2022-13464. Before Commissioners: Richard Glick, Chairman; James P. Danly, Allison Clements, Mark C. Christie, and Willie L. Phillips; North American Electric Reliability Corporation; Order Approving Modifications to the Compliance Section of ...

1. On February 16, 2022, the North American Electric Reliability Corporation (NERC), the Commission-certified Electric Reliability Organization (ERO), submitted a petition seeking approval of Reliability Standard CIP-014-3, which would modify the compliance section of Reliability Standard CIP-014-2 (Physical Security). The proposed modification would eliminate a provision requiring that all evidence demonstrating compliance with this Reliability Standard should be retained at the transmission owner's or transmission operator's facility. As discussed in this order, we approve NERC's petition.

I. Background

A. Section 215 and Mandatory Reliability Standards

2. Section 215 of the Federal Power Act (FPA) requires a Commission-certified ERO to develop mandatory and enforceable Reliability Standards, subject to Commission review and approval. The ERO is obligated to file each Reliability Standard or modification to a Reliability Standard that it proposes to be made effective with the Commission.^[1] Reliability Standards may be enforced by the ERO, subject to Commission oversight, or by the Commission independently.^[2] Pursuant to section 215 of the FPA, the Commission established a process to select and certify an ERO,^[3] and subsequently certified NERC.^[4]

B. Currently Effective Reliability Standard CIP-014-2

3. Reliability Standard CIP-014-2, which applies to transmission owners and transmission operators, is designed to “identify and protect Transmission stations and Transmission substations, and their associated primary control centers, that if rendered inoperable or damaged as a result of a physical attack could result in widespread instability, uncontrolled separation, or Cascading within an Interconnection.” ^[5] Pursuant to the Reliability Standard, transmission owners must perform an initial and subsequent risk assessments to identify the transmission stations and substations that, if rendered inoperable or damaged could result in instability, uncontrolled separation, or cascading within an Interconnection, and is subject to a third party verification. Transmission owners that control identified facilities must conduct an evaluation of the potential threats and vulnerabilities of a physical attack to transmission stations and substation, as well as primary control centers, develop and implement a documented physical security plan and have a third-party review of the evaluation.

C. NERC Petition for Modifications to the Compliance Section of Reliability Standard CIP-014

4. NERC proposes to remove section C.1.1.4., Additional Compliance Information, from the compliance section of the currently effective Reliability Standard CIP-014-2 (Physical Security) that requires all evidence demonstrating compliance with this Reliability Standard to be retained at the transmission owner's or transmission operator's facility in order to protect the entity's confidential information.^[6] NERC states that the proposed change applies only to the compliance section of Reliability Standard CIP-014-2, and proposes no changes in the mandatory and enforceable Requirements of Reliability Standard CIP-014-2. According to NERC, the provision presents challenges to effective and efficient compliance monitoring and is not necessary to protect the confidentiality of Reliability Standard CIP-014-2 compliance evidence.^[7]

5. NERC states that the “Additional Compliance Information” provision in the compliance section of CIP-014 was added to address heightened concerns regarding the protection of CIP-014 evidence. However, NERC has determined that it should no longer treat CIP-014 evidence any differently than other sensitive evidence it collects during its Compliance Monitoring and Enforcement Program (CMEP) activities.^[8] With the advent of the ERO Secure Evidence Locker (SEL), NERC asserts that it has a secure means of collecting and analyzing CIP-014 evidence in the same manner as any other sensitive evidence collected as part of CMEP activities.¹⁴

6. NERC explains that if the change is approved, it will no longer treat Reliability Standard CIP-014 evidence any differently than other sensitive evidence it collects during its compliance activities.^[9] NERC plans to use its SEL to support data and information handling, and it explains that it has developed the SEL for temporary storage of all registered entity compliance evidence.^[10] According to NERC, the SEL enables a registered entity to securely submit evidence through an encrypted session; the evidence is encrypted immediately upon submission, securely isolated per registered entity, never extracted, never backed up, and subject to proactive and disciplined destruction policies. NERC submits that the SEL provides security advantages to ensure proper protection and chain-of-custody management of the submitted evidence for CIP-014 compliance.

7. NERC requests that the modification to the Reliability Standard become effective on the date of Commission approval.

II. Notice of Filing and Responsive Pleadings

8. Notice of NERC's February 16, 2022 Petition was published in the Federal Register , 87 FR 11061 (Feb. 28, 2022), with interventions and protests due on or before March 15, 2022. The Edison Electric Institute (EEI) filed a timely motion to intervene and comments. On March 21, 2022, NERC submitted a request to submit reply comments and reply comments (NERC Answer). On March 30, 2022, EEI filed a motion for leave to answer and answer (EEI Answer).

9. EEI opposes NERC's petition and maintains that Reliability Standard CIP-014 requires data collection for industry's most sensitive assets and, therefore, the compliance provision should be retained so that NERC continues to review compliance evidence for this Reliability Standard only on-site at the registered entities for the most sensitive data.^[11] EEI explains that the information retained under this compliance requirement is of a critical and highly sensitive nature, and some information provided for Reliability Standard CIP-014 compliance is only available to a small set of personnel on a need-to-know basis within EEI member companies.^[12] According to EEI, its members go to great lengths to protect the identity of the assets and other sensitive information by using alternative anonymous names both in internal and external discussions. Further, EEI expresses security concerns related to the use of SEL, arguing that the SEL increases the risk of aggregated industry information falling into the hands of a nation state or bad actor.^[13] EEI argues that ease of access cannot take precedence over the safety, security, and reliability of the electric grid.

10. NERC asserts in its answer that the proposed modification would not decrease the protection of any highly sensitive compliance evidence, but it is needed to ensure compliance monitoring with Reliability Standard CIP-014.^[14] Among other arguments, NERC explains that there will be limited CIP-014 evidence aggregated in the SEL at any given time.^[15] Further, NERC elaborates that a registered entity may choose to develop its own SEL rather than use NERC's SEL, or use NERC's exceptions process, which allows registered entities to collaborate with the compliance authority on alternative submittal methods.

11. Finally, NERC states that over the last two years, due to pandemic restrictions, in some instances registered entities refused on-site access for compliance monitoring.^[16] In addition, certain entities also refused to allow a review of evidence using a secure videoconferencing platform. NERC believes that “[t]he end result was increased risk, in certain instances, because [NERC and the Regional Entities] had no mechanism with which to monitor compliance with CIP-014 until the entity, at its own discretion, lifted its pandemic-related restriction.” ^[17]

12. In its answer, EEI argues that more flexibility should be given to registered entities to select the most secure methods for providing CIP-014 compliance data. In particular, EEI states that, if agreed to by a registered entity's Compliance Enforcement Authority, “secure videoconferencing is an attractive and equally effective and efficient alternative to using the ERO SEL and one that EEI members would welcome.” ^[18] EEI notes, however, that certain entities may prefer to use their own videoconferencing tools, as opposed to an ERO-based tool, “because in doing so they have an understanding of, and confidence in, the security measures that have been implemented.” ^[19] Further, because many registered entities' corporate security access management programs require training, background checks, and monitoring of third-party access, EEI believes that some registered entities may be unable to use their own SEL to submit compliance information if NERC or Regional Entity compliance personnel are unable or unwilling to meet their SEL security access requirements.^[20] EEI also expresses concern with the length of time NERC will keep compliance information in the SEL, as entities have no way of verifying whether it has been deleted.

III. Determination

A. Procedural Matters

13. Pursuant to Rule 214 of the Commission's Rules of Practice and Procedure, 18 CFR 385.214 (2021), EEI's timely, unopposed motion to intervene serve to make it a party to this proceeding.

14. Rule 213(a)(2) of the Commission's Rules of Practice and Procedure, 18 CFR 385.213(a)(2) (2021), prohibits an answer to a protest or answer unless otherwise ordered by the decisional authority. We accept NERC's and EEI's answers because they have provided information that assisted us in our decision-making process.

B. Substantive Matters

15. As discussed below, we find that the proposed removal of the evidence retention provision in section C.1.1.4 of the compliance section of Reliability Standard CIP-014-2 is just, reasonable, not unduly discriminatory or preferential, and in the public interest. The modification will allow NERC to monitor compliance more effectively without compromising the confidentiality of sensitive information. Accordingly, we approve NERC's petition.

16. Reliability Standard CIP-014-2, compliance section C.1.1.4., Additional Compliance Information, currently requires compliance personnel and auditors (and enforcement staff if a potential noncompliance is identified) to be physically present at an entity's facility to review evidence of compliance. As NERC's petition explains, this requirement presented challenges during the pandemic, when auditors could not access certain entities' facilities in person and in some instances were prevented from reviewing the evidence remotely.^[21]

17. We recognize that Reliability Standard CIP-014-2 requires data collection for industry's sensitive assets and that therefore the data should be handled in a secure manner. However, while section C.1.1.4 may have provided necessary protection in the past, we are persuaded by NERC's explanation that its SEL now offers a secure and more flexible alternative for compliance evidence collection and review for Reliability Standard CIP-014-2.

18. Moreover, we are not persuaded by EEI's comments seeking to retain the on-site viewing requirement. First, contrary to EEI's suggestion in its comments, the use of the SEL is not novel and untested. In NERC's petition requesting funding for the SEL, which was filed in June 2020, NERC explained that the use of an evidence locker was a practice already in place for at least two Regional Entities to collect evidence associated with Critical Infrastructure Protection (CIP) Reliability Standards.^[22] Before deciding to implement the SEL, NERC consulted with industry and discussed security concerns related to evidence collection.^[23] Also, NERC has been using the SEL to access compliance evidence for the other CIP Reliability Standards, which indicates that it is a well-established and secure method of evidence review. Restricting auditor review to on-site only when there is a secure alternative impairs the auditor's ability to perform in-depth review of the evidence and could result in increased risk due to lack of adequate or timely compliance monitoring.

19. Further, we are not persuaded by EEI's argument that the SEL increases the risk of aggregated industry information falling into the hands of a nation-state or bad actor. Once evidence is submitted through an SEL encrypted session, it is immediately encrypted and cannot be extracted, is not backed up, and is subject to proactive and disciplined destruction policies, as well as being separated by registered entity.^[24] NERC explained that it will remove the information from the SEL when the CMEP engagement concludes.^[25]

20. Finally, as stated by NERC, entities can structure their own SELs that adhere to their security measure requirements. EEI argues that some registered entities may be unable to use their own SELs to submit compliance information if NERC or Regional Entity compliance personnel are unable or unwilling to meet the SEL security access requirements.^[26] However, EEI provides no specific evidence of such situations for other CIP compliance monitoring engagements or whether they have led to increased risk of evidence being compromised. We find unpersuasive EEI's objections to NERC's offering of a flexible approach to accommodate entities.

21. Therefore, we find that the removal of the evidence retention provision in section C.1.1.4 of the compliance section of Reliability Standard CIP-014-2 will allow NERC to monitor compliance more effectively without compromising the confidentiality of sensitive information. Accordingly, we approve NERC's petition and accept the proposed Reliability Standard CIP-014-3, to become effective on the date of issuance of this order.

IV. Information Collection Statement

22. In compliance with the requirements of the Paperwork Reduction Act of 1995, 44 U.S.C. 3506(c)(2)(A), the Commission is soliciting public comment on revisions to the information collection FERC-725U, Mandatory Reliability Standards for the Bulk Power System; CIP Reliability Standards; which will be submitted to the Office of Management and Budget (OMB) for a review of the information collection requirements. Comments on the collection of information are due within 60 days of the date this order is published in the Federal Register . Respondents subject to the filing requirements of this order will not be penalized for failing to respond to these collections of information unless the collections of information display a valid OMB control number.

23. The information collection requirements are subject to review by the OMB under section 3507(d) of the Paperwork Reduction Act of 1995.^[27] OMB's regulations require approval of certain information collection requirements imposed by agency rules.^[28] The Commission solicits comments on the Commission's need for this information, whether the information will have practical utility, the accuracy of the burden estimates, ways to enhance the quality, utility, and clarity of the information to be collected or retained, and any suggested methods for minimizing respondents' burden, including the use of automated information techniques.

24. The number of respondents below is based on an estimate of the NERC compliance registry for transmission owners and transmission operator. The Commission based its paperwork burden estimates on the NERC compliance registry as of May 6, 2022. According to the registry, there are 326 transmission owners and 18 transmission operators not also registered as transmission owners. The estimate is based on a zero change in burden from the current standard to the standard approved in this Order. The Commission based the burden estimate on staff experience, knowledge, and expertise.

25. For the new Reliability Standard CIP-014-3, the burden for entities remains the same as they will still need to provide the same evidence to demonstrate compliance whether it is kept on-site or loaded electronically into the SEL. No comments were received that expressed a change in the manhour burden associated with the use of SEL.

26. Burden Estimates: The Commission estimates the changes in the annual public reporting burden and cost ^[29] as indicated below:

FERC-725U—(Mandatory Reliability Standards: Reliability Standard CIP-014) Change in Burden

	Number of respondents 30	Number of responses per respondent	Total number of responses	Average burden hours & cost per response	Total burden hours & total cost	Average cost per respondent
	(1)	(2)	(1) * (2) = (3)	(4)	(3) * (4) = (5)	(5) ÷ (1)
Change Annual Reporting and Recordkeeping	344	1	344	32.71 hrs.; $2,845.77	11,252.24 hrs.; $978,944.88	$2,845.77
Total FERC-725U	344	1	344	32.71 hrs.; $2,845.77	11,254.24 hrs.; $978,944.88	2,845.77

Titles: FERC-725U, Mandatory Reliability Standards for the Bulk Power System; CIP Reliability Standards.

Action: Compliance update with no changes to Existing Collections of Information, FERC-725U.

OMB Control Nos.: 1902-0274(FERC-725U).

Respondents: Business or other for profit, and not for profit institutions.

Frequency of Responses: On occasion.

Necessity of the Information: Reliability Standard CIP-014-3 (Physical Security) is part of the implementation of the Congressional mandate of the Energy Policy Act of 2005 to develop mandatory and enforceable Reliability Standards to better ensure the reliability of the nation's Bulk Power system. Specifically, the revised standard only changes the how the evidence is stored.

Internal Review: The Commission has reviewed NERC's proposal and determined that its action is necessary to implement section 215 of the FPA.

27. Interested persons may obtain information on the reporting requirements by contacting the Federal Energy Regulatory Commission, Office of the Executive Director, 888 First Street NE, Washington, DC 20426 [Attention: Ellen Brown, email: [e-mail], phone: [phone]].

28. All submissions must be formatted and filed in accordance with submission guidelines at: http://www.ferc.gov. For user assistance, contact FERC Online Support by email at [e-mail], or by phone at [phone] (toll-free).

29. Comments concerning the information collections and requirements approved and associated burden estimates, should be sent to the Commission in this docket and may also be sent to the Office of Management and Budget, Office of Information and Regulatory Affairs [Attention: Desk Officer for the Federal Energy Regulatory Commission]. OMB submissions must be formatted and filed in accordance with submission guidelines at www.reginfo.gov/​public/​do/​PRAMain. Using the search function under the “Currently Under Review” field, select Federal Energy Regulatory Commission; click “submit,” and select “comment” to the right of the subject collection.

30. Please refer to the appropriate OMB Control Number(s) 1902-0274(FERC-725U) in your submission.

V. Document Availability

31. In addition to publishing the full text of this document in the Federal Register , the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the internet through the Commission's Home Page ( http://www.ferc.gov ) and in the Commission's Public Reference Room during normal business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street NE, Room 2A, Washington, DC 20426.

32. From the Commission's Home Page on the internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number excluding the last three digits of this document in the docket number field.

33. User assistance is available for eLibrary and the Commission's website during normal business hours from the Commission's Online Support at [phone] (toll free at 1-866-208-3676) or email at [e-mail], or the Public Reference Room at [phone], TTY [phone]. Email the Public Reference Room at [e-mail].

The Commission orders:

Reliability Standard CIP-014-3 is hereby approved, as discussed in the body of this order.

Issued: June 16, 2022.

Debbie-Anne A. Reese,

Deputy Secretary.

Footnotes

1.  16 U.S.C. 824o(d)(1).

2.   Id. 824o(e).

3.   Rules Concerning Certification of the Elec. Reliability Org.; & Procedures for the Establishment, Approval, & Enforcement of Elec. Reliability Standards, Order No. 672, 114 FERC ¶ 61,104, order on reh'g, Order No. 672-A, 71 FR 19814 (April 18, 2006),114 FERC ¶ 61,328 (2006).

4.   N. Am. Elec. Reliability Corp., 116 FERC ¶ 61,062, order on reh'g and compliance, 117 FERC ¶ 61,126 (2006), aff'd sub nom. Alcoa, Inc. v. FERC, 564 F.3d 1342 (D.C. Cir. 2009).

5.  NERC Reliability Standard CIP-014-2 (Physical Security), Purpose.

6.  NERC Petition at 1. Section C.1.1.4., Additional Compliance Information states:

Confidentiality: To protect the confidentiality and sensitive nature of the evidence for demonstrating compliance with this standard, all evidence will be retained at the Transmission Owner's and Transmission Operator's facilities.

7.  NERC Petition at 1.

8.   Id. at 5-6.

9.   Id.

10.   Id. at 6.

11.  EEI Comments at 1.

12.   Id. at 5.

13.   Id.

14.  NERC Answer at 1.

15.   Id. at 2-3.

16.   Id. at 3-4.

17.   Id. at 4.

18.  EEI Answer at 2.

19.   Id.

20.   Id. at 2-3.

21.  NERC Petition at 7; NERC Answer at 3.

22.  NERC, Request of the North American Electric Reliability Corporation to expend funds to develop the ERO Enterprise Secure Evidence Locker, Docket No. RR19-8-001, at 4 (filed June 8, 2020) (NERC 2020 Filing); N. Am. Elec. Reliability Corp., Docket No. RR19-8-001 (June 22, 2020) (delegated order).

23.  NERC 2020 Filing at 5.

24.  NERC Answer at 2.

25.   Id. at 2-3.

26.   Id.

27.  44 U.S.C. 3507(d).

28.  5 CFR 1320 (2021).

29.  FERC staff estimates that industry costs for salary plus benefits are similar to Commission costs. The FERC 2021 average salary plus benefits for one FERC full-time equivalent (FTE) is $180,703/year (or $87.00/hour) posted by the Bureau of Labor Statistics for the Utilities sector (available at https://www.bls.gov/​oes/​current/​naics3_​221000.htm ).

30.  The total number (344) of transmission owners (326) plus transmission operators (18) not also registered as owners, this represents the unique US entities (taken from data as of May 6, 2022).