March 19, 2013

Stay Ahead of the Game: The Impact of NERC Critical Infrastructure Standards on Power Generators

Energy Alert

Generators and large consumers of energy need to prepare for some significant pending regulatory changes put forward by NERC. Owners of these types of facilities should seek counsel to analyze the likely impacts, submit comments to FERC on the proposed changes and develop a compliance plan.

The North American Electric Reliability Corporation (NERC) has recently submitted a proposed Version 5 of its Critical Infrastructure Protection Reliability Standards to the Federal Energy Regulatory Commission (FERC) for approval. These new CIP standards significantly expand the reach of cyber security for users of the Bulk Electric System. They impact virtually all NERC facilities particularly smaller facilities and those operating Blackstart capabilities.

Currently, CIP Version 3 of these regulations is in effect. CIP Version 4 will take effect in April 2014 and if NERC has its way Version 5 will take effect sometime in 2015; Version 4 may be skipped. Two competing CIP versions and uncertain effective date are reason enough to cause paralysis. Not knowing how or when FERC will rule as to the content or effective dates creates greater uncertainty on how to proceed and how to minimize costs and impact on the organization.

Added to that is the proposed changes in CIP Version 5 represent a significant change to the structure of these standards and will have direct impact on entities currently registered with NERC. Rather than being based on an owner conducted risk-based assessment of its facilities as they were in the past, the new CIP standards will now apply a strict set of metrics to facilities which will determine their level of impact under the standards.

Some of the key considerations under the proposed Version 5 include:

Some Facilities Not Currently Impacted Now Will Be – Under the proposed revisions, even generators who are currently not heavily affected by the standards will now be included in the system at one of the three levels of "Impact" (High, Medium or Low). Previously, many facilities were able to self-declare that they were not "Critical Infrastructure" for the purposes of these standards and with the exception of a few minor requirements, could effectively exempt themselves from the system. Now, all facilities covered by NERC are going to be required to participate in the system at some level.

Some Facilities Currently Impacted Will Have Changed Requirements – Additional changes in the standards may cause a facility currently complying at one impact level to change to another. For example, a facility which was previously considered a Medium Impact facility could now be lifted into the High Impact category, which could require significant changes to facility design and security procedures.

Impacts for Blackstart Facilities – Operators of Blackstart facilities have significant advantages to gain in these proposed standards.

In its draft, NERC has responded to the concerns of many Blackstart facilities operators that the costs of maintaining the requirements of these standards were exceeding the financial incentive to maintain these facilities. If adopted as written, Blackstart facilities would be exempted from the burdensome requirements of the standards under Version 5.

FERC is currently reviewing these proposed changes. When approved, Version 5 will likely take effect around two years after the date of approval.

Businesses Should Implement a Strategy and Prepare for These Standards

Every business that is currently impacted by these standards or which may be under the revised proposal should address the uncertainty of this changing field with a comprehensive plan.

Preti Flaherty attorney William Roberts has extensive experience with FERC, NERC and with the application of these standards to generating and consumer facilities. He and his colleagues in the Energy Law Group can help businesses plan and be proactive about these changes, with tactics, including:

  • A comprehensive analysis of a company's current requirements and compliance under the standard and a review of how the proposed changes will affect the company's facilities.
  • Development of a strategy for complying with the upcoming Version 4 that acknowledges the forthcoming Version 5 – this may include essentially "skipping" Version 4 and preparing facilities and operators for the forthcoming Version 5.
  • Submission of comments to FERC in support of helpful provisions, in opposition to harmful changes and/or requesting that Version 4 compliance requirements be waived upon passage of Version 5 requirements.

Questions? Contact William Roberts in Preti Flaherty's Energy and Telecommunications Group for more information on the impact of NERC critical infrastructure standards on power generators. William may be reached at [email protected] or 617.226.3800.