Review of Standards Becoming Enforceable in 2014

Transcription

1 Review of Standards Becoming Enforceable in 2014 Laura Hussey, NERC Director of Standards Development Standards and Compliance Workshop April 3, 2014

2 New BAL and VAR Standards in 2014 BAL Real Power Balancing Control Performance Adds a WECC Regional Variance BAL-001-TRE-1 Primary Frequency Response in the ERCOT Region Replaces ERCOT waiver of BAL R2 as an alternate means of assuring frequency performance in the ERCOT interconnection BAL-002-WECC-2 Contingency Response BAL-004-WECC-02 Automatic Time Error Correction Replaces BAL-004-WECC-01 VAR Voltage and Reactive Control Incorporates WECC regional variance; also retires one Paragraph 81 requirement 2

3 Other New or Revised Standards in 2014 EOP Event Reporting Consolidates requirements from CIP a Sabotage Reporting and EOP Disturbance Reporting FAC Vegetation Management Replaces FAC and FAC-003-2; same requirements as FAC but clarifies applicability to generator timelines Becomes enforceable for Transmission Owners in 2014; Generation Owners in

4 Partial Standards Newly Enforceable 2014 PER System Personnel Training Requirement R3, Part 3.1 requires each RC, BA, and TOP to provide System Operators with technology training that simulates the operational behavior of the Bulk Electric System (BES) during normal and emergency conditions. PRC-006-SERC-01 SERC UFLS Standard Four requirements become enforceable 4/1/2014: R1, R2, R7, and R8. One requirement becomes enforceable 10/1/14: R3. PRC Transmission Relay Loadability Only Requirement R6 becomes enforceable in 2014 Requires each PC to conduct an assessment in its area to determine circuits to which the TOs, GOs, and DPs in its area must apply other requirements in the standard 4

5 Retirements in 2014 Paragraph 81 retired 34 requirements or parts of requirements in 19 standards effective January 21, Version numbers were not incremented. Retirements are noted within each standard (in red). 5

6 Beyond BAL Frequency Response FAC Vegetation Management (R3 for GOs only) PRC Protection System Maintenance PRC-006-NPCC-01 NPCC UFLS standard TPL (Requirement R1 only) 2016 CIP Version 5 (nine standards) FAC Vegetation Management (all other R s for GOs only) TPL (all requirements except R1) Other Generator Verification Standards 6

7 7

8 Reliability Assurance Initiative Update Jerry Hedrick, NERC Director of Regional Oversight for Compliance Standards and Compliance Spring Workshop April 3, 2014

9 Project Progress Report Auditor Handbook Handbook and training provided to auditors at March workshop. Handbook on track for publication during April. Single Compliance Design A single program design has been presented for evaluation. The Evaluation team is currently reviewing design elements for final selection. Improvements to Self-Reporting User guide to support improved self reporting process completed in December Request for broader industry review in January FFT Enhancements Triage process implemented across ERO by January 1, 2014 to expedite disposition of minimal risk issues. Enforcement pilots to test aggregation and exercise of enforcement discretion under way. 2

10 2014 Timeline for Single Compliance Approach April May June July Aug Sep Oct Nov Dec April May October Present recommended common compliance design to ERO executive management. Provide update to BOTCC on common compliance approach. Finalized compliance audit design approved for training and deployment in Key Outputs Defined risk approach that supports two-way discussion Evaluation criteria results in appropriately scoped audits based on an entities size and risk Control evaluation is clearly defined and understood 3

11 Compliance Project Update What has been done All Regional pilots have been completed and documented A single recommended compliance design has been presented for evaluation What is currently being done Single recommended compliance design is being evaluated Processes are being developed and modified in response to evaluation team requests ERO enterprise compliance staff is being evaluated for necessary competencies and capabilities What will be done Common compliance approach will be endorsed by ERO executive management Capability and competency gaps will be bridged Enforcement and Compliance design will be integrated 4

12 CIP V5 Revisions and RAI Timeline 5

13 Compliance Activities What has been done Outreach and training Standard Drafting Team Support Posting Transition Lessons Learned What is currently being done Finalize implementation studies in April and report additional lessons learned Develop RSAWs Develop and provide a roadmap for CIP Version 5 transition for entities outside of the studies What will be done Continue Transition Program efforts to support transition guidance Provide progress reports to the industry and stakeholders 6

14 Please send any questions or comments to: 7

15 Enforcement Update Risk Assessment and Noncompliance Ed Kichline, NERC Senior Counsel and Associate Director of Enforcement Standards and Compliance Spring Workshop April 3,

16 Agenda Overview of Reliability Assurance Initiative (RAI) Enforcement Activities RAI Enforcement Pilots Improved triage of noncompliance User Guides for reporting noncompliance and mitigating activities Describing noncompliance Assessing risk of noncompliance 2

17 RAI Enforcement Issues Long overall processing time Lack of communication during process Dispersed processes for multi-region registered entities 3

18 RAI Enforcement Activities Short-Term Solutions User Guides Improved Process Flow (Triage) and Communication Multi-Region Registered Entity (MRRE) Process Medium- to Long-Term Solutions Improved Intake Process Pilots o Aggregation of minimal risk issues o Enforcement discretion (alternative to enforcement process) o Refinement to the Enforcement Criteria 4

19 RAI Enforcement Activities Find, Fix, Track and Report (FFT) enhancements implemented Improved selfreporting/mrre processes Lesser risk noncompliance eligible for discretion End state enforcement implementation 5

20 RAI Enforcement Activities The End State Vision for Enforcement The end state for enforcement involves reserving the enforcement process for those issues that pose a serious and substantial risk to the reliability of the Bulk Power System (BPS) and, as to other issues, allowing NERC and the Regional Entities to exercise appropriate discretion whether to initiate an enforcement action or address an issue outside of Enforcement. 6

21 End-State RAI Processes Maturity Continuum Mature controls / Risk assessment Controls not provided Eligible for adjustment in scope, monitoring, and related testing May require increased scope, monitoring, or testing May be eligible for aggregation/logging Not eligible for aggregation/logging Presumption of discretion No presumption of discretion 7

22 RAI Aggregation Pilot Purpose: To evaluate the ability of registered entities to self-assess issues, identify risk, and mitigate issues posing a minimal risk to reliability Participants will maintain a record of instances of noncompliance with specified Reliability Standards Minimal risk issues only Tracking format will be similar to the FFT spreadsheet 8

23 Sample Tracking Spreadsheet 9

24 Reporting and Review Reporting to Regional Entity Participants will maintain a record of instances at least once every of six noncompliance months. with specified Standards In the event entity identifies noncompliance and determines that it poses a moderate or greater risk to reliability, the entity is expected to Minimal submit a Self-Report. risk issues only Tracking format will be similar to the FFT spreadsheet Each participating entity will provide its spreadsheets to its Regional Entity 10

25 Reporting and Review Regional Entity Review The Regional Entity will review the spreadsheets and determine if there are any concerns requiring further mitigation or enforcement action. If no further issues, the matter may be disposed of by any of the available disposition tracks, but there is a presumption that they will be disposed of without an enforcement action. Each entity will be expected to provide evidence regarding its risk assessment and mitigating activities. NERC or the Regional Entity may review and determine that aggregation is not appropriate. 11

26 End-State RAI Processes Maturity Continuum Mature controls / Risk assessment Controls not provided Eligible for adjustment in scope, monitoring, and related testing May require increased scope, monitoring, or testing May be eligible for aggregation/logging Not eligible for aggregation/logging Presumption of discretion No presumption of discretion 12

27 RAI Enforcement Discretion Pilot Pilot program to identify minimal risk issues which would be recorded and mitigated without triggering an enforcement action. During the pilot, discretion is an available disposition track for minimal risk issues from specific entities, regardless of discovery mechanism. When fully implemented, discretion will be an available disposition track for all registered entities. NERC and the Regional Entities will monitor and log issues tracked for enforcement discretion treatment to refine discretion criteria (including issues regarding risk) and monitor trends. 13

28 The Triage Process During the first 60 days following discovery of noncompliance, Regional Entities will review and make an initial determination as to whether an issue will proceed through enforcement. During the discretion pilot, the following outcomes are possible: Issue poses a minimal risk and qualifies for discretion pilot; More information is required prior to determining the level of risk and disposition track; or The noncompliance does not qualify for the discretion pilot and will be enforced. During the pilot phase, minimal risk issues that are not part of the discretion pilot will continue to be processed primarily as FFTs. 14

29 The Importance of Risk Assessments The RAI enforcement pilots depend on the ability of Regional Entities and registered entities to make accurate and complete risk assessments At this time, aggregation and discretion are available only for minimal risk issues Registered entities will play an instrumental role in the success of RAI by providing robust information upfront regarding: Risk Mitigation Prevention of recurrence (including detective and corrective controls) 15

30 The Keys to Assessing Risk 16

31 Self-Report and Mitigation Plan User Guides The Self-Report and Mitigation Plan User Guides provide valuable information and insight on what to do to facilitate disposition by the ERO of possible noncompliance. 17 Drafts are available at:

32 Detailed Description of the Noncompliance Submittal date of noncompliance (as well as any related Self- Certifications or Self-Reports) Start and end dates of potential noncompliance Description of how the noncompliance was identified Why the noncompliance happened 18

33 Detailed Description of the Noncompliance Date the registered entity discovered the noncompliance Whether the noncompliance has been previously reported to other Regional Entities Whether the noncompliance is still occurring Any corrective actions that were taken upon identification of the noncompliance What future corrective actions may be planned to prevent reoccurrence 19

34 Detailed Description of the Noncompliance Applicable registered functions References to the specific Reliability Standard and Requirement at issue Time horizon of the noncompliance (i.e., real-time or planning horizon) Whether the noncompliance is related to documentation, performance, or both Any other relevant information and evidence to assist the Regional Entity 20

35 Risk Assessment Risk assessments must be based on facts, not assumptions The facts must be existing at the time of the noncompliance not developed later Risk assessments that are based on facts that develop after noncompliance is mitigated do not directly address the risk the noncompliance posed when it occurred or while it continues An after-the-fact determination that no harm was done does not support a conclusion that there was minimal risk to the BPS during the period of noncompliance 21

36 Risk Assessment: Potential and Actual Risk Potential Risk What might have happened to this particular entity regarding specific systems, devices, or activities? Actual Risk What might have happened to this particular entity regarding specific systems, devices, or activities, taking into account any compensating or mitigating factors that existed during the pendency of the noncompliance? What was the actual impact of the noncompliance? 22

37 Risk Assessment: Potential Impact Evaluation Just one approach Identify the risk source Evaluate the risk threat Determine the likelihood of the potential impact Risk sources trigger events that can lead to the risk threat If the initiating event occurred, what would be the following sequence of events? Determine the likelihood by assessing the probabilities of each event 23

38 Risk Assessment: Potential Risk The impact analysis generally involves identifying the source of a risk and the threat due to the risk: Risk Source: Internal or external o Inclement weather o An employee or contractor o Protection System devices Risk Threat: Risk sources trigger events that could lead to threats o Threat of losing a Protection System device o Threat of degradation or loss of a Bulk Electric System (BES) element o Threat of losing Critical Cyber Asset information o Threat of mistakenly providing unauthorized access to Critical Cyber Assets 24

39 Risk Assessment: Potential Risk The following factors play an important role in determining the risk: Registered functions performed Sizes of the BES equipment impacted by the noncompliance Entity s relationship with other entities Duration of the noncompliance To determine the potential risk, ask What if? 25

40 Risk Assessment: Actual Risk After determining the potential risk, the actual risk must be determined. What is the likelihood the potential risk could occur? Statistical information (internal or external data) Best educated guess of subject matter experts Management controls analysis: what processes, procedures, systems, or tools were in place to prevent, detect, or correct errors or events? What actually happened? 26

41 Assigning Risk Level Based on a consideration of the potential risk as well as the actual risk Risk Levels: Minimal: describe the factors that reduced any potential risk Moderate: describe the factors that elevated the potential risk from minimal, then describe the factors that kept the risk from being considered serious or substantial Serious or Substantial: describe the factors that caused the noncompliance to pose a severe threat to the reliability of the BPS 27

42 The Keys to Assessing Risk CIP-005 R2 28

43 The Keys to Assessing Risk CIP-007 R1 29

44 The Keys to Assessing Risk PRC-005 R2.1 30

45 The Key to Assessing Risk FAC-009 R1 31

46 Conclusion RAI Enforcement Activities delivering results Improving our interactions with registered entities Focusing resources on the greatest risks to reliability 32

47 33