable entities comply with Requirement R1.^[39] Specifically, Associations state that the “Commission has sufficient existing enforcement authority under the FPA to take actions to address concerns raised in the NOPR regarding the sufficiency of decisions made to identify critical facilities under CIP-014-1 . . . includ[ing] the use of traditional enforcement authority under Section 215(e)(3), including audits and investigations, which it has used on several occasions.” ^[40] Associations also request a technical conference in two years that addresses the implementation of Reliability Standard CIP-014-1.

Commission Determination

42. Based on our review of the comments, we determine not to adopt the NOPR proposal.

43. We are persuaded by commenters that the NOPR directive would present NERC, as the entity that would have to develop the proposed modification, and the Commission, which would have to approve any NERC proposal, with a number of substantial policy issues. Ultimately, we believe that the NOPR proposal would require NERC and the Commission to expend resources that could be better applied elsewhere.

44. The Commission, instead, will focus its resources on carrying out compliance and enforcement activities to ensure that critical facilities are identified under Requirement R1. In its comments, NERC indicated that NERC staff will submit to the NERC Board of Trustees a report three months following implementation of Requirements R1, R2 and R3 concerning the scope of facilities identified as critical, including the number of facilities identified as critical and their defining characteristics.^[41] NERC also committed to sending this report to Commission staff.^[42] Based on the results reported by NERC, we expect Commission staff to audit a representative number of applicable entities to ensure compliance with Reliability Standard CIP-014-1. Depending on the audit findings, the Commission will determine if there is a need for any further action by the Commission including, but not limited to, directing NERC to develop modifications to Reliability Standard CIP-014-1 to provide greater specificity to the methodology for determining critical facilities. At this time, we will not direct Commission staff to convene a technical conference on implementation of Reliability Standard CIP-014-1 in two-years' time, as requested by Associations. We may revisit that proposal at a later time.

C. Informational Filing on “High Impact” Control Centers

March 7 Order

45. The March 7 Order stated that a “critical facility is one that, if rendered inoperable or damaged, could have a critical impact on the operation of the interconnection through instability, uncontrolled separation or cascading failures on the Bulk-Power System.” ^[43] The March 7 Order, while not mandating that a minimum number of facilities be deemed critical under the physical security Reliability Standards, explained that the “Commission expects that critical facilities generally will include, but not be limited to, critical substations and critical control centers.” ^[44]

NERC Petition

46. NERC states that Reliability Standard CIP-014-1 addresses the protection of primary control centers, which NERC defines as facilities that “operationally control[ ] a Transmission station or Transmission substation when the electronic actions from the control center can cause direct physical actions at the identified Transmission station or Transmission substation, such as opening a breaker.” ^[45]

47. NERC maintains that “[c]ontrol centers that provide back-up capability and control centers that cannot operationally control a critical Transmission station or Transmission substation do not present similar direct risks to Real-time operations if they are the target of a physical attack,” and thus they are not covered by Reliability Standard CIP-014-1.^[46] NERC explains that the destruction of a back-up control center would “have no direct reliability impact in Real-time as the entity can continue operation . . . from its primary control center.” ^[47] With respect to control centers that do not physically operate Bulk-Power System facilities, such as control centers operated by reliability coordinators, NERC states that, while “certain monitoring and oversight capabilities might be lost as a result of a physical attack on such control centers, the Transmission Owner or Transmission Operator that operationally controls the critical Transmission station or Transmission substation would be able to continue operating its transmission system to prevent widespread instability, uncontrolled separation, or Cascading within an Interconnection.” ^[48]

48. NERC acknowledges that certain control centers categorized as “High Impact” or “Medium Impact” under Reliability Standard CIP-002-5.1 (Cyber Security—BES Cyber System Categorization) would not be covered control centers under Reliability Standard CIP-014-1.^[49] NERC explains that this situation:

reflects the different nature of cyber security risks and physical security risks at control centers . . . [a] primary cyber security concern for control centers is the corruption of data or information and the potential for operators to take action based on corrupted data or information . . . [and] [t]his concern exists at control centers that operationally control Bulk-Power System facilities and those that do not. As such, there is no distinction in CIP-002-5.1 between these control centers . . . however, such a distinction is appropriate in the physical security context.^[50]

49. NERC points out that Reliability Standard CIP-006-5 already requires physical security protections that are “designed to restrict physical access to locations containing High and Medium Impact Cyber Systems,” which include control centers and backup control centers for reliability coordinators, balancing authorities, transmission operators and generation operators irrespective of their ability to operationally control Bulk-Power System facilities.^[51]

NOPR

50. The NOPR proposed to direct NERC to make an informational filing within six months of the effective date of a final rule in this proceeding indicating whether the development of Reliability Standards that provide physical security for all “High Impact” control centers, as that term is defined in Reliability Standard CIP-002-5.1, is necessary for the reliable operation of the Bulk-Power System.

51. The NOPR stated that primary and back-up control centers of functional entities other than transmission owners and operators identified as “High Impact” may warrant assessment and physical security controls under this Reliability Standard because a successful attack could prevent or impair situational awareness, especially from a wide-area perspective, or could allow attackers to distribute misleading and potentially harmful data and operating instructions that could result in instability, uncontrolled separation, or cascading failures.

52. The NOPR stated that the proposed informational filing should address whether there is a need for consistent treatment of “High Impact” control centers for cybersecurity and physical security purposes through the development of Reliability Standards that afford physical protection to all “High Impact” control centers. The NOPR also stated that the development of physical security protections for all “High Impact” control centers would not be without precedent because, as noted above, Reliability Standard CIP-006-5 already requires that “High Impact” control centers have some physical protections, including restrictions on physical access, to protect BES Cyber Assets. However, the NOPR further stated that the security measures required by Reliability Standard CIP-006-5 may not be comparable to those required by Reliability Standard CIP-014-1, and thus may not be sufficient to “deter, detect, delay, assess, communicate, and respond to potential threats and vulnerabilities” as required in Requirement R5 of Reliability Standard CIP-014-1. Further, the NOPR stated that Reliability Standard CIP-006-5 does not require an “unaffiliated third party review” of the evaluation and security plan required by Reliability Standard CIP-014-1.

Comments

53. NERC states that it does not oppose submitting an informational filing to address whether “High Impact” control centers warrant assessment and physical security controls under Reliability Standard CIP-014-1. However, NERC requests that the Commission modify the NOPR proposal to give NERC at least 12 months from the effective date of a final rule in this proceeding to submit the informational filing.

54. Other commenters, while not necessarily agreeing that all “High Impact” control centers should be subject to Reliability Standard CIP-014-1, support the NOPR proposal for various reasons.^[52] Associations state that the informational filing “will provide a more granular mapping of the strategic considerations embedded in the CIP standards . . . as well as consideration of the issues relating to control centers not covered by CIP-014-1.” ^[53] MISO and SDG&E state that the informational filing could be a useful way for identifying areas of possible improvement in the future. Some commenters, including Associations, recommend that the Commission direct NERC to submit the informational filing as critical energy infrastructure information (CEII).

55. ITC supports the proposed informational filing but states that the Commission should widen the scope of the informational filing to assess the benefits of extending Reliability Standard CIP-014-1 to all “High Impact” and “Medium Impact” BES Cyber Assets. ITC states that the definition of “critical” assets is insufficiently comprehensive because it fails to provide physical security for facilities that contain crucial Cyber Assets. ITC further states that identifying critical facilities under Requirement R1 is unnecessary because applicable entities already have a list of facilities containing “High Impact” and “Medium Impact” Cyber Assets, which could also serve as the list of critical facilities for the purposes of Reliability Standard CIP-014-1. SIA agrees that Requirement R1 should be modified to include all “High Impact” control centers.

56. Commenters opposed to the NOPR proposal contend that the informational filing is unnecessary or would be burdensome.^[54] Trade Associations state that Reliability Standard CIP-014-1 correctly focuses on the protection of primary control centers that operationally control transmission stations or substations identified under Requirement R1. Idaho Power states that Reliability Standard CIP-006-5 contains enough physical access controls to meet the expectations of “deter, detect, delay, assess, communicate, and respond” because there are extensive monitoring and alerting requirements that must be applied to all “High Impact” control centers. Reclamation states that Reliability Standard CIP-014-1 will capture all “High Impact” control centers as currently drafted. Pepco states that an informational filing would divert resources from implementation and compliance with Reliability Standard CIP-014-1.

Commission Determination

57. The Commission adopts the NOPR proposal and directs NERC to submit an informational filing that addresses whether there is a need for consistent treatment of “High Impact” control centers for cybersecurity and physical security purposes through the development of Reliability Standards that afford physical protection to all “High Impact” control centers. The Commission, however, modifies the NOPR proposal and extends the due date for the informational filing to two years following the effective date of Reliability Standard CIP-014-1.

58. While we approve Reliability Standard CIP-014-1 in this final rule, including the Reliability Standard's treatment of control centers, the Commission, for the reasons set forth in the NOPR, finds that NERC should assess whether all “High Impact” control centers should be protected under Reliability Standard CIP-014-1.^[55] We recognize that NERC and applicable entities will be in a better position to provide this assessment after implementation of Reliability Standard CIP-014-1 and Reliability Standard CIP-006-5, the latter of which provides some physical protection to “High Impact” control centers. Accordingly, the Commission directs NERC to submit the informational filing two years following the effective date of Reliability Standard CIP-014-1. The Commission, while not directing NERC to submit the informational filing as CEII, recognizes the concerns raised by commenters regarding confidentiality. The Commission expects NERC to prepare the informational filing and submit it in such a way as to protect any critical information from public disclosure.

59. At this time, the Commission will not direct NERC to address in the informational filing whether all “High Impact” and “Medium Impact” BES Cyber Assets should be considered critical for the purposes of Reliability Standard CIP-014, Requirement R1. We are sympathetic to several points raised in ITC's comments, which echo some of the statements in the NOPR. However, as stated in the NOPR, the basis for directing an informational filing regarding control centers is found in the March 7 Order, where the Commission stated that it “expects that critical facilities generally will include, but not be limited to, critical substations and critical control centers.” ^[56] While NERC explained why not all “High Impact” control centers may be critical for the purposes of Reliability Standard CIP-014-1, we conclude that this issue requires close attention and should be addressed in the informational filing. The broader concerns raised by ITC regarding the scope of Requirement R1 can be evaluated by NERC and industry as part of the implementation process. As we noted above, the Commission will devote resources to compliance with and enforcement of Reliability Standard CIP-014-1 to ensure that all critical facilities are identified pursuant to Requirement R1. Should the Commission find through these efforts, or through the post-implementation reports and informational filing that NERC will submit, that Requirement R1 as currently written is not capturing all critical facilities, then the Commission will act upon that information.

D. Informational Filing on Resiliency

March 7 Order

60. In the March 7 Order, the Commission stated that the development of physical security Reliability Standards “will help provide for the resiliency and reliable operation of the Bulk-Power System. To that end, the proposed Reliability Standards should allow owners or operators to consider resiliency of the grid in the risk assessment when identifying critical facilities, and the elements that make up those facilities, such as transformers that typically require significant time to repair or replace. As part of this process, owners or operators may consider elements of resiliency such as how the system is designed, operated, and maintained, and the sophistication of recovery plans and inventory management.” ^[57]

NERC Petition

61. Reliability Standard CIP-014-1 mentions resiliency in Requirement R5, stating in Requirement R5.1 that the physical security plans that entities develop shall include, among other attributes: “Resiliency or security measures designed collectively to deter, detect, delay, assess, communicate, and respond to potential physical threats and vulnerabilities identified during the evaluation conducted in Requirement R4.” The NERC petition describes Requirement R5.1, with regard to resiliency, as referring to “steps an entity may take that, while not specifically targeted as hardening the physical security of the site, help to decrease the potential adverse impact of a physical attack . . . including modifications to system topology or the construction of a new Transmission station . . . that would lessen the criticality of the facility.” ^[58]

NOPR

62. The NOPR stated that the NERC petition describes resiliency measures that could be included in the required physical security plans. The NOPR also stated, however, that specific resiliency measures are not required by Reliability Standard CIP-014-1, which is consistent with the March 7 Order. Instead, the NOPR noted that Reliability Standard CIP-014-1 allows the security plans to be flexible in order to meet different threats and protect varying Bulk-Power System configurations.

63. The NOPR stated that resiliency is as, or even more, important than physical security given that physical security cannot protect against all possible attacks. The NOPR also stated that, in the case of the loss of a substation, the Bulk-Power System may depend on resiliency to minimize the impact of the loss of facilities and restore blacked-out portions of the Bulk-Power System as quickly as possible. The NOPR further stated that some entities may implement resiliency measures rather than security measures, such as by adding facilities or operating procedures that reduce or eliminate the importance of existing critical facilities, which could significantly improve reliability and resiliency.

64. The NOPR stated that the NERC petition indicated that the NERC Board of Trustees expects NERC management to monitor and assess the implementation of Reliability Standard CIP-014-1 on an ongoing basis, which would include: The number of assets identified as critical under the Reliability Standard; the defining characteristics of the assets identified as critical; the scope of security plans (i.e., the types of security and resiliency measures contemplated under the various security plans); the timelines included in the security plan for implementing the security and resiliency measures; and industry progress in implementing the Reliability Standard. The NOPR also stated that NERC explained that this information could be used to provide regular updates to Commission staff.^[59] The NOPR proposed to rely on NERC's ongoing assessment of Reliability Standard CIP-014-1's implementation and to require NERC to make such information available to Commission staff upon request.

65. In addition, the NOPR proposed to direct NERC to submit an informational filing that addresses the resiliency of the Bulk-Power System when confronted with the loss of critical facilities. The NOPR stated that the informational filing should explore what steps can be taken, in addition to those required by Reliability Standard CIP-014-1, to maintain the reliable operation of the Bulk-Power System when faced with the loss or degradation of critical facilities. The NOPR proposed to direct NERC to submit the informational filing within one year after the effective date of the final rule in this proceeding.^[60]

Comments

66. NERC requests that the Commission not direct it to submit an informational filing on resiliency. NERC contends that an informational filing on resiliency would divert resources from NERC's oversight of the implementation of Reliability Standard CIP-014-1 and NERC's efforts to assess the Reliability Standard's effectiveness. NERC states that it will monitor and assess implementation of Reliability Standard CIP-014-1, as described in NERC's petition, and will prepare two initial reports for the NERC Board of Trustees, the first report being submitted three months following implementation of Requirements R1, R2 and R3 and the second report being submitted three months after implementation of Requirements R4, R5 and R6. With respect to the second report, NERC states that “[g]iven the NOPR's discussion of resiliency, this report will pay particular attention to the resiliency measures included in entities' security plans.” ^[61] NERC further states that it commits to provide both reports to Commission staff.

67. Pepco does not support the proposed informational filing because of the burden Pepco contends it would impose on NERC and registered entities, including diverting resources from the implementation of Reliability Standard CIP-014-1. Pepco asserts that resiliency is already addressed in Reliability Standard CIP-014-1.

68. SDG&E, MISO and Idaho Power support directing NERC to submit the proposed informational filing on resiliency as a way of determining next steps for enhancing the reliability of the Bulk-Power System.^[62]

69. Other commenters, including Associations, while generally agreeing that the issue of resiliency needs to be considered, recommend that the Commission convene a technical conference rather than require NERC to submit an informational filing because, they maintain, a technical conference would be more effective.^[63]

Commission Determination

70. The Commission determines not to adopt the NOPR proposal requiring NERC to submit an informational filing concerning resiliency of the Bulk-Power System. While commenters expressed differing views on whether an informational filing is needed, the comments recognized the importance of Bulk-Power System resiliency. In addition, NERC committed to providing the Commission with two reports following implementation of Reliability Standard CIP-014-1, which, NERC indicates, will address the issue of resiliency.

71. Rather than require NERC to submit an informational filing at this time, the Commission will review the NERC reports and will consider ways for industry to best inform the Commission of its current and future resiliency efforts, which could take the form of reports and/or technical conferences to address specific areas of concern (e.g., spare parts, fuel security, and advanced technologies).

E. Third-Party Verification and Review

March 7 Order

72. In the March 7 Order, the Commission stated that “the risk assessment used by an owner or operator to identify critical facilities should be verified by an entity other than the owner or operator . . . [and] [s]imilarly, the determination of threats and vulnerabilities and the security plan should also be reviewed by NERC, the relevant Regional Entity, the Reliability Coordinator, or another entity with appropriate expertise.” ^[64]

NERC Petition

73. Requirement R2 of Reliability Standard CIP-014-1 requires transmission owners to have their risk assessments verified by an unaffiliated third party. Requirement R6, likewise, requires each transmission owner and transmission operator to have their vulnerability and threat assessment(s) along with their security plan(s) for any critical facilities reviewed by an unaffiliated third party.

74. Regarding how an applicable entity is supposed to address any recommendations by a third-party verifier, Reliability Standard CIP-014-1, in Requirement R2.3, states that the transmission owner must either (a) “modify its identification . . . consistent with the recommendation” or (b) “document the technical basis for not modifying the identification in accordance with the recommendation.” Similarly, Requirement R6.3 sets forth the procedure for considering any recommendations from the reviewing entity as to the threat assessments and security plans: The applicable entity must either (a) “modify its evaluation or security plan(s) consistent with the recommendation” or (b) “document the reason(s) for not modifying the evaluation or security plan(s) consistent with the recommendation.”

75. NERC states that “[r]equiring documentation of the technical basis for not modifying the identification in accordance with the recommendation will help ensure that a Transmission Owner meaningfully considers the verifier's recommendations and follows those recommendations unless it can technically justify its reasons for not doing so. To comply with Part 2.3, the technical justification must be sound and based on acceptable approaches to conducting transmission analyses.” ^[65] The NERC petition contains a similar explanation for the third-party review (Requirement R6) of the threat assessments and security plans mandated in Requirements R4 and R5.^[66]

NOPR

76. The NOPR proposed to approve the third-party verification and review method proposed by NERC in Requirements R2 and R6. The NOPR stated that failure to provide a written, technically justifiable reason for rejecting a third-party recommendation would render the applicable entity non-compliant. With that understanding, the NOPR proposed to approve NERC's proposed third-party verification and review in Requirements R2 and R6 of Reliability Standard CIP-014-1 as an equally efficient and effective alternative to the directive in the March 7 Order.

Comments

77. NERC states that it supports the NOPR proposal. NERC states that third-party verification and review will provide another layer of expertise and independence to the identification of critical assets, the evaluation of threats and vulnerabilities, and the development of effective security plans. NERC reiterates that an applicable entity's failure to provide a reasonable, written explanation for declining to follow a third-party recommendation would constitute non-compliance.

78. MISO, Reclamation, KCP&L, ITC, and G&T Cooperatives support the NOPR proposal but each suggest modifications or request clarification of Reliability Standard CIP-014-1.^[67]

79. MISO states that entities like itself, that are both reliability coordinators and planning coordinators, may be subject to substantial, simultaneous demands by many transmission owners for concurrent verification of risk assessments. MISO notes that Requirement R2.2 requires applicable entities to have their risk assessment verified within 90 days of completion of the risk assessment. MISO states that firm adherence to the 90-day deadline could undermine the protections in Reliability Standard CIP-014-1 by requiring verifying entities (e.g., MISO) to conduct hurried or shorter-than-optimal assessments. Accordingly, MISO seeks clarification that NERC has the discretion to extend the implementation deadline, especially with respect to the 90-day verification deadline in Requirement R2.2. Likewise, G&T Cooperatives, NIPSCO and KCP&L state that there should be flexibility regarding the 90-day deadline because of the limited pool of qualified third-party verifiers.

80. Reclamation states that transmission owners should have discretion to make decisions regarding third-party recommendations based on cost and risk analyses. Reclamation also states that Requirement 2.1 should be modified to require that third-party verifications be conducted by a transmission owner's planning coordinator or transmission planner. If the transmission owner is also the planning coordinator and transmission planner, then Reclamation states that the verification should be conducted by the reliability coordinator.

81. KCP&L states that NERC should develop a pre-approved list of qualified third-party contractors or require third parties to register with NERC. KCP&L also seeks clarification that an independent system operator (ISO) or regional transmission operator (RTO) concurrent with its role as reliability coordinator could provide third-party review services. KCP&L states that it does not oppose having an RTO that is also a reliability coordinator or planning coordinator serve as a third-party reviewer but would not support a mandate requiring a specific third-party reviewer. KCP&L also seeks clarification of the meaning of the phrase “unaffiliated third-party.”

82. ITC states that the Commission should “confirm that the verification of a responsible entity's risk assessment, threat assessment, and security plan, as specified in Requirements R2 and R6, constitutes full compliance by that responsible entity with respect to the risk assessment and security plan.” ^[68]

83. NIPSCO, TVA and Idaho Power do not support the NOPR proposal. NIPSCO contends that third-party verification is “inconsistent with the approach to entity self-assessment applied in other Reliability Standards” and notes that the Version 5 CIP Reliability Standards do not include a provision for third-party review.^[69] NIPSCO also contends that the use of third parties could raise confidentiality concerns. Idaho Power maintains that the proposal should not be adopted because it does not require third parties to include a written or technical justification with their recommendations. Idaho Power also states that “if a third-party verification and review process is incorporated in to the Standard, it should clearly describe the specific methodology and performance criteria to be applied.” ^[70] TVA states that FPA section 215 does not contemplate the use of third-party verifiers and reviewers acting in an enforcement role. TVA also contends that Reliability Standard CIP-014-1 does not contain any qualification criteria that third-party verifiers and reviewers must meet. TVA further states that using third-party verifiers and reviewers could compromise the confidentiality of critical information.

Commission Determination

84. We adopt the NOPR proposal and approve the third-party verification and review provisions found in Requirements R2 and R6 of Reliability Standard CIP-014-1. These provisions, as stated by NERC, provide an important, independent layer of expertise in the identification, assessment and protection of critical facilities.

85. We disagree with the arguments raised in the comments submitted by NIPSCO, TVA and Idaho Power. The use of third-party verification and review in Reliability Standard CIP-014-1 is not inconsistent with other Commission-approved Reliability Standards merely because third-party review is not used in other Reliability Standards. NIPSCO is correct that the Version 5 CIP Reliability Standards do not include third-party review provisions. However, as NIPSCO acknowledges, the Version 5 CIP Reliability Standards contain bright-line criteria that guide the determinations made by applicable entities in identifying BES Cyber Assets.^[71] By contrast, Reliability Standard CIP-014-1 contains no such criteria and instead requires applicable entities to develop their own analysis. In addition, the threat evaluation in Requirement R4 and security plan in Requirement R6 involve areas of expertise that applicable entities in the electric industry may not possess and thus would strongly benefit from the experience of qualified third parties.

86. Similarly, we disagree with TVA that the use of third-party verifiers and reviewers is inconsistent with FPA section 215. As discussed above, we reject TVA's view that third-party verifiers and reviewers will be acting in an enforcement capacity. These third parties will have no authority to determine whether an applicable entity has violated a requirement of Reliability Standard CIP-014-1, require compliance, or issue penalties. Moreover, as stated in the NOPR, an applicable entity in some cases could be found to be in violation of a requirement even if the applicable entity's actions were verified by a third party.^[72] We also determine that the requirements in Reliability Standard CIP-014-1 (i.e., Requirements R2.1 and R6.1) establishing the qualifications for third-party verifiers and reviewers are sufficient. As discussed below, as Reliability Standard CIP-014-1 is implemented, we are satisfied that NERC and Regional Entities will provide additional assistance to applicable entities to identify qualified third-party verifiers and reviewers if the need arises. We are also satisfied that Requirements R2.4 and R6.4 provide adequate protection against the disclosure of sensitive or confidential information.

87. In response to Idaho Power's concern, we expect that third-party verifiers and reviewers will articulate a reasonable basis for their recommendations. The absence of such a basis for a recommendation could justify an applicable entity's decision to decline to adopt the recommendation. We also see no reason to include in Reliability Standard CIP-014-1 “specific methodology and performance criteria” for third-party verification and review beyond what is already contained in the requirements and compliance measures recited in the Reliability Standard.

88. With respect to the other comments, there is no evidence in the record to support the conclusion that an insufficient number of qualified third-party verifiers and reviewers exists such that applicable entities will be unable to meet the 90-day deadline in Requirements R2 and R6. To the extent an applicable entity requires additional time to comply, that situation should be addressed on a case-by-case basis.^[73] Reclamation has not explained why Requirement R2.1 should be modified to require that a transmission owner use its planning coordinator or transmission planner as a verifier, and thus we reject that proposal. In addition, addressing Reclamation's second point, while risk and cost could be aspects of an applicable entity's technical justification for declining to follow a third-party recommendation, ultimately there must be a sufficient objective basis in the justification document from which to determine that the applicable entity acted reasonably in declining to follow the recommendation.

89. With respect to KCP&L's comments, there may be value in NERC developing a list of qualified third-party verifiers and reviewers or otherwise requiring some form of registration process for third-party verifiers and reviewers. The Commission, however, will not direct NERC to do so at this time. We expect that NERC could, as Reliability Standard CIP-014-1 is implemented, pursue or, if necessary, propose such an effort if warranted. Indeed, Reliability Standard CIP-014-1 appears to contemplate such a role for NERC by indicating in Requirement R6.1 that an entity is qualified to serve as a reviewer if “approved by the ERO.” In addition, we see no reason why an ISO or RTO could not serve as a third-party verifier or reviewer provided it satisfies the qualifications stated in Requirements R2.1 and R6.1. We also conclude that the term “unaffiliated third party” is sufficiently clear. As NERC stated in its petition, “the term `unaffiliated' means that the selected verifying entity cannot be a corporate affiliate (i.e., the verifying entity cannot be an entity that corporately controls, is controlled by or is under common control with, the Transmission Owner). The verifying entity also cannot be a division of the Transmission Owner that operates as a functional unit.” ^[74] KCP&L does not indicate what, in this explanation, is ambiguous or requires clarification.

90. With respect to ITC's comment, third-party verification under Requirement R2 adds an important layer of expertise and independence in the identification of critical facilities. However, verification under Requirement R2 is not intended to and, indeed, cannot cure an applicable entity's failure to comply with Requirement R1 if it is determined by the compliance enforcement authority that the applicable entity failed to do so, a situation that ITC concedes could happen.^[75] We anticipate that a properly verified critical facility list will normally result in compliance with Requirement R1, but the Commission cannot foreclose the possibility that that may not be the case.^[76]

F. Generators

March 7 Order

91. The March 7 Order did not direct NERC to make the physical security Reliability Standards applicable to specific functional entity types. The March 7 Order stated that “some of the requirements imposed by these newly proposed Reliability Standards may best be performed by the owner and other activity may best be performed by the operator,” and that NERC should clearly indicate which entity is responsible for each requirement.^[77] With regard to the applicable types of facilities, the Commission stated that it “is not requiring NERC to adopt a specific type of risk assessment, nor is the Commission requiring that a mandatory number of facilities be identified as critical facilities under the Reliability Standards.” ^[78]

NERC Petition

92. In explaining why the Reliability Standard does not include generator owners and generator operators as applicable entities, the standard drafting team found that:

it was not necessary to include Generator Operators and Generator Owners in the Reliability Standard. First, Transmission stations or Transmission substations interconnecting generation facilities are considered when determining applicability. Transmission Owners will consider those Transmission stations and Transmission substations that include a Transmission station on the high side of the Generator Step-up transformer (GSU) using Applicability Section 4.1.1.1 and 4.1.1.2 . . . Second, the transmission analysis or analyses conducted under Requirement R1 should take into account the impact of the loss of generation connected to applicable Transmission stations or Transmission substations. Additionally, the [March 7] order does not explicitly mention generation assets and is reasonably understood to focus on the most critical Transmission Facilities.^[79]

93. NERC explains that generator owners and generator operators were not included in the applicability section because, “while the loss of a generator facility due to a physical attack may have local reliability effects, the loss of the facility is unlikely to have the widespread, uncontrollable impact” contemplated for loss of a critical facility in the March 7 Order.^[80] NERC maintains that a “generation facility does not have the same critical functionality as certain Transmission stations and Transmission substations due to the limited size of generating plants, the availability of other generation capacity connected to the grid, and planned resilience of the transmission system to react to the loss of a generation facility.” ^[81]

NOPR

94. The NOPR proposed to approve the applicability section of the Reliability Standard CIP-014-1 without the inclusion of generator owners and generator operators. The NOPR stated that omitting generator owners and generator operators from the applicability section is consistent with the March 7 Order. The NOPR affirmed the statement in the March 7 Order that the “number of facilities identified as critical will be relatively small compared to the number of facilities that comprise the Bulk-Power System.” ^[82] The NOPR proposed to accept NERC's justification for excluding generator owners and operators because it is in keeping with the March 7 Order's focus on protecting the most critical facilities. The NOPR stated that, according to NERC, a generation facility “does not have the same critical functionality as certain Transmission stations and Transmission substations due to the limited size of generating plants, the availability of other generation capacity connected to the grid, and planned resilience of the transmission system to react to the loss of a generation facility.” ^[83] The NOPR also noted that Requirement R1 mandates a transmission analysis that accounts for transmission owner- or transmission operator-owned substations that connect generating stations to the Bulk-Power System with step-up transformers.

95. While proposing to accept the applicability section of the proposed Reliability Standard, the NOPR stated that NERC's proposed omission of generator owners and generator operators could potentially exempt substations owned or operated by generators. The NOPR sought comment on the potential reliability impact of excluding generator owned or operated substations.

Comments

96. NERC states that it supports the NOPR proposal to approve the applicability criteria in Reliability Standard CIP-014-1 without the inclusion of generator owners and generator operators. NERC, reiterating the justification in the NERC petition, states that the loss of a generation facility is unlikely to result in critical impacts on the Bulk-Power System.

97. Associations, Trade Associations, Reclamation, G&T Cooperatives, KCP&L, Idaho Power, and APS also support the NOPR proposal.^[84] Associations' comments are representative of the comments supportive of the NOPR proposal in that Associations state that generation facilities will be considered in Reliability Standard CIP-014-1, even without generator owners and generator operators included in the applicability criteria, because all generators interconnected to applicable transmission stations or substations will be in included in the transmission analysis under applicability sections 4.1.1.1 and 4.1.1.2.

98. Paschall states, without elaboration, that generation facilities should be included within the scope of Reliability Standard CIP-014-1. Foundation comments that it supports Reliability Standard CIP-014-1, as modified in the NOPR, and also advocates for the inclusion of certain generation facilities in a second stage physical security Reliability Standard (discussed in Section H below).

Commission Determination

99. We adopt the NOPR proposal and approve the applicability criteria in Reliability Standard CIP-014-1 without the inclusion of generator owners and generator operators. As the Commission stated in the NOPR, we agree with NERC that a generation facility “does not have the same critical functionality as certain Transmission stations and Transmission substations due to the limited size of generating plants, the availability of other generation capacity connected to the grid, and planned resilience of the transmission system to react to the loss of a generation facility.”

100. Paschall provides a conclusory statement that generation facilities should be included in Reliability Standard CIP-014-1, but does not provide a rationale for this position. Thus, we find Paschall's comments unpersuasive.

G. Confidentiality

March 7 Order

101. The March 7 Order stated that:

All three steps of compliance with the Reliability Standard described above could contain sensitive or confidential information that, if released to the public, could jeopardize the reliable operation of the Bulk-Power System. Guarding sensitive or confidential information is essential to protecting the public by discouraging attacks on critical infrastructure. Therefore, NERC should include in the Reliability Standards a procedure that will ensure confidential treatment of sensitive or confidential information but still allow for the Commission, NERC and the Regional Entities to review and inspect any information that is needed to ensure compliance with the Reliability Standards.^[85]

NERC Petition

102. Reliability Standard CIP-014-1 includes two requirements addressing the concerns over confidentiality. Requirements R2.2 and R6.4, which are substantially the same, state that “[e]ach Transmission Owner shall implement procedures, such as the use of non- disclosure agreements, for protecting sensitive or confidential information made available to the unaffiliated third party [verifier or reviewer] and to protect or exempt sensitive or confidential information developed pursuant to this Reliability Standard from public disclosure.”

Comments

103. Associations, GridWise, Duke, Seattle, ITC, and Trade Associations state that the Commission should explicitly address the issue of confidentiality in the final rule. Associations state that the Commission should state that any data produced or collected by an RTO in accordance with a requirement of Reliability Standard CIP-014-1 are protected and should not be made available to a market monitor pursuant to a RTO tariff or market monitor agreement. Associations state that, at a minimum, a market monitor should have to make a filing with the Commission explaining the need for such information and indicating how the market monitor would protect such information from disclosure. GridWise and ITC state that they share Associations' concerns regarding confidentiality.

104. Trade Associations and Seattle comment that the final rule should contain an explicit statement that Reliability Standard CIP-014-1 is intended to preempt any state or local public disclosure laws. SWTDUG's reply comments question the Commission's legal authority to preempt state or local public disclosure laws, as suggested by Trade Associations and Seattle, without further Congressional action.

105. Duke comments that the Commission should take all necessary steps to protect the confidential information related to the activities of applicable entities, the Commission, NERC and Regional Entities in performance of their obligations under Reliability Standard CIP-014-1. Duke states that, pursuant to the Commission's regulations, the “disposition of each violation or alleged violation that relates to a Cybersecurity Incident or that would jeopardize the security of the Bulk-Power System if publicly disclosed shall be nonpublic unless the Commission directs otherwise.” ^[86] Duke recommends interpreting this provision to include violations of Reliability Standard CIP-014-1 or to revise the regulation to do so. Duke also maintains that: (1) The risk assessment required under Requirement R1; (2) the third-party verification performed under Requirement R2; (3) the notification provided to transmission operators under Requirement R3; (4) the evaluation of threats and vulnerabilities performed under Requirement R4; (5) the development of physical security plans performed under Requirement R5; and (6) the third-party review performed under Requirement R6 all qualify as CEII. In addition, Duke states that this information is also exempt from the Freedom of Information Act under the (b)(4) exemption for “trade secrets and commercial or financial information obtained from a person and privileged or confidential.”

Commission Determination

106. In the March 7 Order, the Commission recognized that compliance with the contemplated physical security Reliability Standards would likely require the development or sharing of confidential or sensitive material that, if disclosed to the public, could jeopardize the reliable operation of the Bulk-Power System. As a result, the Commission directed NERC to include adequate procedures in the Reliability Standards to prevent the dissemination of confidential or sensitive information.

107. We find that NERC has included sufficient safeguards in Reliability Standard CIP-014-1 to ensure that confidential or sensitive information produced in compliance with the Reliability Standard will not be publicly disclosed. Reliability Standard CIP-014-1 includes requirements regarding the sharing of information between applicable entities and third-party verifiers and reviewers in Requirements R2.4 and R6.4. Moreover, the “Compliance” section of Reliability Standard CIP-014-1 provides: “Confidentiality: To protect the confidentiality and sensitive nature of the evidence for demonstrating compliance with this standard, all evidence will be retained at the Transmission Owner's and Transmission Operator's facilities.”

108. The Commission will take all necessary and appropriate steps, as provided for in our governing statutes and regulations, to preserve an applicable entity's confidential or sensitive information when the public disclosure of such information could jeopardize the reliable operation of the Bulk-Power System. However, we decline to address in this final rule issues of preemption or the specific mechanism for treating confidential or sensitive information. Moreover, we find that it would be inappropriate to address Associations' request concerning the disclosure of information related to compliance with Reliability Standard CIP-014-1 to market monitors pursuant to a market monitor agreement or RTO tariff. No such agreements or tariffs are before us in this rulemaking proceeding.

H. Other Issues

109. Entergy seeks clarification as to whether the requirement in Reliability Standard CIP-014-1, Requirement R5 that an applicable entity “shall develop and implement a documented physical security plan(s) that covers their respective Transmission station(s), Transmission substation(s), and primary control center(s) . . . [and] shall be developed within 120 calendar days following the completion of Requirement R2 and executed according to the timeline specified in the physical security plan(s)” means that the actions called for in the security plan must be completed within 120 days. We see no ambiguity in Requirement R5 as the requirement only states that the security plan, not the actions called for in the plan, must be developed within 120 calendar days.

110. Reclamation proposes that the term “risk assessment” in Requirement R1 of Reliability Standard CIP-014-1 be changed to “impact assessment” because the requirement contemplates an assessment on the impact of the loss of facilities on the stability of the bulk electric system rather than a “risk assessment.” Reclamation further states that, based on the generally accepted meaning of the term “risk assessment,” that term better correlates to Requirement R4. We see no practical reason to require NERC to modify the nomenclature used in Requirement R1. Similarly, we see no reason to require NERC to change “risk assessment” to “threat risk assessment,” as suggested by Paschall, or to require NERC to define “risk assessment” because the term is largely defined in Requirement R1.

111. Foundation recommends that the Commission direct NERC to begin development of a second phase physical security Reliability Standard. Foundation maintains that such a Reliability Standard would address deficiencies in Reliability Standard CIP-014-1, including the exclusion of generation facilities and certain control centers. For example, Foundation maintains that the loss of a single generation facility could cause cascading outages on the Bulk-Power System. However, for the reasons discussed in Sections C and F above, we are not persuaded that there is a sufficient factual basis at this time to direct NERC to develop a second phase physical security Reliability Standard. While we decline to direct NERC to develop a second phase physical security Reliability Standard at this time, the informational filing on “High Impact” control centers required in this final rule, the post-implementation reports that NERC has committed to provide to the Commission, the Commission's compliance and enforcement efforts, and other outreach with NERC, industry and the public, will inform the Commission's views going forward as to what additional steps, if any, might be required to help ensure the reliable operation of the Bulk-Power System in the face of physical security threats.

I. Violation Risk Factors and Violation Severity Levels

112. Each requirement of Reliability Standard CIP-014-1 includes one violation risk factor and has an associated set of at least one violation severity level. The ranges of penalties for violations will be based on the sanctions table and supporting penalty determination process described in the Commission-approved NERC Sanction Guidelines, according to the NERC petition. The NOPR proposed to approve the violation risk factors and violation severity levels for the requirements in Reliability Standard CIP-014-1 consistent with the Commission's established guidelines.^[87] The Commission did not receive any comments regarding this aspect of the NOPR. Accordingly, the Commission approves the violation risk factors and violation severity levels for the requirements in Reliability Standard CIP-014-1.

J. Implementation Plan and Effective Date

NERC Petition

113. The NERC petition proposes that Reliability Standard CIP-014-1 become effective the “first day of the first calendar quarter that is six months beyond the date that this standard is approved by applicable regulatory authorities” (i.e., the effective date of a final rule in this proceeding approving the proposed Reliability Standard).^[88] NERC states that the initial risk assessment required under Requirement R1 must be completed by or before the effective date of the proposed Reliability Standard.^[89] As described in the requirements of the Reliability Standard, NERC also identifies when Requirements R2, R3, R4, R5, and R6 must be complied with following the effective date of Reliability Standard CIP-014-1.

NOPR

114. The NOPR proposed to approve NERC's implementation plan and effective date for Reliability Standard CIP-014-1.

Comments

115. KCP&L states that the Commission should make it clear if the effective date of Reliability Standard CIP-014-1 will be earlier than April 2016, which KCP&L states is the effective date of Reliability Standard CIP-002-5. KCP&L states that the “basis for determination of criticality in CIP-014-1 references the same applicability as found in the CIP-002-5 . . . [and the] potential disconnect in implementation dates may impact registered entities adversely in preparations for Critical Infrastructure Protection standards or in application of physical security improvements given the work required to identify critical assets.” ^[90]

Commission Determination

116. We approve the implementation plan and effective date proposed by NERC for Reliability Standard CIP-014-1. In response to KCP&L's comment, we understand that, pursuant to the implementation plan and effective date proposed by NERC and approved herein, Reliability Standard CIP-014-1 will become effective before April 2016.

III. Information Collection Statement

117. The Paperwork Reduction Act (PRA) ^[91] requires each federal agency to seek and obtain Office of Management and Budget (OMB) approval before undertaking a collection of information directed to ten or more persons or contained in a rule of general applicability. OMB regulations require approval of certain information collection requirements imposed by agency rules.^[92] Upon approval of a collection(s) of information, OMB will assign an OMB control number and an expiration date. Respondents subject to the filing requirements of an agency rule will not be penalized for failing to respond to these collections of information unless the collections of information display a valid OMB control number.

Comments

118. Associations state that developing a security plan will cost more than $19,000 per company and “should include a more realistic estimate of costs to comply with the proposed standard because of the influence that the Commission's assessment may have on the judgment of state utility commission or other regulatory authorities determining the prudence of costs incurred to comply with the proposed standard.” ^[93] Associations also state “that it understands that one medium-sized investor-owned utility anticipates that third-party contract support will cost approximately $270,000 for conducting transmission studies under R1, third-party verification under R2, analyses of threats under R4, and support for security plan development under R5.” ^[94] Associations further state that the Commission's estimate did not include the cost of implementing the actual security measures included in applicable entity security plan. KCP&L states that it supports Associations' comments.

Commission Determination

119. We adopt the Information Collection Statement estimates contained in the NOPR. As we have previously stated, the estimates provided in an Information Collection Statement are meant to quantify the paperwork burden imposed by a final rule.^[95] The Information Collection Statement is not intended to estimate the cost of compliance with the requirements of a Reliability Standard approved in a final rule.^[96] Associations has not explained why it believes the Commission's paperwork burden estimate is not “realistic” or what would be a “realistic” figure other than to relate, in a footnote, that it understands that an unidentified medium-sized utility anticipates that compliance with requirements of Reliability Standard CIP-014-1, rather than the paperwork burden imposed by a final rule approving the Reliability Standard, will cost approximately $270,000. Associations' comments do not provide any creditable evidence or analysis to cause us to reevaluate the paperwork burden estimate contained in the NOPR. Accordingly, as set forth below, we adopt the NOPR's Information Collection Statement burden and cost estimates.

120. The Commission based its estimates on the number of respondents on the NERC compliance registry as of May 28, 2014. According to the registry, there are 357 transmission owners (TOs) and 197 transmission operators (TOPs). The NERC compliance registry also shows that there are only 19 transmission operators that are not also registered as a transmission owner.

121. The burden associated with the final rule is included in FERC-725U (Mandatory Reliability Standards: Reliability Standard CIP-014, OMB Control Number 1902-0274).^[97] The following table shows the Commission's burden and cost estimates, broken down by requirement and year:

FERC-725U

Requirements in reliability standard CIP-014-1 over	Number and type of respondents	Number of responses per respondent	Total number of responses	Average burden hours and cost per response 98	Total burden hours and total cost
years 1-3	(1)	(2)	(1)*(2)=(3)	(4)	(3)*(4)
Year 1:
R1	357 TOs	1	357	20	7,140
				$1,220	$435,540
R2	357 TOs	1	357	34	12,138
				$2,342	$836,094
R3	2 TOPs	1	2	1	2
				$128	$256
R4	30 TOs	1	32	80	2,560
	2 TOPs			$4,880	$156,160
R5	30 TOs	1	32	320	10,240
	2 TOPs			$19,520	$624,640
R6	30 TOs	1	32	304	9,728
	2 TOPs			$18,812	$601,984
Record Retention	357 TOs	1	359	2	718
	2 TOPs			$64	$22,976
Year 2:
Record Retention	357 TOs	1	359	2	718
	2 TOPs			$64	$22,976
Year 3:
R1	30 TOs	1	30	20	600
				$1,220	$36,600
R2	30 TOs	1	30	34	1,029
				$2,342	$70,260
R3	2 TOPs	1	2	1	2
				$128	$256
R4	30 TOs	1	32	80	2,560
	2 TOPs			$4,880	$156,160
R5	30 TOs	1	32	80	2,560
	2 TOPs			$4,880	$156,160
R6	30 TOs	1	32	134	4,288
	2 TOPs			$8,442	$270,144
Record Retention	357 TOs	1	359	2	718
	2 TOPs			$64	$22,976
Year 1 Total					42,526
					$2,677,650
Year 2 Total					718
					$22,976
Year 3 Total					11,748
					$712,556
TOTAL (for Years 1-3)					54,992
					$3,413,182

122. In arriving at the figures in the above table, the Commission made the following assumptions:

a. Requirement R1: We assume that responsible entities will complete the required risk assessment at approximately the same time as they complete the assessments required under the existing TPL Reliability Standards. Accordingly, the burden for Reliability Standard CIP-014-1 only represents the documentation required in addition to what entities currently prepare. Conservatively, we assume that in the first year all transmission owners and transmission operators will complete the required risk assessment.^[99] In the third year, we assume that only 30 transmission operators will be required to do another risk assessment and that the entities with critical facilities after the first risk assessment will still have critical facilities after the second risk assessment.

b. Requirement R5: We assume that developing physical security plans in the first year will be more time consuming than in later years because in later years the plans will likely only need to be updated.

123. Title: FERC-725U, Mandatory Reliability Standards: Reliability Standard CIP-014-1.

Action: Proposed Collection of Information.

OMB Control No: 1902-0274.

Respondents: Business or other for profit, and not for profit institutions.

Frequency of Responses: Ongoing.

Necessity of the Information: Reliability Standard CIP-014-1 implements the Congressional mandate of the Energy Policy Act of 2005 to develop mandatory and enforceable Reliability Standards to better ensure the reliability of the nation's Bulk-Power System. Specifically, Reliability Standard CIP-014-1 ensures that applicable entities with critical Bulk-Power System facilities develop and implement physical security plans to address physical security threats and vulnerabilities that could result in widespread instability, uncontrolled separation, or cascading within an Interconnection.

Internal review: The Commission has reviewed Reliability Standard CIP-014-1 and has determined that the Reliability Standard is necessary to ensure the reliability and integrity of the nation's Bulk-Power System.

124. Interested persons may obtain information on the reporting requirements by contacting: Federal Energy Regulatory Commission, 888 First Street NE., Washington, DC 20426 [Attention: Ellen Brown, Office of the Executive Director, email: [e-mail], Phone: [phone], fax: [phone]]. Comments on the requirements of this rule may also be sent to the Office of Information and Regulatory Affairs, Office of Management and Budget, Washington, DC 20503 [Attention: Desk Officer for the Federal Energy Regulatory Commission]. For security reasons, comments should be sent by email to OMB at [e-mail]. Comments submitted to OMB should refer to FERC-725U and OMB Control No. 1902-0274.

IV. Environmental Analysis

125. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.^[100] The Commission has categorically excluded certain actions from this requirement as not having a significant effect on the human environment. Included in the exclusion are rules that are clarifying, corrective, or procedural or that do not substantially change the effect of the regulations being amended.^[101] The actions here fall within this categorical exclusion in the Commission's regulations.

V. Regulatory Flexibility Act

126. The Regulatory Flexibility Act of 1980 (RFA) ^[102] generally requires a description and analysis of proposed rules that will have significant economic impact on a substantial number of small entities.

127. The Small Business Administration (SBA) revised its size standard (effective January 22, 2014) for electric utilities from a standard based on megawatt hours to a standard based on the number of employees, including affiliates.^[103] Under SBA's new size standards, transmission owners and transmission operators likely come under the following category and associated size threshold: Electric bulk power transmission and control, at 500 employees.^[104]

128. The NOPR stated that, based on U.S. economic census data, the approximate percentage of small firms in this category is 57 percent.^[105] The NOPR also stated that the Commission did not have information concerning how the economic census data compares with entities registered with NERC and is unable to estimate the number of small transmission owners and transmission operators using the new SBA definition. However, the NOPR stated that Reliability Standard CIP-014-1 only applies to transmission owners and transmission operators that own and/or operate certain critical Bulk-Power System facilities. In the NOPR, the Commission stated that it believes that Reliability Standard CIP-014-1 will be applicable to a relatively small group of large entities. No comments were received addressing the Commission's proposed certification.^[106]

129. Accordingly, the Commission certifies that Reliability Standard CIP-014-1 will not have a significant impact on a substantial number of small entities. Accordingly, no regulatory flexibility analysis is required.

VI. Document Availability

130. In addition to publishing the full text of this document in the Federal Register, the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the Internet through the Commission's Home Page (http://www.ferc.gov) and in the Commission's Public Reference Room during normal business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street NE., Room 2A, Washington DC 20426.

131. From the Commission's Home Page on the Internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number excluding the last three digits of this document in the docket number field.

132. User assistance is available for eLibrary and the Commission's Web site during normal business hours from the Commission's Online Support at 202-502-6652 (toll free at 1-866-208-3676) or email at [e-mail], or the Public Reference Room at [phone], TTY [phone]. Email the Public Reference Room at [e-mail].

VII. Effective Date and Congressional Notification

133. This final rule is effective January 26, 2015. The Commission has determined, with the concurrence of the Administrator of the Office of Information and Regulatory Affairs of OMB, that this rule is not a “major rule” as defined in section 351 of the Small Business Regulatory Enforcement Fairness Act of 1996.^[107] This final rule is being submitted to the Senate, House, and Government Accountability Office.

By the Commission.

Nathaniel J. Davis, Sr.,

Deputy Secretary.

Note:

This appendix will not appear in the Code of Federal Regulations.

Appendix

Abbreviation	Commenter
Initial Commenters
APS	Arizona Public Service Company.
Associations	Edison Electric Institute, Electric Power Supply Association, Electricity Consumers Resource Council.
BPA	Bonneville Power Administration.
CEA	Canadian Electricity Association.
Duke	Duke Energy Corporation.
Entergy	Entergy.
Foundation	Foundation for Resilient Societies.
GridWise	GridWise Alliance.
G&T Cooperatives	Associated Electric Cooperative, Inc., Basin Electric Power Cooperative, and Tri-State Generation and Transmission Association, Inc.
Idaho Power	Idaho Power Company.
ITC	International Transmission Company.
KCP&L	Kansas City Power & Light Company and KCP&L Greater Missouri Operations Company.
MISO	Midcontinent Independent System Operator, Inc.
NARUC	National Association of Regulatory Utility Commissioners.
NEMA	National Electrical Manufactures Association.
NERC	North American Electric Reliability Corporation.
NU	Utilities Northeast Utilities System.
NYPSC	New York Public Service Commission.
Ohio PUC	Public Utilities Commission of Ohio.
Oncor	Oncor Electric Delivery Company LLC.
Pa PUC	Pennsylvania Public Utility Commission.
Paschall	Roger Paschall.
Pepco	Pepco Holdings, Inc.
Reclamation	U.S. Department of Interior, Bureau of Reclamation.
Seattle	City of Seattle.
SCE	Southern California Edison.
SDG&E	San Diego Gas & Electric.
SIA	Security Industry Association.
Southern	Southern Company Services, Inc.
TAPS	Transmission Access Policy Study Group.
TVA	Tennessee Valley Authority.
Trade Associations	American Public Power Association, Large Public Power Council, National Rural Electric Cooperative Association.
Xcel	Xcel Energy Services Inc.
Reply Commenters
Foundation	Foundation for Resilient Societies.
ITC	International Transmission Company.
NIPSCO	Northern Indiana Public Service Company.
SmartSenseCom	SmartSenseCom, Inc.
SWTDUG	Southwest Transmission Dependent Utility Group.
Tallahassee	City of Tallahassee.

Footnotes

1.  16 U.S.C. 824o.

2.  Reliability Standards for Physical Security Measures, 146 FERC ¶ 61,166 (2014) (March 7 Order).

3.  16 U.S.C. 824o(d)(5).

4.  Id. 824o(e).

5.  March 7 Order, 146 FERC ¶ 61,166 at P 11.

6.  Id.

7.  Id. P 10.

8.  NERC explains that, to meet the 90-day deadline in the March 7 Order, the NERC Standards Committee approved waivers to NERC's Standard Processes Manual to shorten the comment and ballot periods for the Standards Authorization Request and draft Reliability Standard. NERC Petition at 13-14. Reliability Standard CIP-014-1 is not attached to this Final Rule. The complete text of Reliability Standard CIP-014-1 is available on the Commission's eLibrary document retrieval system in Docket No. RM14-15-000 and is posted on the ERO's Web site, available at http://www.nerc.com.

9.  NERC Petition at 15-16.

10.  Id. at 18. NERC states that, although the terms “Transmission stations” and “Transmission substations” are sometimes used interchangeably, Reliability Standard CIP-014-1 uses the term “Transmission substation” to refer to a facility contained within a physical border (e.g., a fence or wall) that contains one or more autotransformers. Id. According to NERC, the term “Transmission station,” as used in Reliability Standard CIP-014-1, refers to a facility that functions as a switching station or switchyard but does not contain autotransformers. Id. at 18-19.

11.  Id. at 25 (citing Reliability Standard CIP-002-5.1 (Cyber Security—BES Cyber System Categorization), Attachment 1 (Impact Rating Criteria)).

12.  Id.

13.  Physical Security Reliability Standard, Notice of Proposed Rulemaking, 79 FR 42,734 (July 23, 2014), 148 FERC ¶ 61,040 (2014) (NOPR).

14.  Id. P 23.

15.  Id. P 29.

16.  Id. PP 35, 57.

17.  NERC Petition, Exhibit B (Implementation Plan) at 1.

18.  March 7 Order, 146 FERC ¶ 61,166 at P 6.

19.  NERC Petition at 17.

20.  “[A facility] that, if rendered inoperable or damaged, could have a critical impact on the operation of the interconnection through instability, uncontrolled separation or cascading failures on the Bulk-Power System.” March 7 Order, 146 FERC ¶ 61,166 at P 6; 16 U.S.C. 824o(a)(4) (“The term `reliable operation' means operating the elements of the bulk-power system within equipment and electric system thermal, voltage, and stability limits so that instability, uncontrolled separation, or cascading failures of such system will not occur as a result of a sudden disturbance, including a cybersecurity incident, or unanticipated failure of system elements.”).

21.  NERC Comments at 19.

22.  See SIA Comments at 2; Idaho Power Comments at 2; Pa PUC Comments at 5; Pepco Comments at 4-5; SmartSenseCom Comments at 7-8; Foundation Reply Comments at 7.

23.  KCP&L Comments at 4.

24.  See APS Comments at 3; SCE Comments at 3; SDG&E Comments at 4-5; TVA Comments at 9-10; Tallahassee Comments at 1; Oncor Comments at 3-4; Ohio PUC Comments at 4-5; BPA Comments at 3; NARUC Comments at 11; G&T Cooperatives Comments at 8-11; Southern Comments at 7-10.

25.  Associations Comments at 14-15; see also APS Comments at 3-4, Southern Comments at 11.

26.  March 7 Order, 146 FERC ¶ 61,166 at P 6 n.5.

27.  Id. P 6.

28.  See Version 5 Critical Infrastructure Protection Reliability Standards, Order No. 791, 78 FR 72,755 (Dec. 3, 2013), 145 FERC ¶ 61,160, at P 67 (2013), order granting clarification in part and denying rehearing, Order No. 791-A, 146 FERC ¶ 61,188 (2014) (directing removal or clarification “identify, assess and correct” language).

29.  See, e.g., BPA Comments at 2; Ohio PUC Comments at 5; TVA Comments at 9, ITC Comments at 9.

30.  March 7 Order, 146 FERC ¶ 61,166 at P 11.

31.  NERC Petition at 37.

32.  Id.

33.  Id.

34.  NOPR, 148 FERC ¶ 61,040 at P 23.

35.  NERC Comments at 8 (“the Commission can use its broad enforcement authority to make certain that the applicable entity re-performs the risk assessment on whatever timeline the Commission deems appropriate or face penalties or sanctions under the FPA”).

36.  Pa PUC Comments at 5; Foundation Comments at 3; SmartSenseCom Comments at 6; Paschall Comments at 2.

37.  See G&T Cooperatives Comments at 3-8; ITC Comments at 12; NYPSC Comments at 5-7; Pepco Comments at 5-7; Idaho Power Comments at 1-2.

38.  See Southern Comments at 2-7; Trade Associations Comments at 5-12; GridWise Comments at 3-9; Duke Comments at 3-5; NARUC Comments at 4; KCP&L Comments at 2-4; SDG&E Comments at 3-4; Oncor Comments at 2-3; Entergy Comments at 1; TAPS Comments at 3-9; APS Comments at 2-3; BPA Comments at 2; SCE Comments at 2; Ohio PUC Comments at 3-4; TVA Comments at 6-9; CEA Comments at 3-9; NU Utilities Comments at 1.

39.  Associations Comments at 9; see also TAPS Comments at 5 (“If the Commission finds a Registered Entity's risk assessment study to be inadequate because it lacks a critical facility, the Registered Entity will be in violation of [Requirement] R1 of the Physical Security standard . . . [t]he Commission could then direct a specific method of compliance . . . and impose daily penalties until the Registered Entity complies. If despite the threat of penalties, the Commission were concerned about the need for timely action, it could order the Registered Entity to come into compliance within a specified reasonable timeframe.”).

40.  Associations Comments at 9.

41.  NERC Comment at 27-28. NERC's post-implementation reports are further discussed below.

42.  Id. at 28.

43.  March 7 Order, 146 FERC ¶ 61,166 at P 6.

44.  Id. P 6, n.6.

45.  NERC Petition at 19.

46.  Id.

47.  Id. at 20.

48.  Id. at 20-21.

49.  Reliability Standard CIP-002-5.1 (Cyber Security—BES Cyber System Categorization), Attachment 1 (Impact Rating Criteria).

50.  NERC Petition at 22 n.55.

51.  Id. at 21.

52.  See Associations Comments at 16; KCP&L Comments at 4; Foundation Comments at 7; SDG&E Comments at 5; Pa PUC Comments at 6; SCE Comments at 4; MISO Comments at 6-7.

53.  Associations Comments at 16.

54.  Trade Associations Comments at 12; Pepco Comments at 7.

55.  See NOPR, 148 FERC ¶ 61,040 at PP 35-39.

56.  NOPR, 148 FERC ¶ 61,040 at P 44 (quoting March 7 Order, 146 FERC ¶ 61,166 at P 6 n.6).

57.  March 7 Order, 146 FERC ¶ 61,166 at P 7.

58.  NERC Petition at 42.

59.  NOPR, 148 FERC ¶ 61,040 at P 56.

60.  NERC issued a report on severe impact resilience in 2012. See NERC, Severe Impact Resilience: Considerations and Recommendations (May 2012), available at http://www.nerc.com/​comm/​OC/​SIRTF%20Related%20Files%20DL/​SIRTF_​Final_​May_​9_​2012-Board_​Accepted.pdf. The NOPR stated that the proposed informational filing could draw on the report but should also reflect subsequent work and development on this topic, particularly including supply chain, transporting and other logistical issues for equipment such as large transformers. NOPR, 148 FERC ¶ 61,040 at P 57.

61.  NERC Comments at 28.

62.  See SDG&E Comments at 5; MISO Comments at 6-7; Idaho Power Comments at 4; see also Paschall Comments at 2.

63.  See Associations Comments at 17; KCP&L Comments at 6-7; SCE Comments at 4; Trade Associations Comments at 13-14; GridWise Comments at 3.

64.  March 7 Order, 146 FERC ¶ 61,166 at P 11.

65.  NERC Petition at 36.

66.  Id. at 50.

67.  See also Paschall Comments at 2; Foundation Comments at 7.

68.  ITC Comments at 10.

69.  NIPSCO Comments at 2.

70.  Idaho Power Comments at 3-4.

71.  We also note that in Order No. 706, the Commission directed NERC to develop an external review procedure for the identification of critical assets by responsible entities. See Mandatory Reliability Standards for Critical Infrastructure Protection, Order No. 706, 122 FERC ¶ 61,040, at PP 322-329, order on reh'g, Order No. 706-A, 123 FERC ¶ 61,174 (2008), order on clarification, Order No. 706-B, 126 FERC ¶ 61,229 (2009), order on clarification, Order No. 706-C, 127 FERC ¶ 61,273 (2009).

72.  NOPR, 148 FERC ¶ 61,040 at P 23.

73.  For similar reasons, we reject Entergy's suggestion that Reliability Standard CIP-014-1 include language providing for flexibility concerning delays in compliance with deadlines contained in the Reliability Standard due to acts of nature. See Entergy Comments at 1.

74.  NERC Petition at 34-35.

75.  ITC Comments at 9 (“ITC further doesn't disagree that, in extremely dire circumstances, a risk assessment which has been verified by a third-party may nonetheless be so deficient (and the third-party review be similarly inadequate) that it could be considered non-compliant.”); see also NERC Petition at 37 (“If, in the course of assessing an entity's compliance with the proposed Reliability Standard, NERC, a Regional Entity, or FERC finds that the entity's transmission analysis was patently deficient and that the Requirement R2 verification process did not cure those deficiencies, they could use their enforcement authority to compel Transmission Owners to re-perform the risk assessment using assumptions designed to identify the appropriate critical facilities.”).

76.  See Order No. 706, 122 FERC ¶ 61,040 at P 320 (denying “safe harbor” for good faith compliance with CIP Reliability Standards).

77.  March 7 Order, 146 FERC ¶ 61,166 at P 6, n.4.

78.  Id. P 6.

79.  NERC Petition, Exhibit A (Proposed Reliability Standard) at 23. The standard drafting team provided the following example: “a Transmission station or Transmission substation identified as a Transmission Owner facility that interconnects generation will be subject to the Requirement R1 risk assessment if it operates at 500 kV or greater or if it is connected at 200 kV-499 kV to three or more other Transmission stations or Transmission substations and has an `aggregate weighted value' exceeding 3000 according to the table in Applicability Section 4.1.1.2.” Id. at 23.

80.  NERC Petition at 22.

81.  Id.

82.  NOPR, 148 FERC ¶ 61,040 at P 44 (quoting March 7 Order, 146 FERC ¶ 61,166 at P 12).

83.  NOPR, 148 FERC ¶ 61,040 at P 45 (quoting NERC Petition at 22).

84.  Associations Comments at 16-17; Trade Associations Comments at 12-13; Reclamation Comments at 1; G&T Cooperatives Comments at 13-14; KCP&L Comments at 5; Idaho Power Comments at 3; APS Comments at 4-5.

85.  March 7 Order, 146 FERC ¶ 61,166 at P 10.

86.  18 CFR 39.7(b)(4).

87.  North American Electric Reliability Corp., 135 FERC ¶ 61,166 (2011).

88.  NERC Petition, Exhibit B (Implementation Plan) at 1. Exhibit B also delineates the completion timelines for Requirements R2 through R6. Parts 2.1, 2.2, and 2.4 of Requirement R2 shall be completed within 90 calendar days of the effective date of the Reliability Standard. Part 2.3 of Requirement R2 shall be completed within 60 calendar days of the completion of performance under Requirement R2 part 2.2. Requirement R3 shall be completed within 7 calendar days of completion of performance under Requirement R2. Requirements R4 and R5 shall be completed within 120 calendar days of completion of performance under Requirement R2. Parts 6.1, 6.2, and 6.4 of Requirement R6 shall be completed within 90 calendar days of completion of performance under Requirement R5. Part 6.3 of Requirement R6 shall be completed within 60 calendar days of Requirement R6 part 6.2.

89.  Id.

90.  KCP&L Comments at 7.

91.  44 U.S.C. 3501-3520.

92.  See5 CFR 1320.10.

93.  Associations Comments at 19.

94.  Id. at 19 n.19.

95.  As defined in the PRA, “the term “burden” means time, effort, or financial resources expended by persons to generate, maintain, or provide information to or for a Federal agency, including the resources expended for—(A) reviewing instructions; (B) acquiring, installing, and utilizing technology and systems; (C) adjusting the existing ways to comply with any previously applicable instructions and requirements; (D) searching data sources; (E) completing and reviewing the collection of information; and (F) transmitting, or otherwise disclosing the information.”

96.  Version 5 Critical Infrastructure Protection Reliability Standards, Order No. 791, 78 FR 72,755 (Dec. 3, 2013), 145 FERC ¶ 61,160, at P 235 (2013), order granting clarification in part and denying rehearing, Order No. 791-A, 146 FERC ¶ 61,188 (2014).

97.  The requirement for NERC to make the informational filing is part of the responsibilities related to being the nation-wide Electric Reliability Organization. The burden related to that filing is part of FERC-725 (OMB Control Number 1902-0225).

98.  The estimates for cost per response are derived using the following formula: Average Burden Hours per Response * XX per Hour = Average Cost per Response.

The hourly cost figures are based on data for wages plus benefits from the Bureau of Labor Statistics (as of September 4, 2014) at http://www.bls.gov/​oes/​current/​naics3_​221000.htm and http://www.bls.gov/​news.release/​ecec.nr0.htm. The figures are rounded for the purposes of calculations in this table and are:

• For electrical engineers: $60.87/hr., rounded to $61/hr.
• for attorneys: $128/hr.
• for administrative staff: $31.86/hr., rounded to $32/hr.

99.  While it is likely that only large transmission owners and transmission operators will have critical facilities under Requirement R1, the Commission's estimate includes all transmission owners and operators because reliable data on what percentage of large owners and operators control critical facilities is unavailable.

100.  Order No. 486, Regulations Implementing the National Environmental Policy Act of 1969,52 FR 47897 (Dec. 17, 1987), FERC Stats. & Regs. Regulations Preambles 1986-1990 ¶ 30,783 (1987).

101.  18 CFR 380.4(a)(2)(ii).

102.  5 U.S.C. 601-612.

103.  SBA Final Rule on “Small Business Size Standards: Utilities,” 78 FR 77,343 (Dec. 23, 2013).

104.  13 CFR 121.201, Sector 22, Utilities.

105.  NOPR, 148 FERC ¶ 61,040 at P 70. Data and further information are available on the SBA Web site. See SBA Firm Size Data, available at http://www.sba.gov/​advocacy/​849/​12162. Since issuance of the NOPR, the Commission has obtained data that enables us to estimate more closely the number of small entities affected by this final rule. We now estimate that 28 percent (or 103 out of the 359 entities) are small entities.

106.  To the extent that Associations' comments, which we addressed above in the Information Collection Statement section, were also directed to the Commission's proposed certification regarding the Regulatory Flexibility Act, Associations' comments do not dispute any of the assumptions underlying the proposed certification or contest the proposed certification itself.

107.  5 U.S.C. 804(2).