2021-16915. Standards for Business Practices of Interstate Natural Gas Pipelines

AGENCY:

Federal Energy Regulatory Commission, Department of Energy.

ACTION:

Final rule.

SUMMARY:

The Federal Energy Regulatory Commission is amending its regulations to incorporate by reference, with certain enumerated exceptions, the latest version (Version 3.2) of business practice standards adopted by the Wholesale Gas Quadrant of the North American Energy Standards Board (NAESB) applicable to natural gas pipelines in place of the currently incorporated version (Version 3.1) of those business practice standards. The revisions made by NAESB in this version of the standards are designed to enhance the natural gas industries' system and software security measures and to clarify the processing of certain business transactions.

DATES:

 

Effective date: This rule is effective October 12, 2021.

Compliance date: Compliance filings required by this rule are due on November 12, 2021 and compliance with the standards incorporated in this rule is required on and after June 1, 2022.

Incorporation by reference: The incorporation by reference of certain publications listed in this rule is approved by the Director of the Federal Register as of October 12, 2021.

FOR FURTHER INFORMATION CONTACT:

Stanley Wolf (technical issues), Office of Energy Policy and Innovation, Federal Energy Regulatory Commission, 888 First Street NE, Washington, DC 20426, [phone], [e-mail].

Oscar F. Santillana (technical issues), Office of Energy Market Regulation, Federal Energy Regulatory Commission, 888 First Street NE, Washington, DC 20426, [phone], [e-mail].

Robert McLean (legal issues), Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street NE, Washington, DC 20426, [phone], [e-mail].

SUPPLEMENTARY INFORMATION:

Order No. 587-Z

Final Rule

(Issued July 13, 2021)

Table of Contents

	Paragraph Nos.
I. Background	5
II. Discussion	12
A. The NAESB WGQ Version 3.2 Business Practice Standards	12
1. Modifications to Previous Version of Standards	12
B. NAESB's Process	22
C. Adoption of Version 3.2 of the Standards	23
D. Required Compliance Filings	25
E. Implementation Schedule	26
III. Notice of Use of Voluntary Consensus Standards	28
IV. Incorporation by Reference	29
V. Information Collection Statement	39
VI. Environmental Analysis	46
VII. Regulatory Flexibility Act	47
VIII. Document Availability	50
IX. Effective Date and Congressional Notification	53

1. In this Final Rule, the Federal Energy Regulatory Commission (Commission) amends its regulations at 18 CFR 284.12 to incorporate by reference, with certain enumerated exceptions,^[1] the latest version (Version 3.2) of business practice standards adopted by NAESB's WGQ applicable to natural gas pipelines that NAESB reported to the Commission on August 17, 2020 in place of the currently incorporated version (Version 3.1) of those business practice standards. This Final Rule requires interstate natural gas pipelines to file compliance filings with the Commission by November 12, 2021 and to comply with the standards incorporated by reference in this rule on and after June 1, 2022.

2. The implementation of these standards and regulations will promote the additional efficiency and reliability of the natural gas industries' operations thereby helping the Commission to carry out its responsibilities under the Natural Gas Act (NGA). Further, the implementation of these standards will enhance the natural gas industries' computer security requirements.^[2] In addition, the implementation of these data requirements will provide additional transparency to Informational Postings websites and will improve communication standards.

3. The NAESB WGQ Version 3.2 package of standards contains revisions to the NAESB WGQ Version 3.1 package of standards. As explained further below, in response to the recommendations in the Sandia National Laboratory (Sandia) ^[3] report, NAESB updated the Quadrant Electronic Delivery Mechanism (EDM) Related Standards and internet Electronic Transport (IET) Related Standards to specifically: (1) Require the implementation of fixes or patches for known vulnerabilities as soon as reasonably practicable in coordination with other trading partners; (2) specify notification timelines to provide notice to trading partners of any systems or software that have not been updated and the potential impact of using the vulnerable system; (3) include both specific and broad adoptions of system security measures and specific notification and coordination during outages with affected trading partners; (4) maintain a minimum encryption strength of 128 bits, (5) specify that OpenPGP ^[4] should be used to create public and private keys for privacy and digital signature applications; (6) specify Hyper-Text Transport Protocol Secure (HTTPS) ^[5] whenever secure communication is required to protect information in transit and support overall privacy needs; (7) use the largest feasible key length consistent with implementation of current business processes; (8) state that secure websites should employ individual user credentials; and (9) encourage security assessments and coordination between customers, vendors, and trading partners.

4. Further, in response to industry requests or through the normal course of WGQ activities, NAESB: (1) Updated the Nominations Related Standards to allow a Service Requester to determine which rights of the contract its segmentation nomination is using; (2) updated the Quadrant EDM Related Standards to (i) define a NAESB standard time frame for information to be retained on a pipeline's Informational Postings website, (ii) allow for processing functions at the line item level on Customer Activities websites and allow for the use of icons and/or graphical control elements for navigation and/or processing functions, and (iii) make minor revisions designed to add clarity, update the minimum technical characteristics to account for changes in technology since the previous version (Version 3.1) of the WGQ standards, and update the minimum and suggested operating systems and web browsers that entities should support; (3) updated multiple sets of standards to remove references to the term “gigacalories” and add the term “gigajoules” as the standard quantity for nominations, confirmations, and scheduling in Mexico; and (4) revised the NAESB WGQ data sets or other technical implementation documentation while not resulting in modifications to the underlying business practice standards.

I. Background

5. Since 1996, the Commission has adopted regulations to standardize the business practices and communication methodologies of interstate natural gas pipelines to create a more integrated and efficient pipeline system. These regulations have been promulgated in the Order No. 587 series of orders,^[6] wherein the Commission has incorporated by reference standards for interstate natural gas pipeline business practices and electronic communications that were developed and adopted by NAESB's WGQ. Upon incorporation by reference, this version of the standards will replace the currently incorporated version (Version 3.1) of those business practice standards.

6. On August 17, 2020, NAESB filed a report informing the Commission that it had adopted and ratified WGQ Version 3.2 of its business practice standards applicable to interstate natural gas pipelines. Version 3.2 of the WGQ includes business practice standards developed and modified in response to industry requests and directives from the NAESB Board of Directors. This version also includes the standards developed in response to the recommendations of Sandia, which in 2019 issued a cybersecurity surety assessment of the NAESB standards sponsored by DOE (Sandia Surety Assessment),^[7] and the standards developed to enable the use of distributed ledger technologies when transacting the NAESB Base Contract for Sale and Purchase of Natural Gas.

7. The NAESB report identifies all the changes made to the WGQ Version 3.1 Standards and summarizes the deliberations that led to the changes being made. It also identifies changes to the existing standards that were considered but not adopted due to a lack of consensus or other reasons.

8. On February 18, 2021, the Commission issued a Notice of Proposed Rulemaking proposing to amend its regulations to incorporate by reference, with certain enumerated exceptions, the NAESB WGQ Version 3.2 business practice standards (referenced above) applicable to natural gas pipelines.^[8]

9. In response to the Version 3.2 NOPR, NAESB and the Interstate Natural Gas Association of America (INGAA) filed comments. NAESB clarifies that Standards 4.3.60 and 10.3.16 do not require multi-factor (e.g., two-factor) authentication on an individual basis. NAESB clarifies that Standard 4.3.60 states that a Customer Activities website should be protected by [Hyper-Text Transport Protocol] (HTTP) ^[9] Basic Authentication using transport layer security and require a single logon/password pair for each user session. NAESB further clarifies that Standard 10.3.16 states that trading partners should implement HTTP Basic Authentication using transport layer security.^[10] INGAA supports NAESB's clarifying comments.^[11]

10. INGAA expresses support for the Commission's proposal to incorporate by reference NAESB's WGQ Version 3.2 business practice standards. INGAA also supports the Commission's proposal in the Version 3.2 NOPR, but urges the Commission to ensure that implementation of a Final Rule in this proceeding occurs for the first gas day of the month, but not prior to April 1, 2022, after the winter heating season. INGAA states that implementation of a Final Rule in this proceeding will require substantial time and effort from both pipelines and their customers to alter business systems, scheduling, and coordination processes and, thus, it would be best to schedule implementation to not occur during the winter heating season.^[12]

11. Further, INGAA states that requiring implementation to occur for the first gas day of the month is important for both pipelines and shippers. INGAA explains that while pipelines update their software to accommodate the new NAESB version ahead of the implementation date, both pipelines and shippers need to ensure that contract, nomination, allocation, invoice, and other changes will be fully in place and working properly with the start of the gas month. INGAA states that this is consistent with the industry's monthly billing cycle and shall avoid the complications of a mid-month transition.^[13]

II. Discussion

A. The NAESB WGQ Version 3.2 Business Practice Standards

1. Modifications to Previous Version of Standards

a. Modifications in Response to the Sandia Surety Assessment

12. NAESB revised previously incorporated standards and developed new standards in response to the recommendations in the Sandia Surety Assessment. Specifically, NAESB adopted revisions to the WGQ EDM Related Business Practice Standards, which establish the framework for the electronic dissemination and communication of information between parties in the North American wholesale gas marketplace, and to the WGQ IET Related Business Practice Standards, which define the implementation of various technologies necessary to communicate transactions and other electronic data using standard protocols for electronic commerce over the internet between trading partners. First, NAESB adopted two new standards, 4.3.109 and 10.3.28, to provide that trading partners should evaluate software fixes or patches for known vulnerabilities within 30 days and implement the fix or patch as soon as reasonably practicable based on the severity of the risk. Second, NAESB adopted two new standards, 4.3.110 and 10.3.29, to provide that trading partners should mutually agree to the version of the EDM and IET to be used. Third, the new standards specify notification and coordination timelines with trading partners, where applicable, to address vulnerable systems or software as soon as possible. Fourth, the Sandia Surety Assessment recommended that NAESB consider guidelines for configuration and logging, network traffic monitoring, alerting systems, and manual continuity of operations in the event of abnormal behavior or failure conditions within the system. In response, NAESB added language to new Standards 4.3.110 and 10.3.28 to include both specific and broad adoptions of such system security measures.

13. Further, NAESB added language to existing Standards 4.3.60, 4.3.61, 10.2.33, and 10.3.25 to clarify the Transport Layer Security protocol,¹⁴ which encrypts data to hide information from electronic observers on the internet. NAESB also deleted all references to the Secure Sockets Layer protocol in the standards.

14. Concerning identification key lengths, the Sandia Surety Assessment recommended that Rivest-Shamir-Adelman keys ^[15] must be no shorter than 2048 bits, Elliptic Curve Digital Signature Algorithm keys ^[16] must be no shorter than 224 bits, Hash ^[17] algorithms should be from the Secure Hash Algorithm (SHA)-2 ^[18] or SHA-3 families, and acceptable Advanced Encryption Standard key lengths range from 128, to 192, to 256. The Sandia Surety Assessment recommended that, in general, implementors use the largest feasible key length consistent with implementation of current business processes. In response, NAESB deleted Standard 4.3.83 to remove legacy support references and maintain a minimum encryption strength of 128 bits. Further, NAESB revised existing Standards 10.2.34 and 10.3.15 to delete a proprietary Pretty Good Privacy (PGP) ^[19] -related hyperlink and to accommodate license-free OpenPGP, respectively. NAESB also adopted a new Standard 10.2.39 to specify that OpenPGP should be used to create public and private keys for privacy and digital signature applications.

15. Further, NAESB revised existing Standards 4.3.60, 4.3.84, 10.3.4, and 10.3.16 to specify HTTPS, which is an encrypted version of HTTP, whenever a secure communication is required to protect information in transit and support overall privacy needs.

b. Modifications in Response to Industry Requests

16. The following section describes standards development efforts undertaken by NAESB in response to industry requests or through the normal course of WGQ activities that resulted in modifications to the Nomination Related Standards, Quadrant EDM Related Standards, and an effort that impacted multiple sets of standards. NAESB made corresponding revisions, where appropriate, to the related data sets and technical implementation as part of the standards development effort.

i. Nomination Related Standards

17. NAESB revised existing Standards 1.3.27, 1.4.1, and 1.4.2 to add a new data element “Capacity Block ID” to allow a Service Requester to determine which primary point rights of the contract their segmented nomination ^[20] is using and eliminate an existing manual business process from the TSP to automate the business process.

ii. Quadrant Electronic Delivery Mechanism Related Standards

18. NAESB developed two new standards, Standard 4.3.107 to establish a standard data retention period for retrieval of Operationally Available data from the Informational Postings website, and Standard 4.3.108, to establish a standard data retention period for retrieval of Notices for the subcategories of Critical, Non-Critical, and Planned Service Outage from the Informational Postings website.

iii. Revisions Impacting Multiple Standards

19. NAESB revised multiple standards ^[21] and data sets ^[22] to remove references to the term “gigacalories” and add the term “gigajoules,” as the standard quantity for nominations, confirmations, and scheduling in Mexico.

iv. Other Material in NAESB's Report

20. NAESB revised multiple data sets which impacted technical implementation documentation only.

21. Further, NAESB revised its optional model contracts and corresponding Mexican and Canadian Addendums to reflect a standard digital representation of natural gas trade events. NAESB states that these revisions are intended to capitalize on smart contracts and distributed ledger technologies.

B. NAESB's Process

22. NAESB used its consensus procedures to develop and approve the WGQ Version 3.2 Standards. As the Commission found in Order No. 587, the adoption of consensus standards is appropriate, because the consensus process helps ensure the reasonableness of the standards by requiring that the standards draw support from a broad spectrum of industry participants representing all segments of the industry. Moreover, since the industry itself must conduct business under these standards, the Commission's regulations should reflect those standards that have the widest possible support. In section 12(d) of the National Technology Transfer and Advancement Act of 1995 (NTT&AA),^[23] Congress affirmatively requires federal agencies to use technical standards developed by voluntary consensus standards organizations, like NAESB, as means to carry out policy objectives or activities determined by the agencies unless an agency determines that the use of such standards would be inconsistent with applicable law or otherwise impractical.

C. Adoption of Version 3.2 of the Standards

23. In the Version 3.2 NOPR, the Commission proposed to incorporate by reference, in its regulations, Version 3.2 of the NAESB WGQ consensus business practice standards, with the exception of NAESB's standards specifying the terms of optional model contracts and the eTariff-related standards.^[24] None of the commenters opposed the Commission's proposal to incorporate by reference the NAESB WGQ Version 3.2 business practice standards as proposed in the Version 3.2 NOPR.^[25]

24. After a review of the comments filed in response to the Version 3.2 NOPR, and because the revisions made by NAESB in this version of the standards are designed to enhance the natural gas industries' system and software security measures and to clarify the processing of certain business transactions, we amend Part 284 of the Commission's regulations to incorporate by reference the NAESB WGQ Version 3.2 business practice standards, with the exceptions (as explained in the Version 3.2 NOPR) of the optional model contracts and the eTariff-related standards.

D. Required Compliance Filings

25. As suggested by INGAA, we have selected an implementation schedule for compliance with this Final Rule that delays implementation until after the 2021-2022 winter heating period. To implement the standards that we are incorporating by reference in this Final Rule, we will require each interstate natural gas pipeline to file a separate tariff record reflecting the changed standards by November 12, 2021, to take effect on June 1, 2022 ^[26] We are adopting this implementation schedule to give the interstate natural gas pipelines subject to these standards adequate time to implement these changes.

E. Implementation Schedule

26. To implement these standards, we require interstate natural gas pipelines to file tariff records to reflect the changed standards by November 12, 2021. None of the comments took issue with the Commission's explanation of its policies on tariff filings and on waiver requests to comply with these standards.^[27] Therefore, we are not modifying these policies in this Final Rule and affirm the explanation of those policies the Commission made in the Version 3.2 NOPR.

27. In addition, consistent with the requirements in Order No. 587-W,^[28] we are including the following filing requirements for the November 12, 2021 compliance filing to increase the transparency of the pipelines' incorporation by reference of the NAESB WGQ Standards so that shippers and the Commission will know which tariff provision(s) implements each standard as well as the status of each standard.

(1) The pipelines must designate a single tariff record under which every NAESB standard currently incorporated by reference by the Commission is listed.^[29] This section should be a separate tariff record under the Commission's electronic tariff filing requirement and should be filed electronically using the eTariff portal using the Type of Filing Code 580. We will post on the Commission's eLibrary website (under Docket No. RM96-1-042) a sample tariff record, to provide filers an illustrative example to aid them in preparing their compliance filings; ^[30]

(2) For each standard, each pipeline must specify in the tariff record a list of all the NAESB standards currently incorporated by reference by the Commission:

(a) whether the standard is incorporated by reference;

(b) for those standards not incorporated by reference, the tariff provision that complies with the standard; ^[31] and

(c) a statement identifying any standards for which the pipeline has been granted a waiver, extension of time, or other variance with respect to compliance with the standard.^[32]

(3) If the pipeline is requesting a continuation of a previously granted waiver or extension of time to comply with certain NAESB WGQ standards, it must include a table in its transmittal letter that states the standard for which a waiver or extension of time was granted, and the docket number or order citation to the proceeding in which the waiver or extension of time was granted.

III. Notice of Use of Voluntary Consensus Standards

28. Office of Management and Budget (OMB) Circular A-119 (section 11) (Feb. 10, 1998) provides that when a federal agency issues or revises a regulation containing a standard, the agency should publish a statement in the Final Rule stating whether the adopted standard is a voluntary consensus standard or a government-unique standard. In this Final Rule, we are incorporating by reference voluntary consensus standards developed by NAESB's WGQ. In section 12(d) of NTT&AA, Congress affirmatively requires federal agencies to use technical standards developed by voluntary consensus standards organizations to carry out policy objectives or activities determined by the agencies unless use of such standards would be inconsistent with applicable law or otherwise impractical.^[33]

IV. Incorporation by Reference

29. The Office of the Federal Register requires agencies incorporating material by reference in final rules to discuss the ways that the materials it incorporates by reference are reasonably available to interested parties and how interested parties can obtain the materials.^[34] The regulations also require agencies to summarize, in the preamble of the final rule, the material it incorporates by reference. The standards that we are incorporating by reference in this Final Rule consist of seven suites of NAESB WGQ Business Practice Standards that address a variety of topics and are designed to streamline the transactional processes for the wholesale natural gas industry by promoting a more competitive and efficient market. These include the: Additional Business Practice Standards; Nominations Related Business Practice Standards; Flowing Gas Related Business Practice Standards; Invoicing Related Business Practice Standards; Quadrant Electronic Delivery Mechanism Related Business Practice Standards; Capacity Release Related Business Practice Standards; and internet Electronic Transport Related Business Practice Standards. We summarize these standards below.

30. The Additional Business Practice Standards address six areas: Creditworthiness; Storage Information; Gas/Electric Operational Communications; Operational Capacity; Unsubscribed Capacity; and Location Data Download.

• The Creditworthiness related standards describe requirements for the exchange of information, notification, and communication between parties during the creditworthiness evaluation process.
• The Storage Information related standards define the information to be provided to natural gas service requesters related to storage activities and/or balances.
• The Gas/Electric Operational Communications related standards define communication protocols intended to improve coordination between the gas and electric industries in daily operational communications between transportation service providers and gas-fired power plants. The standards include requirements for communicating anticipated power generation fuel for the upcoming day as well as any operating problems that might hinder gas-fired power plants from receiving contractual gas quantities.
• The Operational Capacity related standards define requirements of the transportation service provider related to the reporting and requesting of a transportation service provider's operational capacity, total scheduled quantity, and operationally available capacity.
• The Unsubscribed Capacity related standards define requirements of the transportation service provider related to the reporting and requesting of a transportation service provider's available unsubscribed capacity.
• The Location Data Download related standards define requirements for the use of codes assigned by the transportation service provider for locations and common codes for parties communicating electronically.

31. The Nominations Related Business Practice Standards define the process by which a natural gas service requester with a natural gas transportation contract nominates (or requests) service from a pipeline or a transportation service provider for the delivery of natural gas.

32. The Flowing Gas Related Business Practice Standards define the business processes related to the communication of entitlement rights of flowing gas at a location, of the entitlement rights on a contractual basis, of the management of imbalances, and of the measurement and gas quality information of the actual flow of gas.

33. The Invoicing Related Business Practice Standards define the process for the communication of charges for services rendered (Invoice), communication of details about funds rendered in payment for services rendered (Payment Remittance), and communication of the financial status of a customer's account (Statement of Account).

34. The Quadrant Electronic Delivery Mechanism Related Business Practice Standards define the framework for the electronic dissemination and communication of information between parties in the North American wholesale gas marketplace for Electronic Data Interchange/EDM transfers, batch flat file/EDM transfers, informational postings websites, Electronic Bulletin Boards/EDM, and interactive flat file/EDM.

35. The Capacity Release Related Business Practice Standards define the business processes for communication of information related to the selling of all or any portion of a transmission service requester's contract rights.

36. The internet Electronic Transport Related Business Practice Standards define the implementation of various technologies necessary to communicate transactions and other electronic data using standard protocols for electronic commerce over the internet between trading partners.

37. The Commission's regulations provide that copies of the standards incorporated by reference may be obtained from NAESB at https://www.naesb.org/​/ or [phone]. Once the Novel Coronavirus Disease (COVID-19) restrictions are lifted, copies of the standards may be inspected at the Federal Energy Regulatory Commission, Public Reference Room, 888 First Street NE, Washington, DC 20426, Phone: [phone], https://www.ferc.gov/​. At this time, the Commission has suspended access to the Commission's Public Reference Room due to the President's March 13, 2020 proclamation declaring a National Emergency concerning COVID-19.

38. NAESB is a private consensus standards developer that develops voluntary wholesale and retail standards related to the energy industry. The procedures used by NAESB make its standards reasonably available to those affected by Commission regulations, which generally is comprised of entities that have the means to acquire the information they need to effectively participate in Commission proceedings. Participants can join NAESB, for an annual membership cost of $8,000, which entitles them to full participation in NAESB and enables them to obtain these standards at no additional cost. Non-members may obtain the Individual Standards Manual or Booklets for each of the seven Manuals by email for $250 per manual, which in the case of these standards would total $1,750. Non-members also may obtain the complete set of Standards Manuals, Booklets, and Contracts on USB flash drive for $2,000. NAESB also provides a free electronic read-only version of the standards for a three-business day period or, in the case of a regulatory comment period, through the end of the comment period. In addition, NAESB considers requests for waivers of the charges on a case-by-case basis depending on need.

V. Information Collection Statement

39. OMB regulations require that OMB approve certain reporting, record keeping, and public disclosure requirements (information collection) imposed by an agency.^[35] Therefore, we are submitting this proposed information collection to OMB for review in accordance with section 3507(d) of the Paperwork Reduction Act of 1995. Upon approval of a collection of information, OMB will assign an OMB control number and an expiration date. Respondents subject to the filing requirements of a rule will not be penalized for failing to respond to these collections of information unless the collection of information displays a valid OMB control number.

40. The Commission solicited comments on the need for this information, whether the information will have practical utility, the accuracy of the provided burden estimates, ways to enhance the quality, utility, and clarity of the information to be collected, and any suggested methods for minimizing respondents' burden, including the use of automated information techniques. No comments were filed raising any objections to the burden estimate presented in the Version 3.2 NOPR. Accordingly, we will use that same burden estimate in this Final Rule.

41. Public Reporting Burden: The burden estimates for this Final Rule are for one-time implementation of the information collection requirements of this Final Rule (including tariff filing, documentation of the process and procedures, and information technology work).

42. The collections of information related to this Final Rule fall under FERC-545 (Gas Pipeline Rates: Rate Change (Non-Formal)) ^[36] and FERC-549C (Standards for Business Practices of Interstate Natural Gas Pipelines).^[37] The following estimates of reporting burden are related only to this Final Rule and include the costs to pipelines for compliance with the Commission's directives in this Final Rule. The burden estimates are primarily related to implementing these standards and regulations and will not result in ongoing costs.

RM96-1-042 Final Rule (Standards for Business Practices of Interstate Natural Gas Pipelines)

	Number of respondents 38	Annual number of responses per respondent	Total number of responses	Average burden hr. per response	Total annual burden hours & total annual cost 39	Annual costs per respondent
	(1)	(2)	(1)*(2) = (3)	(4)	(3)*(4) = (5)	(5)/(1) = (6)
FERC-545 (one-time)	178	1	178	10 hrs.; $1,010	1,780 hrs.; $179,780	$1,010
FERC-549C (one-time)	178	1	178	100 hrs.; $10,100	17,800 hrs.; $1,797,800	$10,100
Total			356		19,580 hrs.; $1,977,580

The one-time burden (for both the FERC-545 and FERC-549C) will take place in Year 1 and will be averaged over three years:

FERC-545: 1,780 hours ÷ 3 = 593 hours/year over three years

FERC-549C: 17,800 hours ÷ 3 = 5,933 hours/year over three years

The number of responses is also averaged over three years (for both the FERC-545 and FERC-549C):

FERC-545: 178 responses ÷ 3 = 59 responses/year

FERC-549C: 178 responses ÷ 3 = 59 responses/year

The responses and burden for Years 1-3 will total respectively as follows:

Year 1: 59 responses; 593 hours (FERC-545); 5,933 hours (FERC-549C)

Year 2: 59 responses; 593 hours (FERC-545); 5,933 hours (FERC-549C)

Year 3: 59 responses; 593 hours (FERC-545); 5,933 hours (FERC-549C)

Title: FERC-545, Gas Pipeline Rates: Rates Change (Non-Formal); FERC-549C, Standards for Business Practices of Interstate Natural Gas Pipelines.

Action: Proposed information collections.

OMB Control Nos.: 1902-0154 (FERC-545), 1902-0174 (FERC-549C).

Respondents: Business or other for profit (e.g., Natural Gas Pipelines, applicable to only a few small businesses).

Frequency of Responses: One-time implementation (related to business procedures, capital/start-up).

Necessity of Information: In response to the recommendations in the Sandia report, the revisions in this Final Rule to the Commission's regulations will upgrade current business practices and communication standards by updating the Quadrant EDM Related Standards and IET Related Standards to specifically: (1) Require the implementation of fixes or patches for known vulnerabilities as soon as reasonably practicable in coordination with other trading partners; (2) specify notification timelines to provide notice to trading partners of any systems or software that have not been updated and the potential impact of using the vulnerable system; (3) include both specific and broad adoptions of system security measures and specific notification and coordination during outages with affected trading partners; (4) maintain a minimum encryption strength of 128 bits; (5) specify that OpenPGP should be used to create public and private keys for privacy and digital signature applications; (6) specify HTTPS whenever secure communication is required to protect information in transit and support overall privacy needs; (7) use the largest feasible key length consistent with implementation of current business processes; (8) state that secure websites should employ individual user credentials; and (9) encourage security assessments and coordination between customers, vendors, and trading partners.

43. Further, in response to industry requests or through the normal course of WGQ activities, the revisions in this Final Rule to the Commission's regulations will upgrade current business practices and communication standards by specifically: (1) Updating the Nominations Related Standards to allow a Service Requester to determine which rights of the contract its segmentation nomination is using; (2) updating the Quadrant EDM Related Standards to (i) define a NAESB standard time frame for information to be retained on a pipeline's Informational Postings website, (ii) allow for processing functions at the line item level on Customer Activities websites and allow for the use of icons and/or graphical control elements for navigation and/or processing functions, and (iii) make minor revisions designed to add clarity, update the minimum technical characteristics to account for changes in technology since the previous version (Version 3.1) of the WGQ standards, and update the minimum and suggested operating systems and web browsers that entities should support; (3) updating multiple sets of standards to remove references to the term “gigacalories” and add the term “gigajoules” as the standard quantity for nominations, confirmations, and scheduling in Mexico; and (4) revising the NAESB WGQ data sets or other technical implementation documentation while not resulting in modifications to the underlying business practice standards. The package of standards also includes minor corrections. The implementation of these data requirements will provide additional transparency to Informational Postings websites and will improve communication standards. The implementation of these standards and regulations will promote the additional efficiency and reliability of the natural gas industries' operations thereby helping the Commission to carry out its responsibilities under the NGA. In addition, the Commission's Office of Enforcement will use the data for general industry oversight.

Internal Review: We have reviewed the requirements pertaining to business practices of interstate natural gas pipelines and have determined that the revisions are necessary to establish a more efficient and integrated pipeline grid. These requirements conform to the Commission's plan for efficient information collection, communication, and management within the natural gas pipeline industries. We determined, through our internal review, that there is specific, objective support for the burden estimates associated with the information requirements.

44. Interested persons may obtain information on the reporting requirements by contacting the following: Federal Energy Regulatory Commission, 888 First Street NE, Washington, DC 20426 [Attention: Ellen Brown, Office of the Executive Director], email: [e-mail], telephone: [phone], fax: [phone].

45. Comments concerning the collection of information(s) and the associated burden estimate(s), should be sent to the contact listed above and to the Office of Management and Budget, Office of Information and Regulatory Affairs, Washington, DC 20503 [Attention: Desk Officer for the Federal Energy Regulatory Commission], telephone: [phone]; fax: [phone].

VI. Environmental Analysis

46. The Commission is required to prepare an Environmental Assessment or an Environmental Impact Statement for any action that may have a significant adverse effect on the human environment.^[40] The actions that we take here fall within categorical exclusions in the Commission's regulations for rules that are clarifying, corrective, or procedural, for information gathering, analysis, and dissemination, and for rules regarding sales, exchange, and transportation of natural gas that require no construction of facilities.^[41] Therefore, an environmental review is unnecessary and has not been prepared as part of this Final Rule.

VII. Regulatory Flexibility Act

47. The Regulatory Flexibility Act of 1980 (RFA) ^[42] generally requires a description and analysis of final rules that will have significant economic impact on a substantial number of small entities. The Commission is not required to make such analysis if proposed regulations would not have such an effect.

48. As we stated in the WGQ Version 3.2 NOPR, approximately 178 interstate natural gas pipelines, both large and small, are potential respondents subject to the requirements adopted by this rule. Most of the natural gas pipelines regulated by the Commission do not fall within the RFA's definition of a small entity,^[43] which is currently defined for natural gas pipelines as a company that, in combination with its affiliates, has total annual receipts of $30 million or less.^[44] For the year 2019, only 11 companies not affiliated with larger companies had annual revenues in combination with its affiliates of $30 million or less and therefore could be considered a small entity under the RFA. This represents about six percent of the total universe of potential respondents that may have a significant burden imposed on them. We estimate that the one-time implementation cost of the proposals in this Final Rule is $1,977,580 (or $11,110 per entity, regardless of entity size).^[45] We do not consider the estimated $11,110 impact per entity to be significant. Moreover, these requirements are designed to benefit all customers, including small businesses that must comply with them. Further, as noted above, adoption of consensus standards helps ensure the reasonableness of the standards by requiring that the standards draw support from a broad spectrum of industry participants representing all segments of the industry. Because of that representation and the fact that industry conducts business under these standards, the Commission's regulations should reflect those standards that have the widest possible support.

49. Accordingly, pursuant to section 605(b) of the RFA,^[46] the regulations being promulgated herein should not have a significant economic impact on a substantial number of small entities.

VIII. Document Availability

50. In addition to publishing the full text of this document in the Federal Register, we provide all interested persons an opportunity to view and/or print the contents of this document via the internet through the Commission's Home Page (https://www.ferc.gov/​). At this time, we have suspended access to the Commission's Public Reference Room due to the President's March 13, 2020 proclamation declaring a National Emergency concerning COVID-19.

51. From the Commission's Home Page on the internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number excluding the last three digits of this document in the docket number field.

52. User assistance is available for eLibrary and the Commission's website during normal business hours from the Commission's Online Support at [phone] (toll free at 1-866-208-3676) or email at [e-mail], or the Public Reference Room at [phone], TTY [phone]. Email the Public Reference Room at [e-mail].

IX. Effective Date and Congressional Notification

53. These regulations are effective October 12, 2021. We have determined (with the concurrence of the Administrator of the Office of Information and Regulatory Affairs of OMB) that this rule is not a “major rule” as defined in section 351 of the Small Business Regulatory Enforcement Fairness Act of 1996. This Final Rule is being submitted to the Senate, House, and Government Accountability Office.

List of Subjects in 18 CFR Part 284

• Incorporation by reference
• Natural gas
• Reporting and recordkeeping requirements

By direction of the Commission.

Issued: July 15, 2021.

Debbie-Anne A. Reese,

Deputy Secretary.

In consideration of the foregoing, we amend part 284, chapter I, title 18, Code of Federal Regulations, as follows:

PART 284—CERTAIN SALES AND TRANSPORTATION OF NATURAL GAS UNDER THE NATURAL GAS POLICY ACT OF 1978 AND RELATED AUTHORITIES

1. The authority citation for part 284 continues to read as follows:

Authority: 15 U.S.C. 717-717z, 3301-3432; 42 U.S.C. 7101-7352; 43 U.S.C. 1331-1356.

2. Amend § 284.12 by revising paragraphs (a)(1) and (2) to read as follows:

§ 284.12

Standards for pipeline business operations and communications.

(a) * * *

(1) An interstate pipeline that transports gas under subparts B or G of this part must comply with the business practices and electronic communications standards as promulgated by the North American Energy Standards Board, as incorporated herein by reference in paragraphs (a)(1)(i) through (vii) of this section.

(i) Additional Standards (Version 3.2, August 15, 2020);

(ii) Nominations Related Standards (Version 3.2, August 15, 2020);

(iii) Flowing Gas Related Standards (Version 3.2, August 15, 2020);

(iv) Invoicing Related Standards (Version 3.2, August 15, 2020);

(v) Quadrant Electronic Delivery Mechanism Related Standards (Version 3.2, August 15, 2020);

(vi) Capacity Release Related Standards (Version 3.2, August 15, 2020); and

(vii) internet Electronic Transport Related Standards (Version 3.2, August 15, 2020).

(2) This incorporation by reference was approved by the Director of the Federal Register in accordance with 5 U.S.C. 552(a) and 1 CFR part 51. Copies of these standards may be obtained from the North American Energy Standards Board, 801 Travis Street, Suite 1675, Houston, TX 77002, Phone: [phone]. NAESB's website is at https://www.naesb.org/​. Copies may be inspected at the Federal Energy Regulatory Commission, Public Reference Room, 888 First Street NE, Washington, DC 20426, Phone: [phone], https://www.ferc.gov/​,, or at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, email [e-mail], or go to: www.archives.gov/​federal-register/​cfr/​ibr-locations.html.

* * * * *

Footnotes

1.  As explained below, we are not incorporating by reference in this Final Rule the optional model contracts and the eTariff-related standards included in the North American Energy Standards Board (NAESB) Wholesale Gas Quadrant (WGQ) Version 3.2 package of business practice standards.

2.  As explained below, NAESB has developed and adopted, in conjunction with Sandia National Laboratories, a series of business practice standards to protect the natural gas industries' internet security.

3.  Sandia is a multidisciplinary national laboratory and federally funded research and development center for the U.S. Department of Energy's (DOE) National Nuclear Security Administration that supports numerous federal, state, and local government agencies, companies, and organizations.

4.  OpenPGP is an encryption standard defined by the internet Engineering Task Force enabling design and implementation free of licensing fees. At present, the encryption method is generally considered the most secure.

5.  HTTPS authentication encrypts username and password combinations as part of a Uniform Resource Locator address. To obtain an HTTPS connection, a web browser must contact a trusted, commercial Certificate Authority, such as a NAESB Authorized Certificate Authority, to obtain the web server's public key, and follow other applicable HTTPS procedures.

6.  This series of orders began with the Commission's issuance of Standards for Bus. Pracs. of Interstate Nat. Gas Pipelines., Ord. No. 587, 61 FR 39053 (July 26, 1996), FERC Stats. & Regs. ¶ 31,038 (1996) (cross-referenced at 76 FERC ¶ 61,042).

7.  In April 2017, NAESB announced that Sandia, through funding provided by DOE, would be performing a surety assessment of the NAESB standards. As determined by Sandia and DOE, the purpose of the surety assessment was to analyze cybersecurity elements within the standards, focusing on four areas: (1) The NAESB Certification Program for Accredited Certification Authorities, including the Wholesale Electric Quadrant (WEQ)-012 Public Key Infrastructure Business Practice Standards, the NAESB Accreditation Requirements for Authorized Certificate Authorities, and the Authorized Certification Authority Process; (2) the WEQ Open Access Same-Time Information Systems suite of standards; (3) the WGQ and Retail Markets Quadrant IET and Quadrant EDM Related Standards Manual; and (4) a high-level dependency analysis between the gas and electric markets to evaluate the different security paradigms the markets employ.

8.  Standards for Bus. Pracs. of Interstate Nat. Gas Pipelines, Notice of Proposed Rulemaking, 86 FR 12879 (Mar. 5, 2021), 174 FERC ¶ 61,103 (2021) (Version 3.2 NOPR).

9.  HTTP is the original communications protocol of the internet which enables a web browser to depict text, pictures, shapes, live data, and click targets on a web browser. However, username and password combinations are not encrypted in HTTP Basic Authentication.

10.  NAESB Cmts. at 1.

11.  INGAA Cmts. at 3.

12.  Id. at 2.

13.  Id.

14.  The National Institute of Standards and Technology Special Pub. 800-52 requires government Transport Layer Security servers and clients to support Transport Layer Security Version 1.2 and recommends support for Transport Layer Security Version 1.3 by the year 2024.

15.  Rivest-Shamir-Adelman is a public key infrastructure algorithm composed of a public component and a private component that is typically installed on a recognized Certificate Authority.

16.  Elliptic Curve Digital Signature Algorithm public keys generate an encrypted signature to validate data.

17.  A Hash is a cryptology technique used for digital signatures in which a series of numbers that may represent, for example, a password, an image, a document, or an executable file is used to generate a cryptographic hash (i.e., a large number).

18.  SHA-2 is a set of cryptographic hash functions.

19.  PGP is a proprietary (i.e., an organization must pay to use it) encryption program developed to enhance the confidentiality and integrity of data.

20.  In order for a Service Requester to have control over its segmented nomination(s), the Transportation Service Provider (TSP) will require a “Capacity Block ID” to be submitted with each nomination line item specifying a Transaction Type of “Segmented.”

21.  NAESB WGQ Version 3.2 Standards 1.3.14, 1.3.15, 1.3.82, and 3.3.3.

22.  NAESB WGQ Version 3.2 Standards 0.4.1 through 0.4.3, 1.4.1, 1.4.3 through 1.4.6, 2.4.1, 2.4.6, 2.4.17, 3.4.1, 3.4.2, and 5.4.24 through 5.4.26.

23.  Public Law 104-113, 12(d), 110 Stat. 775 (1996).

24.  Version 3.2 NOPR, 174 FERC ¶ 61,103 at n.1 & P 19.

25.  NAESB's clarifying comments regarding revised existing Standards 4.3.60 and 10.3.16 are discussed separately in section II above.

26.  To aid in compliance, promptly after issuance of this Final Rule, we will post a sample tariff record on the Commission's website that may be accessed at https://www.ferc.gov/​ferc-online/​elibrary. All interstate natural gas pipelines are to file their tariff records in conformance with this sample tariff record.

27.  Version 3.2 NOPR, 174 FERC ¶ 61,103 at PP 20-24.

28.  Standards for Bus. Pracs. of Interstate Nat. Gas Pipelines, Ord. No. 587-W, 80 FR 67302 (Nov. 2, 2015), 153 FERC ¶ 61,061, at P 42 (2015) (Ord. No. 587-W).

29.  See supra n.21.

30.  Id.

31.  For example, pipelines are required to include the full text of the NAESB nomination and capacity release timeline standards (WGQ Standards 1.3.2(i-vi) and 5.3.2, respectively) in their tariffs. See, e.g., Standards for Bus. Pracs. of Interstate Nat. Gas Pipelines, Ord. No. 587-U, 75 FR 16337 (Apr. 1, 2010), 130 FERC ¶ 61,212, at P 39 & n.42 (2010). Each pipeline's submittal is to identify which tariff provision complies with each of these standards.

32.  Shippers can use the Commission's electronic tariff system to locate the tariff record containing the NAESB WGQ standards, which will indicate the docket number in which any waiver or extension of time was granted.

33.  Public Law 104-113, 12(d), 110 Stat. 775 (1996), 15 U.S.C. 272 note (1997).

34.  1 CFR 51.5 (2020). See Incorporation by Reference, 79 FR 66267 (Nov. 7, 2014).

35.  5 CFR 1320.11 (2020).

36.  FERC-545 covers rate change filings made by natural gas pipelines, including tariff changes.

37.  FERC-549C covers Standards for Business Practices of Interstate Natural Gas Pipelines.

38 .  The number of respondents is the number of entities in which a change in burden from the current standards to the proposed exists, not the total number of entities from the current or proposed standards that are applicable.

39.  The estimated hourly cost (salary plus benefits) provided in this section is based on the salary figures for May 2019 posted by the Bureau of Labor Statistics for the Utilities sector (available at https://www.bls.gov/​oes/​current/​naics3_​221000.htm) and scaled to reflect benefits using the relative importance of employer costs for employee compensation from June 2020 (available at https://www.bls.gov/​news.release/​ecec.nr0.htm). The hourly estimates for salary plus benefits are:

Computer and Information Systems Manager (Occupation Code: 11-3021), $101.58

Computer and Information Analysts (Occupation Code: 15-1210), $87.42

Electrical Engineer (Occupation Code: 17-2071), $70.19

Legal (Occupation Code: 23-0000), $142.65

The average hourly cost (salary plus benefits), weighting all of these skill sets evenly, is $100.50. We round it to $101/hour.

40.  Reguls. Implementing the Nat'l Envt'l Pol'y Act, Ord. No. 486, 52 FR 47897 (Dec. 17, 1987), FERC Stats. & Regs. Preambles 1986-1990 ¶ 30,783 (1987) (cross-referenced at 41 FERC ¶ 61,284).

41.  See 18 CFR 380.4(a)(2)(ii), 380.4(a)(5), and 380.4(a)(27) (2020).

42.  5 U.S.C. 601-612.

43.  See 5 U.S.C. 601(3) citing section 3 of the Small Business Act (SBA), 15 U.S.C. 623. Section 3 of the SBA defines a “small business concern” as a business which is independently owned and operated, and which is not dominant in its field of operation (2019).

44.  13 CFR 121.201 (Subsector 486—Pipeline Transportation; North American Industry Classification System code 486210; Pipeline Transportation of Natural Gas) (2020). “Annual Receipts” are total income plus cost of goods sold.

45.  This number is derived by dividing the total cost figure by the number of respondents. $1,977,580/178 = $11,110.

46.  5 U.S.C. 605(b).