Q&A and Lessons Learned

The typical timeline for compliance monitoring activities is as follows: 210 days prior: IRA questionnaire to entity; 180 days prior: IRA Questionnaire due back from entity; 150 days prior: IRA complete; 90 days prior: Audit Notification letter is sent.  With respect to CIP V5, the Audit Notification Letter will detail which requirements are in scope.

See the instructions for the Level 1 Data Request spreadsheet. If put in service prior to the audit period, leave it blank. If put in service during the audit period, use the date the asset was placed in service. The purpose of the commission date is to determine whether the asset was in place at the beginning of the audit period or was placed in service during the audit period.

Per CIP-011-2, R1.2, the registered entity remains responsible for protecting and securely handling BES Cyber System Information, including storage, transit, and use.

The IP, cell, and satellite phones would have to meet the definition of a BES Cyber Asset and potentially affect the BES within 15 minutes.

10/16/2015
Is there an expectation that EACM will include only those systems that complete Electronic Access Control and Electronic Access Monitoring, or would that extend to secondary systems that are used to provide enhanced security (but do not perform compliance activities) to  the primary Electronic Access Control and Electronic Access Monitoring systems?  For example, if you have a system that automatically disables access to support the 24 hour removal requirement but is not the system that performs Electronic Access Control or Electronic Access Monitoring,  would that be included as an EACM?
Generally speaking, if the system is simply a "nice to have" enhancement that goes above and beyond the access control and monitoring required by the standards (such as a system that runs a report to ensure that other systems have done their jobs), then it would not be included as an EACM, but would likely qualify as an internal control. However, in cases where the “secondary” system is needed to achieve strict compliance with access control and monitoring requirements, that system must be considered a part of the EACMS.

Regarding the example provided in the question, consider a misuse scenario where the system is compromised and an account is not disabled in a timely manner. Clearly, we would want to make sure that doesn't happen, and the standards’ only recourse is to classify the system as an EACMS and protect it.

Recording an EACMS Cyber Asset that resides outside an ESP on the CA tab.

• Example 1:  An individual EACMS or PACS Cyber Asset may be associated with more than one Asset ID.
  In this case, we’ve been including all associated Asset IDs as a delimited list within the Asset ID field. Log aggregation systems and PACS are examples that support/protect multiple Asset IDs listed on the BES Assets tab

Recording log collectors on the CA tab (column M).

• Example 2:  This is another case where several Cyber Assets accomplish the log aggregator function.
  We believe the primary Cyber Asset that’s configured to collect the logs in the log aggregator system should be recorded, not all Cyber Assets within the log aggregator system that may be a backup to the primary log collector. Taking this approach, all Cyber Assets that perform a log aggregation function are recorded as an EACMS (1 per row), but not all Cyber Assets in the log aggregation system will be associated with BCAs in the spreadsheet. We don’t know if this is the correct approach.

• Example 3:  Log collectors for EACMS and PACS aren’t Cyber Assets under the CIP program (hall of mirrors problem) but are also the systems from which compliance evidence is provided.
  There’s no Cyber Asset classification on the list that fits this scenario but the requirement applies to EACMS and PACS. We’ve intentionally left these fields blank with the assumption that only those Cyber Assets that fall under the CIP program and perform log collection for BES Cyber Assets are the ones that should be included.

Recording deactivated Cyber Assets

•  Example 4:  We’ve assumed that the spreadsheet represents “current state”. Therefore, columns that would no longer apply (such as ESP Identifier) would be left blank.

Entities can download the NERC guidance document from the CIP V5 Transition Program page located at: http://www.nerc.com/pa/CI/Pages/Transition-Program.aspx 
Note: The ERO is in the process of reviewing; so stay tuned.

The zip file includes the “CIP Version 5 Evidence Request User Guide v1.0.pdf” document that contains the instructions from NERC on how to fill out the spreadsheet. NERC is working on an update to the spreadsheet. SERC also has a modified spreadsheet that can be populated and used as audit evidence. Here are links to the SERC documents. NOTE: The SERC documents are subject to change at any time. Whatever CIP evidence collection method is in effect at the time of the audit is the method entities will be expected to use. 

• Level 1 Data Request Spreadsheet          Instructions  
• Level 2 Data Request Spreadsheet          Instructions

Example 1: Listing all associated Cyber Assets as comma delimited is correct.

Example 2: Please list all Cyber Assets that are part of the log aggregator system. Assess whether each Cyber Asset is required for operation of the log collector and whether, if it is compromised, it can affect logging and monitoring functions. Please note that redundancy does not affect the impact of the Cyber Asset.

Example 3: Leaving that field blank is acceptable since these assets do not meet the definition as EACMS in the NERC Glossary of Terms.

Example 4: List the information that is accurate when the Cyber Asset was decommissioned or removed from the network.

Referring to the document “Communications to BES Cyber Systems and BES Cyber Assets Version: November 9, 2015.” As noted in the last full paragraph on page 3 (just below Figure 1), the language within the Standard is unclear enough that this issue has been referred to the Standards Drafting Team for consideration in future Standards. Referring to Figure 1, right side of the drawing. The problem arises when the port server, which has an IP address and is accessible from any machine, has serially connected devices attached to it. Although the serially connected devices in the drawing have no IP addresses, they are network accessible since the port server has the IP address and the serially connected devices attached are attached to specific assigned ports. The same drawing, on the left side, provides a suggested remediation that should be considered. Note the use of the intermediate system. It would be helpful to clarify that, while the standards drafting team is working on addressing the ambiguity, the serial devices do not have Interactive Remote Access. However, recognizing the potential security risks with this architecture, it is a best practice to use an Intermediate System or something equivalent.

Medium impact generation facility: Could there be cases when a forced outage could qualify as a CIP exceptional circumstance? 

CIP exceptional circumstances have taken the place of the provision for emergency situations in Version 3. With that in mind, a weather emergency like a tornado or hurricane bearing down on the generation facility; a police action like a rail car of toxic gas that derails; a medical emergency within a protected area; or a fire at the facility requiring a general evacuation should qualify. The fact the generator itself caused a forced outage would not necessarily qualify. Areas should still be protected from unauthorized physical access, and cyber assets should continue to be protected from logical access.

The registered entity is responsible for defining its patch source; however, there is an expectation for due diligence to mitigate vulnerabilities of installed software. Please refer to CIP-007-6, R2.1.

Yes, a registered entity can have a PSP within a PSP; however, the definition of a PSP within a PSP will be based on the entity’s implemented access controls and authorization.

1.  Using the diagram below, is the entire substation router considered part of the ESP?  Or only the Electronic Access Point interface where access control is restricted?

NERC defines the ESP as “The logical border surrounding a network to which BES Cyber Systems are connected using a routable protocol.” The ESP depicted in the drawing is a logical border. The router is subject to the CIP requirements as an electronic access control system.

2.  Are you familiar with the console “management” port on Cisco routers and switches? These cannot be addressed with an IP address, and they do not support routing. To access the console port, you must connect a device to it via a serial cable and use terminal emulation software to access the device. If a laptop is temporarily connected to the console “management” port, should it have all the controls of a Transient Cyber Asset? Authorized? Approved software?  Patch Management?  Approved users?

If a registered entity connects a laptop to the console port of a BES Cyber Asset or PCA, the entity must protect the device per the CIP standards. NERC defines a Transient Cyber Asset as “A Cyber Asset that (i) is capable of transmitting or transferring executable code, (ii) is not included in a BES Cyber System, (iii) is not a Protected Cyber Asset (PCA), and (iv) is directly connected (e.g., using Ethernet, serial, Universal Serial Bus, or wireless, including near field or Bluetooth communication) for 30 consecutive calendar days or less to a BES Cyber Asset, a network within an ESP, or a PCA. Examples include, but are not limited to, Cyber Assets used for data transfer, vulnerability assessment, maintenance, or troubleshooting purposes.” Based on the scenario presented, the laptop meets the Transient Cyber Asset definition and must be treated as such.

3.  Is this different for a router where only a portion of the router (EAP) is part of the Electronic Security Perimeter and a switch that is completely inside the ESP?

Based on the drawing, the registered entity should evaluate the router for consideration as an Electronic Access Control or Monitoring System. In addition, the registered entity should assess the switch within the ESP as a possible Protected Cyber Asset or BES Cyber Asset. The registered entity is responsible for ensuring the devices meet the applicable requirements based on device classification.

4.  Can we use some sort of permanent device, e.g., Remote Site Gateway, to access the console “management” port? In this case, the Remote Site Gateway would NOT be connected to an Ethernet port on any device either at the boundary or inside the ESP. The remote site gateway would be remotely accessed via the business IP network and then access to a NERC CIP device through a serial connection.

All Cyber Assets that have direct connectivity to BES Cyber Assets should be identified and assessed using the appropriate BES Cyber Asset, Electronic Access Control or Monitoring System, and Protected Cyber Asset definitions. In particular, the Cyber Assets, and associated network connections, should be evaluated based on the definition of Interactive Remote Access. The registered entity should conduct the review based on accurate network drawings showing the entire data path used in the management of the cyber assets. In addition, the registered entity must maintain documentation detailing the connectivity through the Remote Site Gateway.

If strict compliance is technically feasible, then it must be implemented, and a TFE is not required. If strict compliance is possible but not technically feasible, then a TFE is required.

No, the expectation is that the logging process will provide accurate entry and exit times for each visitor at the time of the entry and exit.

If logs are not being maintained accurately, consider whether a self-report is required.

Can inbound and outbound access controls be split between two interfaces/EAPs

Possible answers following continued clarification.

1. If this refers to separate physical interfaces on a device, then no. The inbound and outbound cannot be split between the two interfaces as the requirement is that the inbound and outbound access requirements are necessary for each interface.
2. If referring to an Access Control List (ACL) as an interface or EAP, then yes. There may be two separate ACLs, one governing inbound traffic, the other governing outbound traffic. For some devices, this may even be the default access control scheme.

For those Registered Entities that had no assets under Version 3, will that impact their inherent risk assessment under RAI for Version 5?

The number of Critical Assets as well Critical Cyber Assets is considered when conducting an inherent risk assessment.  If a Registered Entity had no such assets under V3 but will have Medium or High BES Cyber Systems under V5, the risk assessment team would assess the impact of including those assets against the ERO/Regional Risks.  The risk assessment team would also consider the impact rating of these newly identified assets, compliance history, previous CMEP monitoring methods/frequency among other items.

What is SERC's expectations for tracking dates during the transition to V5?  May we do it by Requirement, device, site level, system?  Will a final date that all systems were switched to V5 be acceptable?

Registered Entities will need records of implementation to support the partial and transitional phase of implementation into CIP V5.  Registered Entities will also need records documenting the date an asset is moved into CIP V5 from CIP V3 until CIP V5’s date of compliance becomes active.  New assets should be developed and implemented into CIP V5 from their start.

If your Reliability Coordinator (RC) has agreed to be your TOP through a contractual agreement, does your control center fall within the “medium” or “low” criteria for CIP?  If “low,” does this change to a “medium” if your control center can operate BES equipment that the RC control center cannot?

The answer depends on the functions being performed in the control center for one or more of the assets that meet the criterion of CIP-002-5, which determine whether the BES Cyber System is classified in the High-Medium-Low Impact Rating. However, as suggested by the question, the Impact Rating of an asset could be raised or lowered based on the transfer of these functional obligations to another Registered Entity in a contractual agreement.

Also see CIP-002-5 question in the Standards category: How should  a TO facility that has a jurisdictional control agreement with a TOP control center be classified?

All files that are submitted by a registered entity to SERC in order to demonstrate the registered entity's compliance (or return to compliance) with the CIP Standards are considered Protected Entity Information (PEI). All such files are stored on dedicated hardware within a secure data center.

Updated:  1/1/2019
If SERC has outsourced their IT organization, who is supporting access to registered entities’ PEI?  Who is vetting the admins from that group and the whole process for protecting that information?
Currently SERC has contracted with Walser Technology Group (WTG) to maintain the SERC IT infrastructure.    WTG has been performing work for SERC for the last several years, so they do not represent a new or unknown risk.  Employees of WTG are subject to the same background screening (PRA) as any SERC employee.  The process for protecting PEI has become more stringent since WTG took over the IT function. The methods of PEI transfer have been greatly restricted.  Once the PEI is in SERC’s hands, it is scanned for viruses, before being transferred to the SERC PEI server. The PEI server is located inside its own enclave, and is accessible only via a dedicated VPN appliance.  Access to this server is limited to SERC employees with a demonstrated need-to-know, and each such employee has a separate user name and password for VPN access to the PEI server.  PEI remains on SERC-owned cyber assets throughout the process.

Moving forward, is it possible to allow a Registered Entity to store CIP protected information used in preparation for an audit (ahead of the audit) rather than sending the information to SERC?  There are specific concerns about sharing information related to CIP-005 and CIP-007.

Most Registered Entities have reviewed SERC’s PEI program, which was designed to conform with general cyber security best practices; and have seen the value of minimizing the on-site audit time and process. While SERC is willing to further explain the PEI process to assuage any specific concerns a Registered Entity may have, this is a necessary tool to improve our audit process.

Under CIP Version 5, do physical security perimeters need to be defined in three dimensions or, for example, would a fence around substation or a generating plant suffice?

The CIP-006-5 Standard states in Section 4: “While the focus is shifted from the definition and management of a completely enclosed “six-wall” boundary, it is expected in many instances this will remain a primary mechanism for controlling, alerting, and logging access to BES Cyber Systems. Taken together, these controls will effectively constitute the physical security plan to manage physical access to BES Cyber Systems.” 

That being stated, at a Generating Plant or Substation, it may not be possible to produce a six-wall boundary in many circumstances. While a fence is a good start, it could be considered one layer of physical protection, but should not be the only mechanism. According to CIP-006-5, the aim is “physical security defense in depth via multi-factor authentication or layered Physical Security Perimeter(s).”

Please confirm whether SERC or any other NERC region provides certification for its compliance auditors.

NERC and SERC do not provide certifications for auditors but do support ERO and Regional audit staff getting applicable audit certifications from the appropriate providers. NERC does have a “NERC Certified System Operator” certification, and several SERC auditors hold that certification.

Risk Considerations
N/A

Description of the Violation, Issue, or Trend
Registered entities have used legal or the Primary Compliance Contacts to act as a spokesperson/mediator instead of permitting the Subject Matter Experts (SMEs) to directly interact with SERC auditors.

Risk Considerations
This could slow the progress of the audit or hinder the SERC auditors’ ability to capture the actual process or walk-through in the documentation.

Other Factors or Comments
Auditors should have direct access to SMEs to permit the efficient and effective capture of evidence and knowledge. This will assist with the progress of the audit, and will get employees back to normal work assignments.

Would SERC be willing to commit to making their audit plans, RSAWs, work papers, etc. available to registered entities (drafts and final documents)?

SERC believes in transparency and walks each registered entity through the audit process and expectations. However, SERC will not be sharing finalized RSAWS or work papers.

Risk Considerations
N/A

Description of Mitigation Activity
N/A

Electronic approvals or signatures are acceptable as evidence.

The IRA conducted by SERC will result in the initial compliance monitoring scope for the registered entity.  Upon completion of the IRA, the summarization will be shared with the entity, and it’s the entity’s opportunity to identify possible errors (e.g., incorrect information, etc.).  Once the entity responds, SERC also ensures that it has not missed any key data points or information.  Based on the Entity and SERC’s additional reviews, there could be an increase or reduction of standards/requirements based on what information may have changed.  For example, SERC has conducted additional reviews and found that not all of the Implementation Plans (NERC/SERC/Other Region for MRRE) were properly selected in the “IRA Tool.” Therefore, an entity’s audit scope may have appeared to increase. However, it wasn’t necessarily an increase but an error correction.  For those entities that have received their IRA summarizations, SERC does see a decrease in the number of standards and requirements monitored via audit from previous years.  Those numbers vary based on the characteristics of the entity. 

The IRA process is the one of the initial steps in risk-based compliance monitoring. Information is assessed against risk factor criteria, which in turn has been mapped to standards and requirements.  There is some professional judgment that is used in the IRA process. However, SERC primarily uses the Internal Controls Evaluation to potentially reduce the monitoring scope.

The IRA process does not remove standards/requirements from the audit scope. There is no longer an Actively Monitored List for entities. Therefore, the starting point for standards/requirements in scope is ANY standard or requirement that is applicable to the function for which the entity is registered.  The NERC/SERC Implementation Plans add additional focus to identified risks, and then the entity’s characteristics determine the rest.

SERC has had approximately 12 entities “formally” participate in Internal Control Evaluations.  There has not been any reduction of standards/requirements based on ICE, but there have been many instances in the reduction of sampling. The entities that experienced a reduction in sampling were registered as a BA, TOP, or RC.

How much time / effort is being saved and by whom?  Is it too early to tell?  Has the efficiency of using the above to target requirements based on risk been realized?

The implementation year was 2015, and SERC, as well as the registered entities, has spent a lot of time and resources in reviewing, implementing, and developing internal controls. SERC expects that the efficiency will be realized in year two or three of the program once greater clarity is gained around expectations and as the controls mature.

Will SERC make the current ICE form available to entities who have not participated?

The ICE process is detailed on the SERC website, and the Internal Controls Survey template is available to the public.  SERC has worked with other entities that have declined ICE participation.  Based on resources available, SERC will provide the spreadsheet and a couple of risk factors (mapped to standards/requirements) and will work through the process with an entity.  Although it may not impact the current compliance monitoring engagement, it may provide training to the registered entity for Internal Control development and implementation.

Does SERC plan to publish the standardized data request for audits? If so, what is the anticipated publication date? (For example, a population of assets and format) 

No. SERC will continue to make data requests as is currently done.

Description of the Violation, Issue, or Trend
Registered entities have had issues with data/evidence retention in past audits. During the span of the audit periods, registered entities have lost or not retained all audit evidence.

Risk Considerations
If registered entities do not have an established document retention program, information can be lost; this could lead to an issue of noncompliance.

Other Factors or Comments
Registered entities should establish a process for retaining its audit documentation/evidence. In addition, a back-up person should know the process and periodically audit it to make certain the evidence is whole, complete, and accurate.

How will data sampling and selection be handled?

Sample sizes may be determined in part by the results of the optional Internal Controls Evaluation (ICE). If a registered entity chooses to participate in ICE and is found to have good internal controls, auditors will likely opt for a smaller number of samples. Sample selection will depend upon the Standard and Requirement involved, but will typically be a mix of statistical randomness and professional judgment. Sampling will be performed in accordance with the NERC ERO Sampling Handbook. An application called RAT-STATS (Regional Advanced Techniques Staff-Statistical) is used to generate a random sampling from a numbered list. Professional judgment generally aims to include a representative mix of samples, but can also be used to hone in on historic problem areas.

SERC’s pre-audit survey: If SERC is asking questions to determine a registered entity’s risk, how are they using these questions to determine a registered entity’s risk? Is cost a factor? Who has access to the information provided by the entity? Some of the questions are not directly related to a particular standard. (Example: List all fuel contracts; the number of spare transformers on site; the turnover rate)  
QUESTION:  What is the risk of not responding to pre-audit survey questions?

The pre-audit survey has been modified to only include logistic type of information, while the risk-based questions are now asked in an IRA questionnaire.  Each IRA questionnaire is specific to a registered entity; and consists of questions directly related to ERO or Regional identified risks, which are mapped to Standards/Requirements. SERC Reliability and Compliance personnel have access to the information. However, it is protected to ensure only personnel with a need to know have access. SERC creates the IRA questionnaire based on information that the Region currently has on the registered entity. If a registered entity chooses not to respond to the questionnaire, the Inherent Risk Assessment may not correctly reflect the level of risk that the entity could pose to the BPS.

That would depend on the specific standard and how the process document is written.  You may want to re-evaluate the effectiveness of the control. PRC-005-1.1b had no testing interval defined, and the entity was/is required to meet their own defined schedule.  PRC-005-2 defines the testing interval, but also caveats that, if the entity has a shorter interval and misses it but meets the defined interval, they still remain compliant.

Entity Assessment Single Points of Contact would hold the entity accountable to the language of the Standard/Requirement.

If the standard has a specific requirement and the requirement is met, even if the entity procedure is greater than the requirement, we will audit to the standard. If the requirement is to develop and implement a program, we will audit to that program.

Generally, you may use the format that is in that particular RSAW for that particular standard. Communication with your audit team lead (ATL) is very important. Talk with your ATL regarding formatting of the RSAWs for your particular audit, if you have additional questions. The RSAWs for your audit will be placed on the SERC Portal in the audit committee for your audit in the blank RSAWs folder.

In cases where more than one entity has BES Cyber Assets or BES Cyber Systems at a facility, there should be a written agreement that defines the responsibilities of each entity. For example, if one entity is providing all physical access control for a medium substation, that should be clearly documented. If a Possible Violation were found, the auditors would expect the second entity to review the information and consider appropriate action they should take to maintain their compliance with the standards (this could be a Self-Report).

How are attestations to be handled? When should attestations be updated and signed?

Attestations should be worded to cover the entire current audit period and cover all elements of the Requirement.  A Registered Entity may sign and date attestations anytime from the date of the Audit Notification Letter to the date of the onsite portion of the audit.  However, the Registered Entity must notify the Audit Team Lead if the conditions of the attestation change after signing and dating it.  The Audit Team Lead will be able to provide a Registered Entity more information on the timing and specific wording of different attestations.

Regarding consistency of the process for the two-week post-audit period, what is that process?

During the two week period after an audit, the Audit team and SERC management perform a quality review of the Audit process and Audit findings to ensure consistent treatment of registered entities during the audit process.

Description of the Violation, Issue, or Trend
Now that Registered Entities are providing audit evidence for review well in advance of the onsite audit, SERC auditors are facing new challenges when evaluating the evidence.  Most requirements warrant several evidence files each, however, when faced with several files at once, it can be difficult to know where to begin.  Sometimes, there is valuable introductory information in one of the files but auditors may not become aware of that information until after working through several other files.  Furthermore, since every Registered Entity uses a different combination of tools and approaches, the meaning of an individual file can be difficult to understand as auditors may not know what application generated the file or what parameters were used.

Risk Considerations
The most important risk posed by this problem is that auditors will misunderstand the evidence being presented and will arrive at an incorrect conclusion.  This could result in the incorrect issuance of a Potential Non-Compliance or, conversely, could result in failure to detect a serious compliance issue.  However, it is much more likely that the audit team will find it necessary to schedule additional conference calls with the Registered Entity in order to alleviate confusion, which requires the investment of significant additional time from SMEs.  This could make null one of the key benefits of the off-site documentation review.

Description of Mitigation Activity
Registered Entities could greatly aid the speed and efficiency of the off-site portion of the audit andreduce the time demands placed upon the SMEs by providing a small amount of explanation with each group of evidence files.  A simple text file entitled “ReadMe” could be used to give auditors some background information on the evidence files being submitted, such as the best order in which to review the files.  In cases where an evidence file consists of system-generated output, the ReadMe file could include such details as the name of the application that generated the output, what reporting parameters were used to generate the output, and/or which of a spreadsheet’s columns are pertinent to the Requirement in question.

Registered Entities were originally told there would be a cut-off date for audits (only looking at compliance information up to that date).  But now, Registered Entities are being told that SERC staff is looking at information up to the date of the audit. This means extra attestations, data, and work.  Why carry an audit scope up to the date of the audit?

In accordance with the NERC Rules of Procedure Appendix 4C Compliance Monitoring and Enforcement Program (CMEP), SERC defines the End Date of the audit period as the date the Audit Notification Letter is issued to the Registered Entity (which is at least 90 days prior to the commencement of a regularly scheduled audit).  If the SERC audit team discovers a potential noncompliance occurring subsequent to the End Date, the potential noncompliance will be subject to a Preliminary Screen pursuant to Section 3.8 of the CMEP.

Is SERC scaling back on the ISME compliance audit participation?  Is the participation only going to be for documentation and evidence review and not for the on-site part of the audit?

No, SERC is not scaling back on the ISME participation.  Because SERC is now doing more pre-audit evidence reviews, there may, at times, be less need to spend the full week on site.  Also, there may not be a need for the entire audit team to be on site.  It is at the Audit Team Leader’s discretion as to whether the entire team is needed on site or not and which team members are needed most.

If a Registered Entity provides mock audit information, how will that information be used? (In the Pre-Audit survey, SERC staff asks if the Registered Entity has done any pre-audit mock audits. If the response is yes, SERC staff requests the information.)  Is there a draft process for this?

Using mock audit information can reduce the work required for a Registered Entity’s audit. Generally Accepted Government Auditing Standards (GAGAS) (The Yellow Book) permits auditors to utilize the work of others when performing audits or compliance reviews.  In accordance with this guidance, SERC auditors have drafted a process that allows the team to utilize the results of mock audits in lieu of testing every individual Reliability Standard and Requirement under certain conditions.

What is SERC’s risk assessment leading into the audit going to be? Fully subjective? Objective?  In the past this has been subjective. Has this been re-thought? Once scope is determined, is it going to be applied to all compliance monitoring or just the audit?

SERC's risk assessment will be based on common risk criteria that will be applied to all of its Registered Entities.  All audit engagements entail professional judgment by the risk evaluators and audit staff.  However, by ensuring common risk criteria and common risk thresholds, SERC staff will ensure a more consistent approach across Registered Entities. Risk-based compliance monitoring will affect the scope and implementation of all CMEP activities.

Description of the Violation, Issue, or Trend
In preparation for compliance audits, Registered Entities are asked to fill out the relevant Reliability Standard Audit Worksheets (RSAWs).  Depending on the scope of the audit, completing this step all at once may monopolize the Registered Entity Subject Matter Experts’ (SMEs) availability for a significant time period.

Risk Considerations
One of the most important risks is that limitations on their availability may lead Registered Entity SMEs to rush the process of filling out the RSAWs, resulting in incomplete or unclear information being supplied to auditors.  As a result, auditors may misunderstand the evidence being presented; and may arrive at an incorrect conclusion.  This could result in incorrect issuance of a Potential Non-Compliance or, conversely, could result in failure to detect a serious compliance issue.  However, it is much more likely that the audit team will find it necessary to schedule additional conference calls with the Registered Entity in order to alleviate confusion.  As such, the more prevalent risk is that the audit team will require Registered Entity SMEs to invest significant additional time. 

Description of Mitigation Activity
Treat the RSAWs as "living documents."  Rather than filling them out once every audit period, keep them updated as environments and processes change.

Other Factors or Comments
Because the RSAWs serve as auditors' work papers, becoming familiar with them will also aid SMEs in understanding what auditors look for during the audit.

There is a lack of clarity on what SERC is really going to do and the timing of site visits.  Registered Entities need more information in order to have the right people on site, extra escorts, etc.

Site visits are normally conducted during the onsite portion of the audit.  The Audit Team Lead (ATL) will be the Registered Entity’s point of contact during the audit and will provide detailed information on what will take place and when.  The ATL will inform the Registered Entity well ahead of time when the site visit will need to take place, how many SERC staff will be attending, and will be as accommodating as possible.

Is there a NERC or SERC process in place for the registered entity to ask questions about the evidence the Auditors will look for on a specific requirement, if the RSAW doesn't provide that type of insight?

No, there is not a SERC or NERC process where Registered Entities can ask for specifics of audit evidence details other than at workshops and seminars like the ones conducted by SERC twice a year. All Registered Entities do things differently. However, every Registered Entity should end up with the same results (outcome) when it comes to compliance with the NERC requirements. The CEAs will always audit to the wording in each Requirement. It is up to the Registered Entity to provide the evidence that will demonstrate compliance to the CEA during the audit process. For example, processes, procedures or records.

It is not sufficient to merely regurgitate the Standard/Requirement as a demonstration of compliance. For example, regarding FAC-008-3 R1, R2, and R3, it will be the responsibility of the Registered Entity to present the specific means by which it derives its Facility Ratings for each component listed in the requirements.

Pay special attention to words like “shall have” or “must have” to make sure that all aspects required in the Requirements are covered and including how those things in the wording of each requirement are performed (HINT: If you do not have any Series or Shunt Compensation elements in the Facility, stating that fact in the Facility Rating Methodology is a means of demonstrating  this element has been addressed.).

Neither NERC nor SERC is going to tell or suggest how a Registered Entity is to run its business. SERC Compliance Monitoring is always willing to give broad examples of the type of information that it has seen as satisfactory evidence in previous audits and to share industry best practices.

Will the auditor handbook be made available to Registered Entities once it's developed?

NERC has made the auditor handbook available on its website at
   https://www.nerc.com/pa/comp/Pages/ERO-Enterprise-Compliance-Auditor-Manual.aspx

If during the ICP review a question of an expansion of the audit scope is identified – is it a group decision of the audit team or just the lead auditor?

Expansion of audit scope during an audit is usually an Audit Team decision based on evidence reviewed during the audit. The ultimate decision is made by the Audit Team Lead.

If you have a consultant preparing your documentation for an audit, can he, or a representative of his firm, act in the role of primary or secondary SME?

If a consultant represents a registered entity as a subject matter expert (SME) that person needs to be an "authorized representative" on behalf of the registered entity. Also, remember that SERC's confidentiality agreements are with the registered entities, and not consultants.

SERC will continue to have a yearly Implementation Plan, and Compliance Monitoring activities will be dependent on the results of a registered entity’s IRA. Traditional “annual” Self-Certifications have been eliminated. SERC, along with other regions, is now using Guided Self-Certifications instead, which look at lower risk requirements.

Please comment on “Self-Report credit” if you Self-Report after audit notification.

In general, after an audit notification, you will not receive Self-Reporting credit. If an issue occurs during the audit notification period, SERC staff will review the facts and circumstances to determine if credit is appropriate. 

I keep hearing about Self-Reporting.  While I understand it identifies that you are “being honest”, does Self-Reporting eliminate the possibility of fines/enforcement actions vs. the issue being found during an audit?

No, Self-Reporting does not eliminate the possibility of penalties and sanctions. Penalties and sanctions are determined based on the risk to the bulk power system. However, most self-reported issues receive Self-Reporting credit, which reduces the penalty if one is imposed. Self-identification can be an indicator of a strong internal compliance program, which can also reduce a penalty.

For submitting Self-Reports, the new Self-Report form requires root cause and mitigating and prevent recurrence actions.  To be as complete as possible for input as a potential FFT candidate, is 4-8 weeks for submittal of the Self-Report considered timely?

Yes. Self-Reports received within 90 days of discovery are generally considered timely. For issues discovered by the registered entity and not reported to the Region within 90 days, please provide the reason as to why it is took so long to report.  

SERC will continue to use Spot Checks as a monitoring tool. Traditionally, SERC has used Spot Checks as a monitoring method initiated for various reasons, like in response to a system event or to confirm a Self-Certification. In 2015 the regions expanded the use of Spot Checks as a Compliance Monitoring tool for issues that could include a small number of requirements or sampling. Spot Checks are similar to off-site audits, but are smaller and more focused in scope.

Spot audits or Spot Checks are small, focused audits. They may be done on-site or off-site. The NERC Rules of Procedure require a minimum of at least 20 days notification of a Spot Check to the registered entity. The audit team gives an Opening and Exit presentation. RSAWs are used as in an audit. Depending on the standard and requirement, SERC may require sampling. At the end of the Spot Check, SERC will create and send a report.

Guided Self-Certifications are like the traditional Self-Certifications and actually use the same electronic form on the SERC Compliance Portal. The word “Guided” was added to differentiate from the traditional Self-Certifications because Guided Self-Certifications will require supporting evidence to be attached to the electronic form. SERC will give a 30 to 60-day notification by letter to the registered entity that the forms will be posted on the SERC Compliance Portal. No RSAWs are required or expected to be used, as the Guided Self-Certification form itself is the audit work paper. SERC will not monitor standards and requirements that require a sampling methodology by the Guided Self-Certification method. SERC will monitor those standards and requirements by another method such as a Spot Check or Audit. If the supporting evidence attached to the Guided Self-Certification is not sufficient, SERC audit staff will make another evidence request or modify the monitoring method to a Spot Check. SERC will not send a report but will send a validation form confirming compliance with standards and requirements in scope as notification to the registered entity that the Guided Self-Certification review is complete.

SERC has already anticipated this, and has been in contact with those entities undergoing an audit or scheduled to receive an Audit Notification Letter in the coming weeks.

Any impacts to those schedules will be communicated to the registered entity involved, as they arise.

Brief descriptions have been provided on the form for the exception justification, possible impact, and actions to be taken.

Specific guidance cannot be provided due to the potential number of variations that may occur with specific facts and circumstances. Each registered entity can work with their assigned Single Point of Contact (SPOC) when completing the form or submit their question to the SERC Q&A using the COVID-19 topic. Contact serccomply@serc1.org, if you do not know who your SPOC is.

 Yes, a separate COVID-19 Impact Notice form should be submitted to SERC for each unique Standard/Requirement in which a periodic action cannot be completed during the designated time period.

Yes, a separate COVID-19 Impact Notice form should be submitted to SERC for each unique Standard/Requirement in which a periodic action cannot be completed during the designated time period.

April 3, 2020
Should our first step just be to contact our SPOC before submitting the form?

It is not necessary to contact your SERC SPOC before submitted a COVID-19 Impact Notice form.  SERC asks, however, that you copy that SPOC when you submit the form.  If you need specific assistance prior to the submission, feel free to contact your SPOC directly.

The COVID-19 Impact Notice form should be used to submit any COVID-19 impact issue to SERC. The spreadsheet was originally provided in the SERC notification prior to the creation of the form.

This is a very fluid situation we are currently in, however we are considering any impacts on our audit schedule for later this year.

At this time we are maintaining our audit schedule for registered entities scheduled to receive an Audit Notification Letter after July 31, however this is subject to revision as this situation evolves.

March 23, 2020
If a utility was forced to set up a temporary control center due to needs to isolate personnel over Coronavirus contamination that cannot be fully completed with the two current control centers (primary and backup), is there any provision that allows the entity to be released from meeting some of the CIP standards during an emergency conditions such as this?  

SERC recognizes the challenges that the coronavirus outbreak has placed on our operations. In fact, NERC and FERC issued guidance on personnel certification requirements, meeting periodic Reliability Standards requirements, and compliance monitoring activities by the Regions. Regulatory discretion will be applied in consideration of the uncertainties caused by our collective response and recovery from this unprecedented public health emergency.

The most relative scenarios center on our entities’ responses during a natural disaster. The response below for your consideration is very prescriptive. This is because the requirements around a CIP Exceptional Circumstance are specific. Naturally, there can be flexibility in any waivers or leniency granted during this time.

For all instances during this period, SERC will consider all facts and circumstances as described in the guidance provided by NERC and FERC; however, it is incumbent on the registered entity to notify SERC of the issue, to fully describe the specific facts and circumstances for each case, and to not assume we know their specific details, should an issue arise.

SERC places criticality on all situations concerning conditions or events that impact or might impact reliable operation of the bulk power system (BPS). Cases of COVID-19, have the potential to become a CIP Exceptional Circumstance. Understanding the definition of a CIP Exceptional Circumstance and ensuring that our registered entities’ existing Business Continuity Plans address the requirements identified for a CIP Exceptional Circumstance is paramount.

Glossary definition of CIP Exceptional Circumstance:

A situation that involves or threatens to involve one or more of the following, or similar, conditions that impact safety or BES reliability: a risk of injury or death; a natural disaster; civil unrest; an imminent or existing hardware, software, or equipment failure; a Cyber Security Incident requiring emergency assistance; a response by emergency services; the enactment of a mutual assistance agreement; or an impediment of large scale workforce availability.

Some examples of CIP Exceptional Circumstances include the standards and requirements identified below. Please remember, this list includes only CIP standards, and is not conclusive. Others, such as PER-003-2 and PRC-005-6 might also be affected.

• CIP-003-7 R2 Attachment 1 Section 5
• CIP-004-6 R2 Part 2.2
• CIP-004-6 R4; Part 4.1
• CIP-006-6 R2 Part 2.1, 2.2
• CIP-007-6 R4 Part 4.3
• CIP-010-2 R3 Part 3.3 and R4

 What is the maximum file size for documents imported to the secure Committee documents folders?

The maximum file size for documents imported to the secure Committee documents using the portal interface folders is 50 MB. There is no size limit for documents imported using sFTP.

What roles (permissions) are available in the RA Portal?

RAV - Reliability Viewer
A contact with RAV permissions can view, but not edit or submit, all data forms. RAV is the default setting for all users.

RAC - Reliability Contributor
A contact with RAC permissions can view, edit, and submit all data forms.

MAA - Master Account Administrator
A contact with the MAA role can view, edit, and submit all data forms. In addition, the MAA user can edit roles (permissions) for all users with access to the company for which the contact has the MAA role.

Why is a data form read-only?

The icon in the Action column indicates the form's status, Read-Write or Read-Only. The status varies depending on whether the form has been submitted and the current user’s access level. If the form is Read-Only but it has not been submitted, ask your Master Account Administrator (MAA) to update your permissions from RAV (Viewer) to RAC (Contributor).

Who will the Annual Registration Confirmation letter notifications go to?  When will they be sent?

The Annual Registration Confirmation notifications are sent to the Primary and Alternate Compliance Contacts. Notifications are sent via email, generally, by the end of the first quarter each year or shortly thereafter.

My question is, what falls outside the existing process for notification of model changes for planning purposes?  We also need to know if there is a time frame associated with the notification to SERC.

The NERC Rules of Procedures, Section 501. Scope of the Organization Registration and Organization Certification Programs, Part 1.3.5 states:

Each Registered Entity identified on the NCR shall notify its corresponding Regional Entity(s) of any corrections, revisions, deletions, changes in ownership, corporate structure, or similar matters that affect the Registered Entity’s responsibilities with respect to the Reliability Standards. Failure to notify will not relieve the Registered Entity from any responsibility to comply with the Reliability Standards or shield it from any Penalties or sanctions associated with failing to comply with the Reliability Standards applicable to its associated Registration.

The above obligation includes configuration changes (i.e., new facilities, reconfigurations, decommissions, etc.) associated with the entity’s Transmission system and Generation assets. This will allow SERC to conduct an evaluation of the subject facilities and determine the correct classification (i.e., BES or non-BES). This is not however limited specifically to Transmission and Generation facilities as other facilities can be a determining factor in the overall Registration process.

For changes to the “models” (i.e., new facilities, reconfigurations, decommissions, etc.), entities should continue to follow the existing SERC processes.

While there is no specific time frame requirement for reporting these changes, the expectation is that they be reported as soon as practicable. As stated in the NERC Rules of Procedure, Section 501. Scope of the Organization Registration and Organization Certification Programs, Part 1.3.5:

Failure to notify will not relieve the Registered Entity from any responsibility to comply with the Reliability Standards or shield it from any Penalties or sanctions associated with failing to comply with the Reliability Standards applicable to its associated Registration.

1. How would this device be any different than a device in storage waiting to be installed?
2. Does the length of time the device will be de-energized factor into the result? 

If a device/Facility is installed and physically capable of being connected and energized, then the device/Facility should be treated as a BES Facility.

The device/Facility is different because it can be physically connected and energized by closing a switch. 

3/18/2014

SERC staff seems to want to see both internal and external assessments.  There seems to be a disconnect between what the SERC personnel are saying it will be used for and how it is actually being used.

SERC is willing to utilize the work of independent evaluators to reduce the audit burden on a Registered Entity.  Independence, as defined in Generally Accepted Government Auditing Standards (GAGAS) (The Yellow Book), can be achieved by either an internal or external independent audit group. SERC evaluates independence and determines how much work of the independent assessment to utilize on a case-by-case basis.

Updated December 4, 2017

Will the audit approach change for Registered Entities that elect not to participate in the ICE? If so, how?

No. Internal controls are reviewed as appropriate during a compliance monitoring activity.

Updated December 4, 2017

Is there an expectation that a Registered Entity have formal controls testing in place prior to the ICE?

ICE is a voluntary process for the Registered Entity.  Registered Entities are not required to have formal controls testing in place. Although, if you have an internal controls program, it is a good practice to test them.

10/31/2014

Can a Registered Entity decide to share only a portion of its internal controls with SERC during the ICE?

Registered Entities may share some, all, or none of its internal controls.

Updated: 1/1/2019

What impact will the inherent risk assessment have on an entity’s audit cycles and future audits? Could this result in some entities having audit cycles that extend greater than six years?

Each registered entity’s inherent risk assessment will help define their compliance oversight plan.  As the ERO moves to a risk-based compliance oversight program, registered entities may have a different compliance oversight plan based on their individual IRA. The ERO Actively Monitored List (AML) of standards and requirements no longer exists; so registered entities are assessed (and your engagement is scoped) against the risks identified in the NERC and SERC CMEP Implementation Plan.

Updated:  1/1/2019

Can the inherent risk assessment change the bright-line criteria for an entity (on a case-by-case basis) for CIP-002?

No. Registered entities are encouraged to perform internal risk assessments and determine potential risk to the bulk power system. However, those internal assessments and/or SERC’s IRA cannot be utilized to “reclassify” a BES Cyber System to a lower impact rating.  The bright-line criteria are used to identify the impact rating of BES Cyber Systems, while the inherent risk assessment is utilized to develop a compliance monitoring plan around those identified systems.

SERC utilizes the information from the IRA questionnaire with the data that SERC has on-hand to complete the entity inherent risk assessment. The priority is on the registered entities that are scheduled for compliance monitoring engagement (audit), but the IRA results will be shared with each entity as they are completed. The results of the IRA are utilized to determine the compliance monitoring tool (on-site audit, off-site audit, Spot Check, guided Self-Certification, self-monitor). Each entity is unique; so the audit scope for each entity has been different. There is no longer an Actively Monitored List, as the IRA results drive the list of Standards/Requirements to be monitored for each entity.

10/31/2014

Is there an appeals process or other method for the Registered Entity to provide additional information that might change the results?

There isn’t an official appeal process.  However, SERC will consider any additional information that the Registered Entity would like to share.

10/31/2014

What steps are being taken to promote consistency in the IRA process between SERC and the other Regions?

The ERO has created an IRA Guidance document.  Also, the ERO is creating, with input from all the Regions, a training slide deck which all Regional personnel who are responsible for conducting IRAs must attend. In addition to the ERO industry sessions, the ERO is conducting numerous training sessions for Regional staff in the next few months.

Updated:  1/1/2019

What inputs will SERC use in determining a Registered Entity’s inherent risk?

SERC utilizes data previously submitted by the Registered Entity, as well as information from the IRA Questionnaire.  That information includes:  the Registered Entity’s unique characteristics (i.e., business organization, reporting structure, Registered Entity operating conditions); Risks identified by SERC’s Reliability Risk Team; previous audit history; compliance history; events analysis; NERC Alerts; and, mitigation activities to address open enforcement actions or previous audit findings. See ERO IRA Guidance.

10/31/2014

Will SERC share the results of the IRA with the Registered Entity? If so, how?

Yes.  SERC will provide a documented summarization of the IRA.

10/31/2014

Who initiates the IRA? 

The Regions initiate the IRA.  It may be based on emerging risks (ERO, Regional, or Registered Entity), compliance history, etc.

Updated:  1/1/2019

Availability and application of self-logging (aggregation)?

Any registered entity may request to begin self-logging by completing the application. SERC staff will review the application and notify the entity whether or not SERC grants permission to begin self-logging.

Updated:  1/1/2019

Is the availability of self-logging of deficiencies by a Registered Entity contingent on its participation in RAI?

SERC will conduct an IRA prior to considering a registered entity for self-logging. A review of internal controls may be a component of that review that can assist SERC in determining if a registered entity qualifies. 

Updated:  1/1/2019

Will SERC offer self-logging to all Registered Entities, or will the Registered Entity need to request this?

Each registered entity must apply for inclusion of the self-logging program.

10/31/2014

If self-logging is not available to all Registered Entities, what criteria will SERC use to decide which Registered Entities can/cannot participate in self-logging?

SERC will utilize the factors established in the ERO Self-Logging of Minimal Issues Guidance Document posted on the NERC website.

10/31/2014

Will self-logging be available for all Reliability Standards and Requirements or just specific ones? If the latter, then by what criteria will SERC decide?

If a Registered Entity is accepted into the self-logging program, it may be for all or just some of the Reliability Standards/Requirements.  The relevant factors evaluated for acceptance into the program will be utilized to determine which Reliability Standards/Requirements the Registered Entity may self-log.

10/31/2014

How often will the Registered Entity need to file deficiency (or aggregation) logs with SERC? How often will SERC review the logs?

Registered Entities should submit the logs to SERC every three months, and SERC will review the logs within 60 days per the triage process at the beginning of the program.

10/31/2014

Will the Registered Entity be expected to discuss each issue individually with SERC prior to entering the issue on the aggregation log?

It is not required to discuss the issue with SERC prior to entering the issue into the spreadsheet unless the Registered Entity is unsure of the risk and has questions. 

With this being a transitional year for Reliability Assurance Initiative (RAI), are there things that are occurring in the audits?  Are audits being completed in a week? How is the implementation of RAI going thus far in 2014?

RAI (currently known at Risk-Based Compliance) implementation includes risk assessment and audit changes that are occurring in preparation of and in carrying out compliance monitoring obligations.  The on-site portion of an audit generally occurs within a week's time.  To allow for this abbreviated time on-site and to minimize the operational impact of time on-site, SERC devotes more time to reviewing documentation in advance of the on-site portion of the audit.  As Risk-Based Compliance has matured the last couple of years across the ERO, entities are generally favorable with this approach.

10/5/2014

Description of the Violation, Issue, or Trend
Another key benefit of SERC’s RAI pilot program has been that it focuses primarily on risks that are ongoing, thus reducing the time spent by Registered Entities and by SERC in handling mitigated Violations.  However, a misconception has arisen that SERC auditors will no longer review mitigated Violations.  This is not the case. SERC will continue to review mitigated Violations, as warranted.  Registered Entities should continue to mitigate Possible Violations as soon as possible and not delay necessary improvements to the reliability of the BES.

Risk Considerations
Failing to realize that SERC auditors will continue to review previously mitigated Violations may result in a Registered Entity not self-reporting when it should have.  Another risk is that SMEs may not be adequately prepared with the appropriate supporting evidence.

Description of Mitigation Activity
Registered Entities should work internally to foster realistic expectations in regard to mitigated Violations.  Management and SMEs must understand that while SERC is most concerned with Violations that are ongoing, previously mitigated violations will also be reviewed, as warranted, during an audit  or other compliance monitoring activities.

10/7/2014

Clarify the expected qualifications of the utility staff involved in performing internal reviews in preparation for taking advantage of RAI during an audit.  If the work papers met the standards of the NERC Auditor Manual -- up to the same standards that SERC's own auditors would use -- does the utility have to have personnel with auditor certifications?

The qualifications spelled out in the Compliance Auditor Capabilities and Competency Guide, which is a portion of the Compliance Auditor Manual,- are intended primarily for the use of the Regions in developing training programs for their own auditors.  The internal or third-party auditors utilized by Registered Entities are not required to adhere to this guide.  While an internal review team that can demonstrate compliance with this guide will likely be viewed as being more credible than a team that does not demonstrate such qualifications, SERC’s review of Internal Audit Reports (IAR) will focus primarily on the quality of the work papers and the independence of the internal auditors.  Auditors are considered independent when their opinions, findings, conclusions, judgments, and recommendations are impartial and viewed as impartial by reasonable and informed third parties.  A good question to ask to determine whether an internal auditor would be considered independent is:  Has the auditor (or anyone to whom the auditor answers) had any involvement in the development, operation, or management of the compliance measures being audited?

As long as the internal audit team can demonstrate independence, and their work papers demonstrate good audit practices (including appropriate sampling and performance evidence), the Registered Entity does not have to have personnel with auditor certifications.

Are there any differences between SERC's Risk-Based Compliance model and those of NERC and the other Regions?

No. SERC’s goal is to have a model that is consistent with the ERO IRA and ICE Guidance, and all other CMEP approach documentation posted on the NERC website. However, each Region’s risk is unique; so certain results from each Region's Inherent Risk Assessment may differ and result in different scopes and monitoring methods. But, the ERO is implementing the same guidance.

For how long will ICE maintain its "voluntary status"?

At this time, ICE will remain voluntary until NERC and the ERO determine otherwise. However, review of internal controls during compliance monitoring activities will continue as a normal part of the monitoring process.

Updated December 4, 2017

If an entity chose not to undertake its own risk-assessment, prepare IARs, or perform other non-mandated elements of Risk-Based Compliance (all of which are expensive or resource intensive efforts), how will that be factored by SERC during an audit?  Would it be viewed negatively in it's culture of compliance or result in a more critical or extensive audit than is currently being performed?

Regional Entities will utilize information available about Registered Entities to assess risk and develop an appropriate audit scope and monitoring methods based upon that risk.  The more information that SERC staff has, the more effectively SERC staff can rely on the Registered Entity’s internal control and management practices to scope and to scale focused monitoring objectives.  In the absence of a reasonable assurance of reliability, the Regional Entity may have to audit more Standards and Requirements for those Registered Entities on which the Regional Entity does not have information available.  This is not to penalize the Registered Entity but  to properly assess its level of compliance and resulting reliability risk. This would not be viewed negatively in a Registered Entity’s culture of compliance assessment.

The SERC audit team will audit based on the NERC Compliance Monitoring Process outlined in the BAL-001-2 Standard. Data required for the calculation of Regulation Reserve Sharing Group Reporting ACE, or Reporting ACE, CPS1, and BAAL shall be retained for a period of three years. The data will also need to be stored in digital format at the same rate Reporting ACE is calculated for a three year period.

December 28, 2017
With BAL-002-2, Most Severe Single Contingency (MSSC) and Reportable Balancing Contingency Event have been defined as shown below.

 Most Severe Single Contingency

The Balancing Contingency Event, due to a single contingency identified using system models maintained within the Reserve Sharing Group (RSG) or a Balancing Authority’s area that is not part of a Reserve Sharing Group, that would result in the greatest loss (measured in MW) of resource output used by the RSG or a Balancing Authority that is not participating as a member of a RSG at the time of the event to meet Firm Demand and export obligation (excluding export obligation for which Contingency Reserve obligations are being met by the Sink Balancing Authority).

If I read this correctly a BA with no firm demand and no export obligation would have no MSSC and, thus, no Reportable Balancing contingency Events. If that is correct only R2 would be applicable to the entity.

I’d like to get SERC’s comments on the above statements to be sure I am not interpreting something differently than SERC. I would also like to know if any clarification exists for export obligation since it is not a defined term.

Background Information

BAL-002-2  Applicability:

4.1. Responsible Entity

4.1.1. Balancing Authority

4.1.1.1. A Balancing Authority that is a member of a Reserve Sharing Group is the Responsible Entity only in periods during which the Balancing Authority is not in active status under the applicable agreement or governing rules for the Reserve Sharing Group.

4.1.2. Reserve Sharing Group

BAL-002-2 R1 states the following;

R1. The Responsible Entity experiencing a Reportable Balancing Contingency Event shall: [Violation Risk Factor: Medium] [Time Horizon: Real-time Operations]

1.1. within the Contingency Event Recovery Period, demonstrate recovery by returning its Reporting ACE to at least the recovery value of:

• zero (if its Pre-Reporting Contingency Event ACE Value was positive or equal to zero); however, any Balancing Contingency Event that occurs during the Contingency Event Recovery Period shall reduce the required recovery: (i) beginning at the time of, and (ii) by the magnitude of, such individual Balancing Contingency Event,

  or,

• its Pre-Reporting Contingency Event ACE Value (if its Pre-Reporting Contingency Event ACE Value was negative); however, any Balancing

  Contingency Event that occurs during the Contingency Event Recovery Period shall reduce the required recovery:

  1. beginning at the time of, and
  2. by the magnitude of, such individual Balancing Contingency Event.

  1.2. document all Reportable Balancing Contingency Events using CR Form 1.

  1.3. deploy Contingency Reserve, within system constraints, to respond to all Reportable Balancing Contingency Events, however, it is not subject to compliance with Requirement R1 part 1.1 if:

  1.3.1 the Responsible Entity:

• is a Balancing Authority experiencing a Reliability Coordinator declared Energy Emergency Alert Level or is a Reserve Sharing Group whose member, or members, are experiencing a Reliability Coordinator declared Energy Emergency Alert level, and
• is utilizing its Contingency Reserve to mitigate an operating emergency in accordance with its emergency Operating Plan, and
• has depleted its Contingency Reserve to a level below its Most Severe Single Contingency

or,

1.3.2 the Responsible Entity experiences:

• multiple Contingencies where the combined MW loss exceeds its Most Severe Single Contingency and that are defined as a single Balancing Contingency Event, or
• multiple Balancing Contingency Events within the sum of the time periods defined by the Contingency Event Recovery Period and Contingency Reserve Restoration Period whose combined magnitude exceeds the Responsible Entity's Most Severe Single Contingency.

The measure M1 states;

Each Responsible Entity shall have, and provide upon request, as evidence, a CR Form 1 with date and time of occurrence to show compliance with Requirement R1. If Requirement R1 part 1.3 applies, then dated documentation that demonstrates compliance with Requirement R1 part 1.3 must also be provided.

Reportable Balancing Contingency Event is defined;

Any Balancing Contingency Event occurring within a one-minute interval of an initial sudden decline in ACE based on EMS scan rate data that results in a loss of MW output less than or equal to the Most Severe Single Contingency, and greater than or equal to the lesser amount of: (i) 80% of the Most Severe Single Contingency, or (ii) the amount listed below for the applicable Interconnection. Prior to any given calendar quarter, the 80% threshold may be reduced by the responsible entity upon written notification to the Regional Entity.

• Eastern Interconnection – 900 MW
• Western Interconnection – 500 MW
• ERCOT – 800 MW
• Quebec – 500 MW

Contingency Event Recovery Period; defined;

A period that begins at the time that the resource output begins to decline within the first one-minute interval of a Reportable Balancing Contingency Event, and extends for fifteen minutes thereafter.

Balancing Contingency Event, defined

Any single event described in Subsections (A), (B), or (C) below, or any series of such otherwise single events, with each separated from the next by one minute or less.

A. Sudden loss of generation:

1. Due to
   1. unit tripping, or
   2. loss of generator Facility resulting in isolation of thegenerator from the Bulk Electric System or from the responsible entity’s System, or
   3. sudden unplanned outage of transmission Facility;
2. And, that causes an unexpected change to the responsible entity’s ACE;

B. Sudden loss of an Import, due to forced outage of transmission equipment that causes an unexpected imbalance between generation and Demand on the Interconnection.

 C. Sudden restoration of a Demand that was used as a resource that causes an unexpected change to the responsible entity’s ACE.

SERC Response

As a generation only Balancing Authority with no firm load obligations, you are obligated, as demonstrated in the diagram below, to balance your power generated or purchases with sales (either firm or non-firm). These sales are your export obligation. It is SERC’s opinion that Requirement 1 of BAL-002-2 is applicable to a generation only Balancing Authority.

BAL-003:  If an entity loses a unit that causes a BAL-003 event and that event is chosen for reporting, is the entity that caused the event still required to meet the FRM for that event; or can they be exempt?

Frequency Response Measure (FRM) (as calculated and reported in accordance with Attachment A) is an annual requirement; there is not an exemption. If a Responsible Entity had a Reportable Balancing Contingency Event, BAL-002-2(i) Disturbance Control Standard (DCS), the Responsible Entity shall recover per the standard.

What is the process for making notification to the ERO? How much of a load or gen change is needed to trigger notification?

The language in the RSAW following this question states that this “is for information purposes to assist the auditor in understanding if there should have been a corresponding change in the frequency response obligation, not to assess compliance with Requirement R1.” Further down in Attachment A of the Standard there is some additional language that states the entity is encouraged to reach out to the ERO Resource Subcommittee (RS) to inform of resource/load changes. These values are used by the RS to assign Frequency Response Obligations (FRO) per annum. This would be the same mechanism for informing the RS to make considerations for changing FROs or Frequency Bias Settings.

Essentially, the ERO does not use this information to assess compliance directly, but uses it to provide more information for the auditor to understand changes to the metrics used to assess compliance; in this case the FRO.

SERC is neutral on this issue. However, to demonstrate compliance with Requirement R3, the Balancing Authority shall have evidence such as dated documents or other evidence in hard copy or electronic format showing the frequency metering equipment used for the calculation of Reporting ACE had a minimum availability of 99.95% for each calendar year and had a minimum accuracy of 0.001 Hz.

Per the standard, the information is required for each calendar year; therefore, documented data for the system used to calculate Reporting ACE has a minimum availability of 99.5% must be available for the entire audit period.  SERC will use the NERC Sampling Guide which is part of the NERC Compliance Monitoring and Enforcement Manual Version 4.0 for sampling data if necessary.

Response:
In order to meet this requirement you must demonstrate the values for ACE Telemetry come from a common source to both BAs and provide documentation of how the megawatt-hour values are time synchronized. PTs, CTs, and meters must be common and RTU’s time synchronized for the proper megawatt-hour values.

The NERC glossary definition of PACS mentions cyber assets (plural) as achieving compliance with CIP-006-6 R1, so if the SAN is one of the BES Cyber Assets which in combination is used to “…control, alert, or log access to the Physical Security Perimeter(s), exclusive of locally mounted hardware or devices at the Physical Security Perimeter such as motion sensors, electronic lock control mechanisms, and badge readers,” then it would be part of the PACS and subject to the standards, requirements, and requirement parts where it falls under the Applicability column.

Yes. FERC published the following determination in the October report on lessons learned from CIPv5 audit activity by FERC-led teams, “To determine whether a generation Control Center or back-up Control Center meets the 1500 MW threshold, the MW capacity of both BES generation and non-BES generation are considered” (FERC, 2017 Oct 6, 2017 Staff Report, p. 10).

That is correct.

The auditor will require enough information to be able to locate the asset.

Prior exclusion for not having Critical Assets in the version 3 standards is not a consideration for exclusion from CIP-002-5.1a or the other CIP standards. Registered entities meeting the criteria in section 4 “Applicability” of CIP-002-5.1a must implement a process to demonstrate compliance with CIP-002-5.1a.

Non-BES “facilities” (Lower case “f”) and Non-BES “Facilities” (Upper case “F”) are out of scope. This is due to the applicability requirements. Refer to “Facility” definition in the NERC Glossary of terms and “Section 4” and “Attachment 1” (pages 23 - 33) of the CIP-002-5.1 Guideline and Technical Basis.

The question is not whether the relays operate independently of the EMS, but rather whether the multiple relays coordinate with each other (i.e., operate as a coordinated load shedding system) that can trip more than 300 MW of load.  If the relays do not coordinate, i.e., they are separate and autonomous, then they do not meet the criterion; however, if they coordinate their actions or have common inputs, then they may meet the criterion.

Registered entities should apply CIP-002-5.1a to all assets and facilities that meet Section 4 Applicability of the CIP-002-5.1a standard.

It is a best practice to document the assessment for all assets and facilities that are considered possible candidates as part of the BES. This documentation can provide information for auditors explaining why facilities may be excluded from the BES.

Note that lack of remote operation is not a consideration for exclusion from the BES or the CIP requirements. BES facilities with no remote capability can still be an asset with Low or Medium BES Cyber Systems. In most generation facilities, the Distributed Control Systems (DCS) qualify as BES Cyber Assets/Systems, even if they are not connected to a SCADA system.

Yes, if it meets the Impact Rating Criterion of Section 2 - Medium Impact Rating (M).

More detail is required for a definite answer. For example, if the distributed control system has only one input that is common to all parts of the system, it could be viewed as a common control system.

Assuming that there are no common components or inputs of the distributed control system, then it would not apply. If all the elements are below 100 kV, they are not considered BES Elements and, therefore, not subject to the CIP Standards unless subject to the 4.2.1.1.2 inclusion.

CIP-002-5.1 Attachment 1 Medium Impact Rating Criteria
2.10. Each system or group of Elements that performs automatic Load shedding under a common control system, without human operator initiation, of 300 MW or more implementing undervoltage load shedding (UVLS) or underfrequency load shedding (UFLS) under a load shedding program that is subject to one or more requirements in a NERC or regional reliability standard.

CIP-002-5.1 Attachment 1 Low Impact Rating Criteria
3.6. For Distribution Providers, Protection Systems specified in Applicability section 4.2.1 above.

CIP-002 V5 R1 and Section 2.6 (Attachment 1): Which functional entity (TP, PC, RC) determines the identification of the transmission facility as a medium impact BES cyber system? The TP/PC, due to the time horizon considered, do not identify the IROL; but are the asset owner of the transmission facility.  (The RC is not the owner).

Each entity audited for compliance will need to provide thorough evidence of communication with all parties involved to provide some final determination by one of the parties of the impact rating for the particular Transmission Facility. This communication should address the various determinations and responsibilities as applicable for each Transmission Facility for which this determination is necessary.

Section R1.2 states for assets identified in CIP-002 as containing low impact BES Cyber Systems, each entity shall review and obtain CIP Senior Manager approval at least every 15 calendar months for one of more documented cyber security policies that address:

1.2.1 Cyber security controls (effective 4/1/17)

1.2.2 Physical security controls (effective 4/1/17)

1.2.3 Electronic access controls for Low Impact External Routable Connectivity and Dial-Up Connectivity (effective 4/1/17)

1.2.4 Cyber Security incident response (effective 4/1/17)

Section R2 states each entity with at least one asset identified in CIP-002 containing low impact BES Cyber Systems shall implement one or more documented cyber security plans for its low impact BES Cyber Systems per attachment 1.

Section 1 – Cyber security awareness – reinforcement of cyber security practices every 15 months (effective 4/1/17)

Section 2 – Physical Access Controls – Control of physical access to the asset (effective 1/1/20 with CIP 003-7)

Section 3 – Electronic Access Controls (effective 1/1/20 with CIP 003-7)

Section 4 – Cyber Security Incident Response (effective 4/1/17)

My question is what is the difference between just having a documented cyber security policy versus implementing cyber security plans?

A cyber security policy is a high level over-arching document either reiterating the standard and requirement to be met or similar verbiage stating the responsible entity shall perform or meet certain levels of compliance as stated in the CIP Standards. Per the Rationale for Requirement R2 as written in CIP-003-6, “One or more security policies enable effective implementation of the standard's requirements. The purpose of policies is to provide a management and governance foundation for all requirements that apply to personnel who have authorized electronic access and/or authorized unescorted physical access to low impact BES Cyber Systems. The Responsible Entity can demonstrate through its policies that its management supports the accountability and responsibility necessary for effective implementation of the standard's requirements by CIP Senior Manager approval of the policies specified in Part 2.1.”

A plan is a lower level document providing information as to who will do what, when, and how to meet the requirement as set forth in the policy document. Plans may have lower level procedure documents providing more details, breaking down the stages in the plan into steps or tasks to be performed to accomplish the plan.

An example: CIP-003-6 R1.2 requires a responsible entity having an asset containing low impact BES Cyber Systems to document a cyber security policy for cyber security awareness under R1.2.1. Requirement 2 states the responsible entity must implement one or more documented plans that include the applicable elements in Attachment 1.

A cyber security policy statement might read, “Acme Power shall provide Cyber Security Awareness reinforcement to all authorized persons having access to low impact BES Cyber Systems at least once every 15 calendar months.”

A cyber security awareness reinforcement plan might read, “Acme Power shall provide Cyber Security Awareness reinforcement to all authorized persons having access to low impact BES Cyber Systems at least once every 15 calendar months. This will be accomplished via the following methods: direct communications, indirect communications, and management support. Regarding direct communications, Acme Power shall send quarterly emails to all authorized persons with a known email account regarding some aspect of cyber security. Regarding indirect communications, posters portraying some aspect of cyber security shall be hung within each identified area housing low impact BES Cyber Systems and rotated on a quarterly basis. Regarding management support, all safety meetings and training sessions shall include a cyber security awareness topic to be presented.”

A cyber security awareness reinforcement procedure might read, “The Manager of Transmission shall be responsible for hanging cyber security awareness posters within areas housing low impact BES Cyber Systems. Posters shall be hung in a prominent place so that all who enter would be most likely to see it. Posters shall be changed out on a quarterly basis among the various locations across the company. When a new poster is hung, a dated photograph shall be taken showing the poster and its surroundings as evidence of the reinforcement. Photographs shall be stored in the Evidence Server under Cyber Security Awareness.”

When monitoring is used as a physical security control at a low impact location for standard CIP-003-6 Attachment 1 Section 2, should entities maintain evidence/logs of the monitoring for 90 calendar days, as in CIP-006-5 R1.9, or for the entire compliance period to provide to internal and ERO auditors? What are other examples of what will be requested to show implementation of these controls?

The 90 calendar day limit deals with logging of access by authorized personnel or of visitors. However, because SERC tends to only sample events and incidents for a 90-day period just prior to an audit, monitored alarm events could be kept for this same time period. The policies, procedures, and system configurations that support logging must be maintained throughout the compliance monitoring period. It should be noted that reportable incidents per CIP-008 R2 require that all pertinent information be retained for three calendar years.

CIP-003-6 – Attachment 1
Section 2.

Physical Security Controls: Each Responsible Entity shall control physical access, based on need as determined by the Responsible Entity, to (1) the asset or the locations of the low impact BES Cyber Systems within the asset and (2) the Low Impact BES Cyber System Electronic Access Points (LEAPs), if any.

Question: Does this require a log (physical or electronic) of individuals who physically access the “Low” assets?

Yes, CIP-003-6 is applicable to all BES Cyber Assets, and all BES Cyber Assets are part of at least one BES Cyber System.

From NERC Glossary:
BES Cyber Asset: A Cyber Asset that if rendered unavailable, degraded, or misused would, within 15 minutes of its required operation, misoperation, or non‐operation, adversely impact one or more Facilities, systems, or equipment, which, if destroyed, degraded, or otherwise rendered unavailable when needed, would affect the reliable operation of the Bulk Electric System. Redundancy of affected Facilities, systems, and equipment shall not be considered when determining adverse impact. Each BES Cyber Asset is included in one or more BES Cyber Systems.

The examples in CIP-003-6 Attachment 2, Section 3 list “access control on the BES Cyber System” as an example of authentication for Dial-Up Connectivity.  Many Cyber Assets utilized in industrial control systems are capable of providing password/passcode authentication, but are not capable of using any type of user or system account in conjunction with a password/passcode. 

If Dial-Up Connectivity to a low impact BES Cyber System is authenticated through the use of passwords (but not in conjunction with any type of account) as the sole challenge authentication, would SERC consider this to be a sufficient means of authentication to meet the requirements of CIP-003-6 Attachment 1, Section 3, 3.2?

At this point, dial-up authentication for low impact assets does not come into effect until January 1, 2010. Currently, SERC’s stance is that it applies “per device capability.”

Does the phrase imply that the registered entity’s Security Awareness Program only needs to target employees of the registered entity who have authorized electronic or unescorted physical access to High or Medium impact BES Cyber Systems?  It appears that, under V5, the SDT removed the registered entity’s obligation (as opposed to V3) to have multiple awareness programs to provide awareness to contract personnel who may not have access to direct communications (i.e., emails, memos, computer‐based training); or indirect communications (i.e., intranet); or management support and reinforcement (i.e., presentations or meetings) when any of these methods are incorporated into the awareness program.
As noted in the Measures section, compliance requires “documentation that the quarterly reinforcement has been provided.” The guidance states “[t]he Responsible Entity is not required to provide records that show that each individual received or understood the information, but they must maintain documentation of the program materials utilized in the form of posters, memos, and/or presentations.”

Can an entity define the training requirements specific to access type (physical or electronic)?

Yes, a Registered Entity can define specific training requirements pursuant to access type. A Registered Entity will need to ensure that all training modules associated with that access type are obtained before access is granted and at least once every 15 calendar months for continual access. Example: If there are three modules needed for an access type, all three will need to be completed prior to being granted access.

I am seeking guidance or examples on the level of separation required between the network(s) the BES Cyber Security policies and procedures are currently stored and the Corporate Network and associated Corporate IT staff.

The BES Cyber Security policies are located on a secure network location(s), but the Corporate IT staff has “God Rights” to these network(s) as part of their job duties as assigned to support the Corporate network. The Corporate IT staff is not currently subject to any NERC compliance requirements and are not familiar with NERC in general since they only support the Corporate Network.

Per the BES Cyber System Information definition, we are of the understanding that the BES Cyber Security policies and procedures would have to be stored in a separate location to prevent the Corporate IT staff from having any access.  If the BES Cyber Security policies and procedures are to remain on the Corporate Network, would the Corporate IT staff be subject to the NERC training requirements and access revocation timelines as specified?

Within CIP-011-1 R1.1, the registered entity is required to establish methods to identify information that meets the definition of BES Cyber System Information. Under CIP-011-1 R1.2, the registered entity is instructed to implement procedures for protecting and securely handling BES Cyber Security Information. Using the definition of BES Cyber System Information that will become effective on April 1, 2016 (refer to the Glossary of Terms Used in NERC Reliability Standards; dated March 3, 2015), the registered entity would be required to properly determine and support the decisions on what information is considered BES Cyber Security Information.  Policies and procedures (what level of information they contain and how it is documented) will vary from entity to entity and from program to program. Some registered entities may include information in policies and procedures that is detailed or specific enough to its program, systems, architecture, and/or network that the information would be sensitive and could pose a threat to the BES if it found its way into the wrong hands.  Other registered entities keep policies high-level enough that they contain no sensitive information to cause or pose impact to the BES, even when considered in conjunction with all policies and procedures under CIP. The approach for this requirement is specific to the registered entity and to the program developed to meet compliance.  If a registered entity’s policies and procedures (when considered collectively) do not contain sensitive information that could pose a threat or could be used to allow unauthorized access to BES Cyber Systems, then it would not be in scope for protections cited in CIP-011-1 R1.2. If the policies and procedures do contain sensitive information, then they would be in scope for Information Protection.

As a side note, if a registered entity chooses to keep policies and procedures devoid of operational specifics or details, there will be a level of documentation below these that does get into specifics and details that are required for operational effectiveness. These documents, however they are stored and used, and whatever they are called, would be subjected to Information Protection as required in CIP-011-1 R1.3/18/2015

Yes, unescorted physical access to the physical host would need to meet the Requirements of CIP-004-6 R3.2 if the virtual PACS are associated with a high impact BCS located in a separate physical location.  CIP-004-6 R2.3 states that it is associated with High Impact BES Cyber Systems and their associated PACS; it does not distinguish if they are virtual. Also, there is the risk that, if someone were to gain access to the physical host, they would have access to all virtual machines located on the said physical host. So, that physical host should be protected at the highest level of associated items on the said physical host.

CIP-004-6 R5.2 specifies that for transfers, access must be revoked by the “end of the next calendar day following the date that the Responsible Entity determines that the individual no longer requires retention of that access.”  Knowing that transfers are still employees with passing PRAs and adequate CIP training, the risk against compromise that could lead to misoperation or instability in the Bulk Electric System (BES) from these transferred individuals accessing BES Cyber Systems after a transfer is assumed to be low risk.

Based on this assumption of low risk threat, can SERC provide an opinion about how much time would be considered too great an amount of time to pre-determine the individual no longer needs access?  For example, if an entity predetermined 6 months to be acceptable to keep access intact such that the access must be revoked by the end of the next calendar day following the pre-determined 6 months, would SERC find the entity’s predetermined 6 months to be an acceptable time limit for revoking access for transfers? Is there a particular range of time that SERC feels could be acceptable?

The entity is responsible for documenting the need for the employee to retain the access so there is not a specific number of days that will be acceptable, rather the entity should document the actual need for the employee to have access. SERC expects that if access is no longer being used, then it is not required unless there is a well-documented business need for the access. The documentation should clearly justify why access is required but is not being used.

An Electronic Access Point (EAP) protects the Electronic Security Perimeter (ESP) via routable protocols that provide the capability of examining the communication traffic inside and outside the ESP.  A layer 2 protocol bypasses the established security controls provided by the Firewall EAP which protects BES Cyber Systems and Cyber Assets from potentially harmful attack vectors.

Because layer 2 communications between Cyber Assets outside with those on the inside eliminates the protection needed that may impact the reliability of the Bulk Electric System (BES) and because the NERC ERO and the Standards Drafting Team has not published an acceptable method or solution for how the ESP should be minimally protected, the implementation of layer 2 bypassing the ESP is currently not recommended.  If you are considering the implementation of layer 2 communications that bypasses the security currently afforded by an ESP, consider the following:

• Document the business purpose for the use of layer 2 and reasons for bypassing secure established protocols
• Identify the Layer 2 protocol being considered
• Identify all potential attack vectors and method of protection to determine or apply a Risk Based Analysis of those vectors
• Describe the type of communications occurring both inbound/outbound from the protected BES Cyber Systems and Cyber Assets
• Describe how the BES Cyber Systems and Cyber Assets within an ESP would be protected should an attack occur
• Use a network diagram to design, document and articulate how the communications paths between all network equipment and protocols used to communicate both inside and outside the ESP will occur
• Document all contingency processes and describe how Layer 2 would be monitored

The above considerations are not all-inclusive. These are only a starting point for documenting a justification and making the determination of using a non-routable protocol that currently bypasses the security afforded by an Electronic Access Control or Monitoring Systems that protects the reliability of the BES.

1. Policy statement requiring multi-factor authentication and
2. Any applicable procedures that affect multi-factor authentication and
3. Configuration and procedure data showing that all IRA connections require multi-factor authentication and
4. Evidence of execution of the process including a demonstration of the process

CIP-005-5 R2.3 – Multi-factor authentication for interactive access: If a registered entity uses an application on their smart device to generate an authentication code, does the smart phone need to be protected as part of the intermediate system?

Examples of additional authentication factors that are typically employed to achieve multi-factor authentication include devices such as smart cards and hardware tokens. These would be considered stand-alone devices, and would not be brought into scope as part of the intermediate system. By extension, this would also be true of the smart phone described in the question, since the described application would fulfill the same role as a hardware token. Entities should keep in mind that smart phones are highly targeted by cyber threat actors; and should, thus, be secured accordingly. However, in this example, the smart phone does not fall into CIP purview as an intermediate system.

Note that if the dial-up connection provides Interactive Remote Access, then CIP-005 Requirement 2 will also apply.

CIP-005 R1.5 is about Electronic Access Contol and/or Monitoring Systems.  Can SERC confirm that this means "electronic access control and/or electronic access monitoring", as is clarified in the accepted definition of EACM in V5?

The "Applicable Systems" field of CIP-005 Part 1.5 states that this requirement part is about Electronic Access Points. Accordingly, the relevant definition in NERC's Glossary of Terms is the definition for Electronic Access Point.

Let’s start with some definition from the NERC Glossary of Terms to answer the question:

Physical Access Control Systems (PACS) are defined as Cyber Assets that control, alert, or log access to the Physical Security Perimeter(s), exclusive of locally mounted hardware or devices at the Physical Security Perimeter such as motion sensors, electronic lock control mechanisms, and badge readers.

Physical Security Perimeter (PSP) is defined as the physical border surrounding locations in which BES Cyber Assets, BES Cyber Systems, or Electronic Access Control or Monitoring Systems reside, and for which access is controlled.

From the definitions above, we can see that the access control panel (ACP) is controlling access to the guard house; but because it does not contain any BES Cyber Assets, BES Cyber Systems, or Electronic Access Control or Monitoring Systems, it does not meet the definition of a PSP, hence it does not meet the strict definition of PACS.

Per CIP-006 R1.1, the entity would need to define the operational or procedural controls to restrict physical access to PACS associated with high impact BES Cyber Systems or medium impact BES Cyber Systems with External Routable Connectivity.

The ACP controlling access to the guard house would not be a CIP PACS cyber asset since this room contains no BES Cyber Systems or BES Cyber Assets. This would be a corporate PACS cyber asset.

A dedicated PACS workstation located within this room or building would be a CIP PACS cyber asset, if alarm monitoring and access logging of CIP PSP physical access points are displayed and acted upon at this monitor position. If this workstation only has alarm and access information for non-CIP physical access points to buildings and grounds, it would not be a CIP PACS cyber asset. If it is CIP PACS, the entity would need to include operational or procedural controls to restrict physical access to the workstation, not to the room or building. The ACP controlling guard house card readers and those associated card readers would be corporate PACS devices.

If the PACS is browser based and requires a logon to the PACS application by an authorized individual but the workstation is used for other applications also, the workstation would not be considered as a CIP PACS cyber asset. This would be the same as every other workstation connected to the same network.

Description of the Violation, Issue, or Trend
The responsible entity did not include or implement a visitor control program in its physical security plan, or it does not meet the requirements of continuous escort.

Risk Considerations
Unauthorized or unsupervised individuals could access sensitive information and systems within the physical security perimeter.

Description of Mitigation Activity
Implement a visitor control program that incorporates logging of access and exit and incorporates a continuous escort within the physical security perimeter.

Other Factors or Comments
This is a best practice for visitor pass management. The visitor is assigned a bright green badge with a number. The escort then takes the corresponding bright yellow half badge with the same number to indicate which visitor he/she is escorting. The escort can clip on multiple yellow half badges for escorting more than one visitor. At a glance you can recognize which visitors are being escorted by which entity personnel. In the event there is an escort hand off, the new escort would receive the smaller yellow clip-on badge(s) from the original escort.

Are there additional resources or guidance for the types of controls to restrict physical access for the Medium Impact BES Cyber Systems without External Routable Connectivity and PACs applicable to CIP-006-5 R1.1 which do not reside within a PSP? The measures section only mentions providing documentation that these controls exist.

Please note the following are examples of what has worked for other organizations.  A Physical Access Control System (PACS) server that is configured and maintained by authorized personnel that utilizes a documented procedure to grant and review access can be used to restrict access.  In addition, utilize a visitor management procedure that requires sign in, identification tagging, and active escorting within restricted areas. A detective control would utilize alarm systems to alert for forced open, held open, or unauthorized entry.

In this example the documented physical security plan defined physical access controls as card keys, mechanical keys, security personnel, and other authentication devices (keypad or biometrics). Additionally, monitoring and logging of physical access are in place and working.

CIP-006-6:  Is a Cyber Asset that is only used to log visitor access to a PSP considered a PACS asset?

A Cyber Asset used only to record visitor access should not be considered a PACS.

The questions relates to the handling of guests or visitors.  Can an Entity write procedural controls to allow guest entry into the areas with just someone providing them access?  Would a guest/visitor log be expected? Would escorting be expected?  The standard is not very clear on handling access to 1-time guests.

There is no requirement per the wording of CIP-006-6 Part 1.1 to restrict physical access to any certain authorized group or to require that any other persons be restricted or escorted. It is up to the entity to document how they will restrict physical access to these BES Cyber Systems. The document should include, but not limited to, a discussion regarding:

• Who the entity deems to have authorized physical access to these BES Cyber Systems and who would be restricted from physical access;
• For those restricted from physical access, how the entity plans to grant them temporary access;
• Whether escorting of those not normally authorized should be required and performed by whom;
• Whether logging of those the entity deems authorized and those they deem not authorized needs to occur and, if so, by what means,
• How access is to be restricted, either by electronic means such as via a PACS or keyless entry system or via mechanical means such as keys; and
• If using keys, whether said physical access points should have special keys or standard keys and whether the keys should be “restricted” through a check-out process or distributed to anyone deemed authorized.

CIP-006-6 Part 2.2 requires manual or automated logging of visitor entry into and exit from the Physical Security Perimeter and CIP-006-6 Part 2.1 requires continuous escorted access of visitors and BES Cyber Systems; however, those requirements are not applicable to BES Cyber Systems without ERC.

Note that not all applicable patches must be installed, so the entity may choose to create a mitigation plan.

In the example cited, short and simple passwords are clearly a vulnerability, so increasing the complexity and length of the passwords on the system does make the system less vulnerable. If the patch allows the entity to retire a TFE, that would be a patch that should be considered for installation rather than just mitigated.

CIP-007-5, Table R4, Requirement 4.2.2
“Detected failure of Part 4.1 event logging.”

1. I do not see anything under “Measures” that defines what is expected.
2. Is this on a “per device” or a general logging function?
3. Is this covered by fulfilling 4.4 or is it an automated function, and if so how often?

I’m not sure what is required, how often it is required, or how to fulfill the requirement.

CIP-007-5 Part 4.1 requires that registered entities use event logs, while Part 4.2.2 requires that an alert be generated if that logging fails. Part 4.4 requires a periodic review of a summarization or sampling of logs; this is neither frequent enough nor comprehensive enough to serve as an “alert.” For all practical purposes, Part 4.2.2 may need to be addressed by an automated function.

Part 4.1 allows the option of logging at the BES Cyber System level or the Cyber Asset level. Accordingly, the registered entity should document whether they are implementing Part 4.1 on a “per device” basis or utilizing a central log server. Once the registered entity has documented this, the entity will need to implement Part 4.2.2 at the same level(s). Most registered entities employ logging at both levels; i.e., individual devices generate and store logs locally (Cyber Asset level) while also forwarding log entries to a log server (which may be at a BES Cyber System or broader level).

An example measure at the Cyber Asset level might be a script that runs periodically to verify that the local logging service is still running. An example measure at the BES Cyber System level could be a “heartbeat” service, whereby a central log server is configured to recognize when it stops receiving logs from an individual device. A good example measure for either level would be an automatically generated email that alerts system personnel to a detected logging failure.

Due to differences in entity logging practices and in the amount of activity on individual devices, the threshold at which failure might be detected (and thus the frequency at which automated checks should occur) could be as little as a few minutes or as long as several days.  As such, SERC cannot define how often these checks should occur. Each registered entity must evaluate their Cyber Assets / BES Cyber Systems to determine the appropriate threshold(s) for their own environment.

Are CIP Exceptional Circumstances to a PSP expected to be shown in the Visitor log?

What format should the reports use? 

To whom at SERC should they be addressed?

The "at the time of occurrence" reports - not the documents for audit evidence.

There is no requirement to "report" the CIP exceptional circumstance - at the time of occurrence. However, the registered entity should adequately document the CIP exceptional circumstance and be prepared to provide the documentation to the auditors. The documentation should include, but is not limited to, the start and stop times and details surrounding the issue.

Description of the Violation, Issue, or Trend
Recovery plans focused on disaster recovery do not meet the requirement of CIP-009 which is focused on device recovery. While redundancy and automatic failover to backup assets or sites provide disaster recovery, that process does not provide recovery of individual assets. This is a good way to find any deficiencies or undocumented parts of the recovery plan and procedure.

Risk Considerations
Recovery of individual assets, if not clearly documented, may not be executed properly when needed, especially in a major event when multiple assets are lost. This could greatly increase the time required to recover to the base situation where all assets (both primary and backup) are available.

Description of Mitigation Activity
Ensure that the recovery plans include procedures to recover individual assets. These procedures should either address each asset individually or address each class of asset. They should include how to obtain replacement parts (relevant contracts, purchase orders, approvals required), which roles are required (who initiates the recovery, purchase order approval, communication to operations on restoration, change ticket creation and approval, testing prior to installation, documentation of events, lessons learned), and any relevant localized information. For example, there may be a central spare parts location, but for some assets (remote substations are one example), it may take longer to get the parts from the spare parts location to the site. That should be documented in the recovery plan and in the recovery procedure for those assets and both the plan and the procedure should account for that time in the expected recovery duration.

Other Factors or Comments
Quote from an Entity RSAW

"Auditors noted an Area of Concern with the recovery process since it did not clearly address all information needed for the recovery. While the recovery plans include high level information that is required, they did not include details on parts of the recovery such as how to obtain replacement parts, who is responsible to obtain the spare parts (and any procurement sign offs), vendor contracts for spare parts or support, change management requirements during a recovery, roles for recovery approvers, coordination of the recovery with system operations and how the expected duration of the recovery is determined."

Description of the Violation, Issue, or Trend
Recovery plan testing is often done only at a very high level.

Risk Considerations
Recovery of individual assets, if not adequately tested, may not be executed properly when needed, especially in a major event when multiple assets are lost. This could greatly increase the time required to recover to the base situation where all assets (both primary and backup) are available.

Description of Mitigation Activity
One approach that works well is to have someone technically qualified but outside the CIP organization attempt a recovery. This removes the tribal knowledge and forces the recovery to use the actual, documented procedure.

Other Factors or Comments
Quote from and Entity RSAW

"shows a description of how the entity exercises their recovery plan but it does not include recovery of individual assets as specified in the requirement."

"provides entities evidence of a 2015 recovery exercise, including agenda, participant list, exercise (not detailed) and restore types. It does not include a scenario describing the event, specific equipment affected or procedures to recover specific assets or lessons learned."

September 28, 2016
CIP-010 Attachment 1, Section 3.2.2 states, “Mitigate the threat of detected malicious code on Removable Media prior to connecting the Removable Media to a high impact or medium impact BES Cyber System or associated Protected Cyber Assets.” 

As further guidance within the Guidelines and Technical basis for Requirement R4, Attachment 1, Section 3 – Removable Media, it states: “Frequency and timing of the methods used to detect malicious code were intentionally excluded from the requirement because there are multiple timing scenarios that can be incorporated into a plan to mitigate the risk of malicious code.” 

While this guidance and flexibility is appreciated, it also raises the question of what SERC would consider “acceptable” frequency and timing for detection of malicious code when the Removable Media may be used throughout BES and non-BES facilities.  For example, when providing support to remote facilities (e.g. substations, switchyards, etc.), it is not atypical to require use of Removable Media within multiple locations over an average workday, which each may be separately categorized as containing Medium Impact BES Cyber Systems, Low Impact BES Cyber Systems, or a non-BES facility.  As a standard practice to address this requirement, malware scanning of Removable Media may only occur at a central facility once each morning or week prior to using the Removable Media at these locations. 

As such, we are requesting clarity from SERC regarding what would constitute sufficient mitigation controls for the Removable Media used at these facilities.  For example, if the Removable Media is scanned once each morning or week, but then used at multiple BES and non-BES facilities throughout the day, does SERC agree that this scan would suffice to meet the requirement?  Or, is the expectation from SERC that a sufficient frequency would only consist of an individual malware scan prior to use at each individual High or Medium impact BES Cyber System or BES Cyber Asset? 

Additionally, if the specific frequency is solely up to the discretion of the entity, is it SERC’s contention that providing an entity uses a method to detect and mitigate malicious code on Removable Media at some point prior to connecting the Removable Media to a BES Cyber Asset, then the requirement is meet?

Is the answer the same for transient assets?  Particularly, how frequently do anti-virus scans need to be run … daily, before each use?  For how long is an authorization valid?

The threat of malicious code on Removable Media shall be mitigated prior to the registered entity making a connection with a high impact or medium impact BES Cyber System or associated Protected Cyber Assets.

We are trying to determine if a laptop employed in the following way would be classified as a “transient cyber asset”:

The laptop is normally plugged into the “low impact” rated power plant DCS system for more than 30 days. The laptop is used by the plant DCS engineers to monitor and maintain the DCS network. Occasionally, the laptop is disconnected from the network connection, and is used to access a network PLC through a serial port to provide updates or changes that can only be accomplished when connected through the serial port. When the tasks are completed on the network PLC the laptop is returned to its original location and reconnected to the plant DCS. It is never connected to a network outside of the referenced DCS.

Our assumption is that, when using the laptop only in the manner described above, that the laptop is not a “transient cyber asset” just because it is physically moved and connected to the same DCS through the serial port. Please advise.

If the laptop mentioned is already declared as a BES Cyber Asset given its “normal” usage, then it couldn’t also be a TCA – per the TCA definition (“A Cyber Asset that (i) is capable of transmitting or transferring executable code, (ii) is not included in a BES Cyber System)..”

If the laptop is not declared a BES Cyber Asset, it is a TCA.  When the laptop is moved and momentarily connected to the network PLC, from the perspective of that network PLC (not the original DCS) it meets the TCA definition:

• A Cyber Asset that
  1. (i) is capable of transmitting or transferring executable code,
  2. (ii) is not included in a BES Cyber System,
  3. (iii) is not a Protected Cyber Asset (PCA), and
  4.  (iv) is directly connected (e.g., using Ethernet, serial, Universal Serial Bus, or wireless, including near field or Bluetooth communication) for 30 consecutive calendar days or less to a BES Cyber Asset (in this case the network PLC), a network within an ESP, or a PCA.

Examples include, but are not limited to, Cyber Assets used for data transfer, vulnerability assessment, maintenance, or troubleshooting purposes.

The registered entity does not need to identify the defined business function for every executable on a Transient Cyber Asset.  Follow the same guidance as CIP-010-2, R1.

CIP-010-2 does not prescribe any specificity as to how long a vulnerability assessment should take to complete; only that the components must all be completed within 15 months (for R3.1) or 36 months (for R3.2).  The four components of an active vulnerability assessment (as listed in the Guidelines & Technical Basis), thus need not occur all at once. Rather, performance of the four components may be spread across the 15- or 36-month timeframe dictated by the applicable requirement part.  However, this approach cannot be used as a way to extend the compliance deadlines.  All components (not merely a subset) of a vulnerability assessment must be completed by the published implementation date for the applicable requirement part (July 1, 2017 for R3.1; and July 1, 2018 for R3.2).

For more insight as to what the vulnerability assessment should address, SERC recommends reviewing FERC Order No. 706 and its associated Notice of Proposed Rulemaking.

A question was raised in our organization, regarding a BES Cyber Asset. Our operational team brought up the existence of a BES Cyber Asset containing a built-in tape backup, which makes the “built-in” part, not a transient device. However, the specific question is… Does the [physical] tape constitute a removable media? If so, would it require the corresponding CIP protections as stated in the guidelines and technical basis?

Physical tape cartridges constitute Removable Media as defined in the Glossary of Terms Used in NERC Reliability Standards, as long as the physical tape resides in the tape drive for 30 consecutive calendar days or less. As defined in the NERC Glossary, Removable Media is storage media that:

(i) are not Cyber Assets – (SERC notes the tape cartridge is not a Cyber Asset)

(ii) are capable of transferring executable code, - (Tape is indeed capable of doing so)

(iii) can be used to store, copy, move, or access data, and – (Tape is indeed capable of doing so)

(iv) are directly connected for 30 consecutive calendar days or less to a BES Cyber Asset, a network within an ESP, or a Protected Cyber Asset. – (SERC assumes the Entity is rotating the tapes on a weekly basis.)

When documenting baseline configuration of the asset, it is important to document unique configuration attributes of the asset.

As an example, for windows 7, “OS” can be listed as – “Windows 7 Professional” or “Windows 7 Enterprise”. “Version” of the OS, depending on the service pack level, can be listed as “Windows 7 - 6.1.7600” or “Windows 7 SP1 - 6.1.7601”.

Updated December 28, 2019
CIP-010-2 R1.3:  When does the 30 days start for CIP-010 R1.3? Is it when a change request (what starts the change) is closed, the day changes are complete on a BES Cyber System as a whole, or when a change is complete on an individual BES Cyber Asset of a BES Cyber System?

According to the Applicable Systems section, this requirement applies to the BES Cyber Systems and their associated EACMS, PACS, and/or PCS.  If the registered entity has made a change to a BCA in that system, then the registered entity has essentially changed part of the BCS.  Therefore, the 30 days start after the change is completed on each BCA.  Please reference page 33 of the Guidelines and Technical Basis for CIP-010-2, Requirement 1, paragraph 1.

The Requirements (both CIP-010-2 R1.4 and R1.5) do permit the Responsible Entity to identify the “required” cyber security controls that may be impacted. CIP-010-2 R1.5.1, while not as specific in the language as CIP-010-2 R1.4.1, does say “. . . to ensure that required cyber security controls in CIP-005 and CIP-007 are not adversely affected . . .” The referenced FAQ also supports this position, However, the determination of what constitutes “required” is open to interpretation; and could result in differing opinions between entities and audit staff. Therefore, in order to avoid potential oversights that would lead to potential noncompliance and increased risk to entity operations and the BPS, it is strongly recommended that all cyber security controls in CIP-005 and CIP-007 be tested under CIP-010-2 R1.5.

Our understanding is that, if a stand-alone commercially available or open-source executable program (e.g., the SSH client "PuTTY" or the third-party text editor “Notepad ++”) is copied onto the hard disk of an asset, then it has been “installed” on the asset. Because these types of programs do not go through the Windows installer, they do not show up in the Windows registry or list of installed software.

1. When performing a 35-day baseline review of installed software, is it expected that every folder on every asset is searched for executables to compare to the baseline?
2. Or, is it acceptable to define a folder where such software is to be placed according to a procedure, then search that folder for the review?
3. Or, is there another recommended practice?
4. How should stand-alone commercially available or open-source executable programs that reside on removable media that gets inserted into a BCA be handled? (i.e., Which CIP-010-2 and CIP-007-6 requirements apply to the programs on removable media?) Note, this question is not referring to cases where the program is to be copied onto the asset (“installed”) but rather used temporarily directly from the removable media.

1. A registered entity must monitor the baseline of installed software for unauthorized changes at least once every 35 days. The registered entity must first properly identify and document software that makes up each baseline. Typically, most executables are put in place by the operating system or other installed software without individual approval of each executable. As such, these individual executable files are part of the software documented in the baseline and do not require additional documentation on the baseline configuration. For this reason, SERC expects the registered entity to develop its baseline and monitor for changes as required. Depending on system configuration, it may require in depth system analysis as part of CIP-010-2 R2.1 compliance efforts.
2. A procedure mandating the use of a single specific folder for intentionally added standalone executables, including monitoring that folder’s contents for changes every 35 days, would not be an acceptable practice for detecting changes to standalone executables. However, the registered entity could deploy internal controls to support the monitoring requirement and ensuring only executables are added to the identified directory. In addition, the registered entity must maintain evidence to demonstrate that the controls are operating sufficiently.
3. We have no additional specific recommendations other than clarification provided above.
4. Programs residing on removable media are not “installed on” the Cyber Asset; and thus, are not required to be documented as part of any baseline. However, as a good security practice, SERC recommends specifically authorizing use of such programs, whether documented in the baseline configuration or elsewhere.

Question: If you procured hardware and/or software from a vendor prior to July 1, 2020 and install it into the CIP environment after July 1, 2020, does the vendor that provided the hardware or software need to have a risk assessment completed prior to installing the hardware or software in the CIP environment?  For example, Entity A purchases several workstations on January 1, 2020 and stores the workstations in inventory. On August 1, 2020, Entity A takes one of the workstations purchased in January from inventory and installs that workstation in the EMS environment.

Hardware or software that is procured prior to the effective date of July 1, 2020 would not be in scope for the purposes of CIP-013.

“In implementing CIP-013-1, responsible entities are expected to use their Supply Chain Cyber Security Risk Management Plans in procurement processes (e.g., Request for Proposal, requests to entities negotiating on behalf of the responsible entity in the case of cooperative purchase agreements, master agreements that the responsible entity negotiates after the effective date, or direct procurements covered under the responsible entity’s plan) that begin on or after the effective date of CIP-013-1. Contract effective date, commencement date, or other activation dates specified in a contract do not determine whether the procurement action is within scope of CIP-013-1.”

A:  No, CIP-013-1 affects only new procurements. This answer is supported by the General Considerations section of the Implementation Plan (https://www.nerc.com/pa/Stand/ CIP0131RD/Implementation_Plan_Clean_071117.pdf):

“In implementing CIP-013-1, responsible entities are expected to use their Supply Chain Cyber Security Risk Management Plans in procurement processes (e.g., Request for Proposal, requests to entities negotiating on behalf of the responsible entity in the case of cooperative purchase agreements, master agreements that the responsible entity negotiates after the effective date (the renegotiation of contracts), or direct procurements covered under the responsible entity’s plan that begin on or after the effective date of CIP-013-1. Contract effective date, commencement date, or other activation dates specified in a contract do not determine whether the procurement action is within scope of CIP-013-1.”

In order to determine the beginning date of a procurement, the Responsible Entity must document that date in a manner suitable for use as audit evidence. Without such documentation, audit teams will use the earliest date that provides reasonable assurance of the beginning of the procurement process.

Q:  If initial risk assessments are expected, will performing and documenting a high-level controls risk assessment be acceptable for the 7/1/2020 effective date?

A:   Risk assessments of vendors that provided equipment or services prior to the CIP-013-1 effective date of July 1, 2020, are not required. Any procurements for high or medium impact BES Cyber Systems equipment, software, or services begun after July 1, 2020, must be performed in accordance with the entity’s documented CIP-013-1 R1 supply chain cyber security risk management plan.

If the term "widespread" is removed from CIP-014, what criteria is NERC expecting Registered Entities to use?

Registered Entities will be expected to apply the criteria that are issued with the release of FERC’s Final Rulemaking.  However, the Final Rule may not only remove the term “widespread” but also may include additional changes and language that further clarifies FERC’s intent; so read it very carefully.

Description of the Violation, Issue, or Trend

NERC recently distributed a memorandum to the regions regarding the handling of CIP-014 evidence information. Per the instructions SERC will be conducting all reviews of CIP-014 while onsite at TOs and TOPs. SERC will fill out the RSAW also while onsite during the review with no pre-audit preparation by the entity. SERC will not collect from the entity or store on its PEI server any of the following:

1. Any registered entity-provided evidence used to demonstrate compliance with CIP-014 from the Transmission Owner’s or Transmission Operator’s site

a. An entity’s list of critical substations developed under Requirement R1

b. Documentation of the entity’s vulnerability evaluation developed under Requirement R4

c. Documentation of the entity’s security plan developed under Requirement R5

2. CIP-014 Reliability Standard Audit Worksheets (RSAWs) containing entity provided evidence

3. Any auditor notes describing the whereabouts of critical substations or any other entity-provided evidence from the Transmission Owner’s or Transmission Operator’s site.

CIP-014 information that will be stored on the SERC PEI server for the next 7 years, along with other audit evidence, may include the following:

1. Auditor notes that describe the ERO Enterprise’s process for conducting the audit

2. Documents (or other evidence) reviewed during the CMEP activity and their location

3. Reliability Standard Audit Worksheets (RSAWs) that do not contain entity provided evidence

4. Evaluated findings

5. Evidence in the ERO Enterprise’s possession as a result of CMEP activities performed for other Reliability Standards, such as the cybersecurity‐related Critical Infrastructure Protection Reliability Standards (CIP‐002 through CIP‐011) and Transmission Planning (TPL) Reliability Standards

Does the scope of a registered entity’s obligation to perform an initial risk assessment under CIP-014 R1 extend only to the Transmission stations and Transmission substations that it owns?  From a plain reading of the first sentence of R1, that appears to be the case:

“Each Transmission owner shall perform an initial risk assessment and subsequent risk assessments of its Transmission stations and Transmission substations (existing and planned to be in service within 24 months) that meet the criteria specified in Applicability Section 4.1.1.” 

The word “its” in R1 seems to make clear that a Transmission Owner need only include in its risk assessment those Transmission stations and Transmission substations that it owns.  This is further supported by the language in Applicability Section 4.1.1, which makes clear that the Reliability Standard applies to a “Transmission Owner that owns a Transmission station or Transmission substation that meets any of the following criteria.”  Given that CIP-014 would not apply to a Transmission Owner that did not own a Transmission station or Transmission substation, it is a fair reading that CIP-014 R1 would not require a Transmission Owner to include in its assessment Transmission stations/substations that it does not own.

 For example, if a registered entity owns transmission facilities that are located within Transmission stations/substations that are owned by neighboring utilities, does the registered entity need to include the Transmission stations/substations in its risk assessment under CIP-014 R1?  

The Applicability section 4.1.1 of CIP- 014-1 states that the standard applies to a “Transmission Owner that owns a Transmission Station or Transmission substation that meets any of the following criteria: . . .” and this concept is further reinforced by the language in R1 as noted.

However, ultimate compliance responsibility could be impacted by existing mutual agreements, Coordinated Functional Registration (CFR) agreements, Joint Registration Organization (JRO) agreements, delegation agreements, memorandums of understanding (MOU), or contractual arrangements. Where none exist or where none specifically address compliance responsibility, it is highly recommended that registered entities include language in a formal agreement to clearly address compliance responsibility to avoid any confusion or misunderstanding between the two registered entities who share an impacted site.

See NERC Compliance Public Bulletin #2010-004

6/25/2014
I am a contractor following the development of CIP-014 Standard. We’re reaching out to each of the NERC Regions to determine what qualifications, if any, that the RE may have for Requirement 2 of the Standard which specifies an independent third party verification of the risk assessment (R1).  Does SERC have a formal or informal process regarding approved third parties? We have also developed a study methodology to perform the risk assessment based on our industry experience with performing impact analysis that we’d like to receive feedback/opinions on.

SERC conducts a number of outreach and training activities to keep Registered Entities apprised of new and revised NERC Reliability Standards. SERC does not, however, instruct Registered Entities on how to be compliant. SERC also does not review or give feedback on methodologies or processes to consulting firms concerning Reliability Standards.  Participation in SERC outreach events is open to employees and representatives of organizations listed on the NERC Compliance Registry within the SERC Region.

Yes, if the designated Alternative Interpersonal Communication is unique to the backup Control Center and the only medium utilized at the backup Control Center, it would be required to be tested in accordance with Requirement R9.

Yes, an Alternative Interpersonal Communication is any medium that is able to serve as a substitute for, and does not utilize the same infrastructure (medium) as the Interpersonal Communication.

Yes. 

In addition, do you have to have a coordinated test with your neighbor; or can you test your own equipment?

No, a documented test call for each is sufficient evidence of testing.

As long as non-suffering entities are able to contact the suffering entity via the Primary Interpersonal Communication capability, there is no failure.

Per the Standards for COM-001 and COM-002, the retention period for written documentation is the most recent twelve calendar months and voice recordings for the most recent 90 calendar days unless directed by the CEA to retain specific evidence for a longer period of time as part of an investigation.

Does SERC have a retention period for written documentation and call recordings that will require an entity to keep evidence longer than what is specified in the Standard?

Response:
NERC Standard COM-001-3 require the applicable entity to retain written documentation for the most recent twelve calendar months and voice recordings for the most recent 90 calendar days. NERC Standard COM-002-4 requires the applicable entity to retain data or evidence for each applicable Requirement for the current calendar year and one previous calendar year, with the exception of voice recordings which shall be retained for a minimum of 90 calendar days.

SERC is obligated to request the data and evidence based on the retention periods that are stated in the NERC Standards and Requirements. SERC may request the applicable entity to retain specific evidence for a longer period of time as part of an investigation.

According to R10, each Reliability Coordinator, Transmission Operator, and Balancing Authority shall notify entities as identified in Requirements R1, R3, and R5, respectively within 60 minutes of the detection of a failure of its Interpersonal Communication capability that lasts 30 minutes or longer.  Does that apply for GOP and DP as well?

As stated in COM-001-3 R10, each RC, TOP, and BA shall notify entities as identified in COM-001-3 R1, R3, and R5, respectively within 60 minutes of the detection of a failure of its Interpersonal Communication capability that lasts 30 minutes or longer.

COM-001-3 R11 requires that each DP and GOP that detects a failure of its Interpersonal Communication capability shall consult each entity affected by the failure, as identified in Requirement R7 for a DP or Requirement R8 for a GOP, to determine a mutually agreeable action for the restoration of its Interpersonal Communication capability. COM-001-3 R11 does not specify a time requirement.

R12. Each Reliability Coordinator, Transmission Operator, Generator Operator, and Balancing Authority shall have internal Interpersonal Communication capabilities for the exchange of information necessary for the Reliable Operation of the BES. This includes communication capabilities between Control Centers within the same functional entity, and/or between a Control Center and field personnel.

Internal interpersonal Communication capabilities are not required for field personnel of a GOP at a single facility with a single control room.

NERC definition of Control Center: One or more facilities hosting operating personnel that monitor and control the Bulk Electric System (BES) in real-time to perform the reliability tasks, including their associated data centers, of: 1) a Reliability Coordinator, 2) a Balancing Authority, 3) a Transmission Operator for transmission Facilities at two or more locations, or 4) a Generator Operator for generation Facilities at two or more locations.

During a declared state of emergency, are all operating instructions considered an emergency operating instruction or just the ones related to the emergency?

Will non-emergency operating instructions be treated differently than emergency operating instruction during an audit / require higher level of documentation?

What is SERC / NERC doing to ensure consistency across the regions in what is considered an emergency? What guidance have they given the different regions’ auditors for how to apply this standard?

Although not explicitly defined, Emergency Operating Instruction (OI) is a combination of two NERC defined terms. Only OIs related to an Emergency are considered an Emergency OI. From an audit perspective, an Emergency OI and an OI will be treated the same. The VRF for an Emergency OI increases. Emergency is a NERC defined term.

Operating personnel who can receive an oral two-party, person-to-person Operating Instruction must receive initial training prior to receiving an Operating Instruction (no retraining requirement).  If the personnel have been previously trained to use three-part communications that matches the COM-002-4 protocol, this training would meet the requirement and would have to be sufficiently documented. 

Q: When does the initial assessment under R4 have to be performed?

• July 1, 2016
• December 31, 2016
• July 1, 2017
• Other, please explain

The protocol should be in place by July 1, 2016. All operators that issue or receive Operating Instructions (OI) should be trained before issuing or receiving an OI. Operators that are trained on the COM-002-4 protocol prior to implementation meet the requirements of R2 and R3.

The assessment should be completed by July 16, 2017 and within every 12 months thereafter. The assessment is not specifically an individual assessment, and the assessment methodology is left to the registered entity. One approach might be to assess each outage for adherence. Although somewhat burdensome, this approach would likely catch all operators at different times of the day. Another approach could be to document a specific time frame such as “x number of minutes per week during peak hours will be reviewed.” This approach would, most likely, catch each operator. It would also allow for the development of statistical data. That documentation would point out the percentage of adherence so that training could be brought in when irregularities are detected (perhaps an operator was determined to be using the protocols only 85% of the time). In the case where an operator did not issue or receive an OI or the sampling did not include an operator, simulation/training could be used and documented for an assessment of that individual.

COM- 002-4
Purpose:
To improve communications for the issuance of Operating Instructions with predefined communications protocols to reduce the possibility of miscommunication that could lead to action or inaction harmful to the reliability of the Bulk Electric System (BES).

R6.     Each Balancing Authority, Distribution Provider, Generator Operator, and Transmission Operator that receives an oral two-party, person-to-person Operating Instruction during an Emergency, excluding written or oral single-party to multiple-party burst Operating Instructions, shall either: [Violation Risk Factor: High][Time Horizon: Real-time Operations]

• Repeat, not necessarily verbatim, the Operating Instruction and receive confirmation from the issuer that the response was correct, or
• Request that the issuer reissue the Operating Instruction.

M6.   Each Balancing Authority, Distribution Provider, Generator Operator, and Transmission Operator that was the recipient of an oral two-party, person-to-person Operating Instruction during an Emergency, excluding oral single-party to multiple-party burst Operating Instructions, shall have evidence to show that the recipient either repeated, not necessarily verbatim, the Operating Instruction and received confirmation from the issuer that the response was correct, or requested that the issuer reissue the Operating Instruction in fulfillment of Requirement R6. Such evidence may include, but is not limited to, dated and time-stamped voice recordings (if the entity has such recordings), dated operator logs, an attestation from the issuer of the Operating Instruction, memos or transcripts.

As written, R6 is only applicable to the DP/GOP in cases of an Emergency Operating Instruction. As illustrated during the 2015 Fall Compliance Seminar, however, a routine Operating Instruction may become an Emergency Operating Instruction while executing the Operating Instruction. So in this case, the lack of using the protocol when receiving the Operating Instruction has become a violation of R6 with a Severe VSL.  Most shops use three-part communications and may or may not be a requirement of a local procedure.  Using 3-part communications in any instance of receiving an Operating Instruction just makes good business sense, and is demonstrative of a Culture of Compliance.

From the RSAW
Evidence Requested:
Dated operator logs, voice recordings, memos, or transcripts, or other evidence (per M6) describing the registered entity’s response to Operating Instructions received during an Emergency selected by the auditor.

Auditors will look for several things in regards to this Standard for the DP/GOP. First will be that DP/GOP personnel have been trained as prescribed in R3, demonstrated by attendance records, training materials, agendas, etc. Second will be that DP/GOP personnel have used the established communication protocol when receiving an Emergency Operating Instruction. This can be demonstrated with date/time stamped voice recordings or transcripts thereof, dated operator logs, an attestation from the issuer of the Operating Instruction, voice recordings (if the entity has such recordings, memos transcripts, etc.).  In that the issuer is required to assess their protocol, it is likely that a recording of the Operating instruction already exists. This requirement does not require the DP/GOP to install any recording equipment.

This is regarding EOP-004 reporting and suspicious activity.  Does SERC have any guidance as to what constitutes suspicious activity, or is the recommendation to let the Registered Entity specify what is reportable?

The Registered Entity determines what is reportable as suspicious activity.  SERC Regional Criteria for Event Reporting is an applicable document, but it provides no specific recommendations.

Re: EOP-004, in the event that a standard is applicable to multiple functional entities, is a separate report required on behalf of each RE for the same event?

No. From Page 13 of the standard . . ."Multiple Reports for a Single Organization

For Registered Entities that have multiple registrations, the Disturbance and Sabotage Reporting Standard Drafting Team intends that these Registered Entities will only have to submit one report for any individual event. For example, if a Registered Entity is registered as a Reliability Coordinator, Balancing Authority and Transmission Operator, the Registered Entity would only submit one report for a particular event rather submitting three reports as each function.

EOP-004-3 Attachment 1 defines Transmission loss as:
Unexpected loss within its area, contrary to design, of three or more BES Elements caused by a common disturbance (excluding successful automatic reclosing).

PRC-004-5(i) R3 states:
Each Transmission Owner, Generator Owner, and Distribution Provider that receives notification, pursuant to Requirement R2 shall, within the later of 60 calendar days of notification or 120 calendar days of the BES interrupting device(s) operation, identify whether its Protection System component(s) caused a Misoperation.

If a Responsible Entity experiences an unexpected loss within its area of three or more BES Elements caused by a common disturbance and then identifies a Misoperation (contrary to design) during the 120 day or 60 day period allowed in PRC-004 R3 was involved in the unexpected loss, must they report the event within 24 hours of recognition of meeting an event type threshold for reporting or by the end of the next business day if the event occurs on a weekend per EOP-004-3 R2?

EOP 004-R2 specifies providing an event report within 24 hours of recognition of meeting an event type threshold for reporting, but leaves open how long after the unexpected loss Responsible Entities can be required to recognize an event type meeting the threshold for reporting.  Does the time period for the Responsible Entity to recognize that an event meets the event type threshold for reporting end within 24 hours of the unexpected loss, extend to forever, or can the Responsible Entity define the time period within their Operating Plan?

It is important to submit an EOP-004 report in situations of uncertainty to provide information to make people/agencies aware of the current situation so that they may prepare to mitigate current and future events. 

If recognition of an event occurs where more than three BES elements are lost and there is no Protection System designed to remove the elements in question, an EOP-004 Event Reporting Form must be submitted within 24 hours or by the end of the next business day if the event occurs on a weekend.  If it is unclear if a Protection System misoperated, then a NERC Disturbance Report Form should be submitted. Once a final determination is made, an updated EOP-004 Event Reporting Form and/or misoperation report should be submitted.  There is not a defined time period that would prohibit submitting a NERC Disturbance Report Form.  Once recognition of an event occurs (e.g., days, months, etc. after the event), the Form must be submitted.

If the RC or BA did not experience the loss of monitoring capability affecting the BES control center (and there are no contractual obligations (example: JRO or CFR)) for more than 30 minutes, they would have no reporting obligation. The only registered entity obligated to file a report would be the affected entity. In this particular case, if the RC or BA is depended on information that is delivered by the failed monitoring system, they would have a reporting obligation. Upon notification the RC would be obligated to post the event on RCIS.

Is the “review only” approach acceptable for small Distribution Providers for EOP-004-2 R1 and R3?

Distribution Providers (DPs) that do not meet the “Threshold for Reporting” for any event listed in Attachment 1 will not have any reports to submit under Requirement R2. However, these DPs will be responsible for meeting Requirements R1 and R3. These DPs may have a very simple Operating Plan that includes a statement that there are no applicable events in Attachment 1 (to meet R1) and that the DP will review the list of events in Attachment 1 each year (to meet R3).

The threshold for reporting loss of load for my company is 200 MW. If my power provider has an outage that causes my company to lose 200 MW or more, am I required to report the event?

Reporting this type of load loss event should be coordinated with impacted registered functions/entities. Multiple entities are not required to submit forms for the same event. It is important that one of the affected entities reports the event. It is important to note that, if the upstream provider does not meet its reporting threshold and does not complete OE-417 or EOP-004-3 Attachment 2 form, then Fayetteville may not be compliant should it not submit a report. SERC recommends that entities error on the side of caution and coordinate with the upstream provider to determine if the provider is submitting a form (and it includes Fayetteville load). If the provider is not submitting a report, then Fayetteville must submit an OE-417 or EOP-004-3 Attachment 2 report.

NERC Standard EOP-004-3 Requirement 3 requires Responsible Entities to validate contact information contained within the Operating Plan each calendar year. The date of enforcement for EOP-004-4 is April 1, 2019, and does not contain a Requirement to validate contact information each calendar year.

Is the Responsible Entity under EOP-004-3 required to validate contact information prior to the April 1, 2019 effective date of EOP-004-4?

Can a Responsible Entity, which has not performed a validation of contact information by April 1, 2019, state they did not perform the 2019 validation since the NERC Standard Version is no longer effective?

Recognition is not defined by the NERC glossary of terms. 

Among other definitions, recognition can be defined as an acknowledgment of something's existence, validity, or legality.

With reference to EOP-004-3 R2, when the reporting threshold is acknowledged (recognized), the reporting clock starts. The recognition could be made by a real-time operator or a member of the support staff. Either type of acknowledgement is valid and constitutes recognition of an event.

EOP-005 R2 requires Registered Entities to have restoration plan that identifies black start facilities and cranking path, etc.  How does this apply to Registered Entities with no black start capabilities that will not be restored from black start units and restored later in the plan, after frequency and voltage becomes stable?

If a Registered Entity has no black start units or Cranking Paths, there won't be any identified in the plan. However, the Registered Entity must still have a restoration plan, which should document that there are no black start units or Cranking Paths.

In the ‘Applicability’ section of NERC Reliability Standard EOP-005-2 (System Restoration from Blackstart Resources), section 4.1 lists Transmission Operators (TOP). Does the EOP-005-2 apply to all TOPs or only to TOPs that have Blackstart Resources within their footprint?

Applicability section 4.1 is applicable to all Transmission Operators (TOP’s).

According to Requirement 1 which states:

R1 - Each Transmission Operator shall have a restoration plan approved by its Reliability Coordinator. The restoration plan shall allow for restoring the Transmission Operator’s System following a Disturbance in which one or more areas of the Bulk Electric System (BES) shuts down and the use of Blackstart Resources is required to restore the shutdown area to service, to a state whereby the choice of the next Load to be restored is not driven by the need to control frequency or voltage regardless of whether the Blackstart Resource is located within the Transmission Operator’s System. The restoration plan shall include: R1.1-R1.9.

Each TOP should have a restoration plan approved by its Reliability Coordinator (RC). If a TOP does not have a Blackstart Resource in their area, the plan should show cranking paths and initial switching requirements between the affected TOP and an adjacent TOP that has a Blackstart Resource for the affected TOP to restore their systems and reestablish connection with other TOP’s.

Any changes that affect an established restoration plan will require the TOP to update the restoration plan and submit to their Reliability Coordinator (RC) within 90 days for approval, per Requirement 4.1.

System Operators normally pick up no more than 5% of the current system load at a time to avoid large frequency swings and the tripping of units that are online.  Would this need to be verified through steady state and dynamic simulation?

Picking up no more than 5% of current system load is common practice and a good way to control voltage and frequency, but it is not part of this Requirement’s criteria. However, choosing to verify this through simulations is fine.

What Requirements do companies plan on applying dynamic simulations?  Will it only be R6.1 or all of them?

Dynamic simulation is one of the methods of verification of the plan. It can be applied to all of the sub-requirements.  It's up to the company.  (Also see other responses to these requirements.)

Simulations performed in the EMS have difficulties energizing long transmission lines and starting some units due to the way these elements are modeled in the simulation.   Also, TOP restoration plans most of the time specify for the dispatch of field personnel to black start sites, to substations to open breakers, and to report station status.  The TOP can only estimate this time, so what basis does this need to have in the simulation?

It is fine to estimate these things as best and realistically as possible. 

It seems the intent of Transmission Operator (TOP) restoration plans would include black start, off-site power to nuclear plants and control centers, provide offsite power to CT and coal plants, picking up critical customer loads, synchronize internal islands, and synchronize with the Interconnection.  Do all these elements need to be simulated to achieve compliance with R6?  What does a dynamic simulation need to consist of?  Would this be a dynamic stability analysis, scripted PSSE power flow solution, or a combination or several analyses?  To what extent do the steady state and dynamic simulations need to show the TOP restoration plans’ intended function?  Would taking the simulation to the point where off-site power is restored to nuclear plant switchyards and those unit auxiliary loads energized be sufficient, without taking the simulation to the point of the units actually being started?  Do other fossil units in the TOP restoration plan need to show their auxiliary loads modeled and unit started in order to show the ability to energize lines, pick up load, and be able to control frequency and voltage within a tolerance?

Verify through at least one of the three analysis tools in the Requirement, that the restoration plan accomplishes its intention.   Any analysis used to support satisfaction that the plan works as intended is acceptable as long as it satisfies the Requirement and all sub-Requirements.   Taking the simulation to the point where off-site power is restored to the nuclear plant is fine.  However, to satisfy R6.3, other generating resources will have to be online to control voltage and frequency within acceptable operating limits.  Each restoration plan is obviously different. Take the verification of the restoration plan as far along as needed to establish that the plan accomplishes its intent and satisfies the Requirement and sub-requirements.

Many TOP restoration plans include multiple islands, with options, and paths to pursue since it is unknown where the restoration will begin due to damage from a storm, sabotage, etc.  For instance, several best option starting points are detailed in the restoration plan; and are outlined step-by-step to the point where off-site power to nuclear plants is restored.  Then the plan goes into more generic guidance to energize the 115 kV, 230 kV, and 500 kV systems in loops to establish stability and pick up load; and then eventually, gets to guidance on synchronizing islands and tying with neighbors.  How many different islands or options must be simulated?  Does the simulation need to include all possible black start sites?  If a TOP restoration plan has multiple black start units with multiple possibilities of places to start from and end up, is it ok to exercise just one of these options or do all possibilities need to be exercised in the simulation? 

Each system is different.  Larger TOP's have a bigger footprint; and therefore, more options. It is up to the TOP as to how many islands, options, black start units, and simulations are needed to verify that the plan will accomplish its intended function. You have a vested interest in having a successful plan that sufficiently meets your needs. Your documentation should reasonably tell the story of compliance that your restoration plan will work when needed.

EOP-005-2 R9 requires each TOP to have “Blackstart Resource testing requirements to verify that each Blackstart Resource is capable of meeting the requirements of [the entity’s] restoration plan,” and R9.1 indicates that the  registered entity’s testing requirements must ensure that, at a minimum, “each Blackstart Resource is tested at least once every three calendar years.” EOP-005-2 R16 then states that GOPs with Blackstart Resources shall perform Blackstart Resource tests “in accordance with the testing requirements set by the TOP to verify that the Blackstart Resources can perform as specified in the restoration plan.”

QUESTION: If an entity’s restoration plan includes testing requirements that provide for testing of each Blackstart Resource more frequently than once every three calendars years, will the entity be audited to the testing timeline specifications in its restoration plan or to the “at least once every three calendar years” language found in the standard at EOP-005-2 R9.1?

The short answer is that SERC audits against the criteria established in the Reliability Standards. In this case, the criterion is a minimum of three years.

The longer answer is:

Some Reliability Standards require the registered entity to establish a program or plan that includes certain elements. For example, consider FAC-003-3 R7 that requires the registered entity to perform 100% of its annual work plan. In this example, the content of the work plan is flexible; but the entity will be audited against whatever it has established in its work plan. In PRC-005-1 R1, the registered entity is required to establish a maintenance and testing program that specifies maintenance and testing intervals; and registered entities are audited against whatever it justified as its interval.

Other Reliability Standards (or Requirements within the same Reliability Standard) establish a criterion as a threshold for compliance. Where such a criterion exists, it establishes the threshold for compliance; and the entity will be audited against the Requirement. Examples include PRC-023 R1 that sets a minimum relay trip set-point.  Registered entities may exceed that set-point without being noncompliant.  FAC-003-3 requires that 100% of applicable transmission lines receive a vegetation inspection annually.  If a registered entity establishes a more aggressive schedule for inspections in their program, it will not be found noncompliant unless it does not meet the requirement of at least once annually.

In general, the Reliability Standards establish a minimal expectation for compliance and registered entities will often prefer to exceed those expectations.  An internal control (such as a program, process, or procedure) that exceeds the criteria established in the Requirements is encouraged as a measure to enhance, maintain, or restore reliability; but does not establish the minimal required performance when the criterion is stated in the Requirements.

EOP-005-2 R11 states, “Each Transmission Operator, each applicable Transmission Owner, and each applicable Distribution Provider shall provide a minimum of two hours of System restoration training every two calendar years to their field switching personnel identified as performing unique tasks associated with the Transmission Operator’s restoration plan that are outside of their normal tasks.”   What does SERC define as unique tasks?  Please provide examples of these tasks.  How are other companies defining unique tasks?   What are the tasks identified; and what training is being, or will be, conducted?

"Unique tasks" is actually defined in the Requirement as tasks "that are outside of their normal tasks." Examples could be a substation test engineer whose normal duties are to test relays or EMS remote work, who are called to do transmission line switching. Another example is a Distribution employee called to do transmission substation or line switching.

SERC is not aware of how other companies define "unique tasks".  Tasks identified and the particular training needed would be up to the registered entity and its needs for successful training.

The RSAW for EOP-005-2 R11 states: 
Note to Auditor: Evidence may include, but is not limited to, a copy of training records/materials with training dates, topic, attendees and duration. Initially, entities will have two years from July 1, 2013 to execute this training.

Registered entities may have interpreted this to be “two calendar years” as stated in the requirement, which would make the “initial” training completion date to be December 31, 2015.

Question:  When is the “initial” training for applicable Distribution Provider field switching personnel to be completed, by July 1, 2015 or by December 31, 2015?

If the training is self-paced and some people take less than two hours to complete, are you out of compliance?  Self-paced training is written such that the average student will take “X” amount of time. This means some take longer, and some take less time. If it is formal classroom training and some instructors can cover the required material in less than two hours, are you out of compliance?  The measurability of R17 should rest on the training content that it is given within the required two year period.

Provided the self-paced course has been piloted and documented to be a “two-hour program”, and provided the individual successfully completes all the requirements of the two-hour program, the Registered Entity would be in compliance, no matter how long it takes the person to actually complete the training.  This applies to self-paced training only.  For instructor-led classes, the individual must have the full two contact hours every two years.  It is expected that the two hours will address not only the restoration-related tasks but also an overview of restoration principles and practices.

Can SERC provide some clarification on what they would want to see for criteria for sharing information regarding restoration with neighboring RCs and with TOPs and BAs within its RC Area? Some examples would be helpful.

What R1.7 is asking is what the RC is sharing, and how are you sharing or communicating this to your neighboring RC, and TOPs and GOPs in its RC Area. Show evidence of what you have shared and that the sharing has been/is being done to prove compliance.

This is relative to EOP-006-2 R2 and R3 that state:
R2. The Reliability Coordinator shall distribute its most recent Reliability Coordinator Area restoration plan to each of its Transmission Operators and neighboring Reliability Coordinators within 30 calendar days of creation or revision.

R3. Each Reliability Coordinator shall review its restoration plan within 13 calendar months of the last review.

Is a review of the restoration plan that has no changes but is documented in the Revision History of the plan, such as going from Version 1 to 1a, considered a revision that has to be distributed to its TOPs and neighboring RCs within 30 calendar days?

Yes, the TOPs and RC need to know that the plan was reviewed and that there were no changes.

Description of the Violation, Issue, or Trend
Entity that is required to maintain control center functionality and communications capability as a Reliability Coordinator and Balancing Authority maintains IT staff position in their control center at a System Operator console on a 24x7 basis. The IT person is also certified as a System Operator and has the same access and training on all EMS and SCADA applications as the on-shift System Operators.

Risk Considerations
Loss of EMS, SCADA, and other application tools affect the System Operators ability to manage real-time operations. These systems are vital to the oversight provided by the Reliability Coordinator and Balancing Authority functions.

Description of Mitigation Activity
Staffing the control center 24x7 with an IT person that is also a System Operator allows quick response to loss of EMS, SCADA, and other applications that affect system visibility for real-time System Operators.

Other Factors or Comments
Staffing an IT person in the control center 24x7 is excellent.  Staffing an IT person certified as a System Operator gives that person insight and knowledge of the systems and information and how they are used to maintain the reliability of the bulk electric system.

The new EOP-011 (http://www.nerc.com/pa/Stand/Reliability%20Standards/EOP-011-1.pdf) does not reference the EEA report anywhere. 

The old EOP-002-3.1 (http://www.nerc.com/files/EOP-002-3_1.pdf), which EOP-011 essentially replaced, referenced in Attachment 1-EOP-002.

Section B., Step 3.6, the reporting requirement and the report was included in Section C (only the heading is included below).

3.6 Reporting. Any time an Alert 3 is declared, the Energy Deficient Entity shall submit the report enclosed in this Attachment to its respective Reliability Coordinator within two business days of downgrading or termination of the alert. Upon receiving the report, the Reliability Coordinator shall review it for completeness and immediately forward it to the NERC staff for posting on the NERC website. The Reliability Coordinator shall present this report to the Reliability Coordinator Working Group at its next scheduled meeting.

C. Energy Emergency Alert 3 Report

A Deficient Balancing Authority or Load Serving Entity declaring an Energy Emergency Alert 3 must complete the following report. Upon completion of this report, it is to be sent to the Reliability Coordinator for review within two business days of the incident.

It appears this report is no longer required. I have scoured the Standards and documents and do not find a clear statement of this fact, other than the obvious omission. Before we remove this EEA 3 Reporting step from several of our procedures, I am asking for assistance from SERC to confirm that we are no longer required to submit this report or that we are still required to submit the report per Standard and Requirement.

According to language in EOP-011-1, EEA 3 reports are not required. SERC has confirmed the interpretation of EOP-011-1 with NERC staff.

Both SERC and NERC Situational Awareness staff will utilize RCIS to monitor for EEA activity. SA staff may request additional information from the RCs depending on the acuteness of the event.  

 [AS1]Added additional verbiage

June 4, 2018
FAC-001-2 R2:   States to have a Facility Interconnection Requirements document and to provide the document within 45 calendar days of an executed Agreement to conduct a study for interconnecting a Third Party Facility through an existing Generator Owner’s Facility Interconnection.

If the Generator Owner’s policy is to not allow such connections, does a GO need to have a Facility Interconnection document? If such a policy exists, would a study even be considered? If a GO is required to have a Facility Interconnection document, can the document plainly state that third party connections to their facility is not allowed? If such a Facility Interconnection document were written, how does that comply with Requirement R4?  

FAC-001-2 requires Transmission Owners and “applicable Generator Owners” to document and make Facility interconnection requirements available so that entities seeking to interconnect will have the necessary information. Per the standard, an “applicable Generator Owner,” is a “Generator Owner with a fully executed Agreement to conduct a study on the reliability impact of interconnecting a third party Facility to the Generator Owner’s existing Facility that is used to interconnect to the Transmission system.” Therefore, if
the Generator Owner’s policy prevents it from entering into any such Agreements, R2 does not apply to the Generator Owner and it is not required to have a Facility Interconnection Requirements document.

1. According to FAC-001-3 R3.3 and R4.3, the TO and GO are responsible for having a procedure that  addresses confirming that the party interconnecting has made appropriate provisions with a BA to  operate within its metered boundaries. Since our company is not the BA, where on the SERC website  can I find published material that will provide guidance for writing a procedure for R3.3 and R4.3?
2. If there is no written guidance, are there examples of how other entities are approaching R3.3 and R4.3?

1. SERC does not have a published procedure regarding R3.3 or R4.3.  
2. FAC-001-3 includes a Guidelines and Technical Basis section on page 9 of the standard. This section provides further details about FAC-001-3 R3.3 and R4.3. The TO and GO procedure should be written to accomplish the task of coordination and notification between the entity wishing to connect and all entities that will or could be affected by new generation, transmission, or load. A good practice would be to coordinate the procedure with the reliability entities in the area of interconnection prior to implementation. Request input from the BA, TOP, etc. to determine preferences for coordination and notification.

Description of the Violation, Issue, or Trend
Applicable Transmission Owners and Generation Owners are required to perform a Vegetation Inspection of 100 percent of all Rights-of-Way (ROW) 200 kV and above each calendar year with no more than 18 months between inspections. In addition to the inspection, these registered entities must develop and complete an annual plan for vegetation related work to ensure no encroachments occur into the transmission line Minimum Vegetation Clearance Distance (MVCD).

Risk Considerations
Vegetation related transmission outages pose a high risk to transmission line reliability. Entities with a large number of transmission lines above 200 kV are challenged with keeping track of inspection and maintenance on their lines.

Description of Mitigation Activity
Entity uses geospatial data to monitor and track vegetation inspections, maintenance, and quality assurance review. The geospatial data is updated continuously from devices carried by field personnel and displayed on a geographical transmission map. The map uses different colors on the ROW corridors to indicate the completion of inspections, maintenance, and quality assurance review.

Does SERC staff have specific expectations regarding the timeliness of ratings changes in field being reflected in planning and EMS models (particularly for downgraded ratings)?

[REF Recommendation: Be aware of associated PRC-023 “official ratings analysis” compliance.]

No, there is not a hard timeline for updating the affected systems.  However, a Registered Entity should have a process in place to update its tools and systems with new information when changes in the field occur. 

In regards to GO/GOP Registered Entities, the FAC-008-3 generators’ facility ratings are never requested. They are never electrically limited but mechanically limited. Has SERC staff recommended to NERC that this standard should not apply to generating units, since the rating of the largest prime mover is never attained?

No, this Standard applies to both transmission and generation.  Generation facility ratings are requested for audit if this Standard is identified in the audit scope.  Some generation facilities are electrically limited. MOD-025-2 also requires generation facility ratings.

Risk Considerations
These violations typically pose a moderate risk to the bulk power system.

Description of Mitigation Activity
Implementation of additional internal controls and training are typically included in the mitigating activities.

Other Factors or Comments
Ineffective change management for Facility Ratings has been a significant contributing factor.

Under FAC-008-3, R8.2, who specifically may request this data from the TO?
a. Which functional entities may request this data?

As stated in FAC-008-3 R8, each TO (and GO subject to R2) shall provide requested information to RC(s), PC(s), TP(s), TO(s) and TOP(s).
b. What does “under the requestor’s authority” mean? (i.e., Could this include adjacent entities?)

Facilities under the requestor’s authority refers to Facilities within the RC(s), PC(s), TP(s), TO(s) or TOP(s) area of operational or planning responsibility.

Per FAC-014-2 R5.3, it is the PC’s responsibility to provide System Operating Limits, which include facility ratings, to adjacent PCs and TPs, TSPs, TOPs, and RCs within its PC area.

November 11, 2019

1.  What specifically in the standard are they looking at for Operations and Planning Coordination? Is it that Planning and Operations should be getting the same source data, or do they see a requirement for a direct TOP – PC comparison?  As I mention below one of the things the drafting team is trying to address to some extent is the lack of a direct connection between TOP SOLs and the ratings/limits used by the TP/PC. Though the focus is primarily on stability limits, voltage limits and which of the mired of possible line ratings the TP/PC uses compared to the TOP. 
2. The presentation is focusing primarily on thermal ratings. Do they have expectations regarding voltage rating?

Responses:

1. The coordination between operations and planning models is used to ensure that Facility Ratings and real-time SOLs for BES Facilities are developed consistently using sound technical rationale based on a registered entity’s Facility Rating methodology and/or SOL methodology. For example, if an entity is registered as a Transmission Operator and a Planning Coordinator, then their Facility Ratings in the summer and winter planning models should be consistent with the SOLs in their EMS/State Estimator for summer and winter for the corresponding year. If there is a difference due to real-time temperature adjustment, the registered entity should be able to provide calculations to show how the temperature adjusted rating is derived from the planning model Facility Rating.
2. Yes. If you look at the definition of Equipment Rating (the maximum and minimum voltage, current, frequency, real and reactive power flows on individual equipment under steady state, short-circuit and transient conditions, as permitted or assigned by the equipment owner), you can see that voltage is a part of the Equipment Rating. Thermal ratings are presently a topic of focus because registered entities have exhibited problems in that area. If an entity installs equipment that is not rated to withstand nominal voltage, the equipment will normally fail during normal operation or fault conditions

Yes

No, SERC will sample certain days of the audit period per NERC Sampling Methodology.

Per the measures for IRO-001-4:

R2: Registered entities are expected to provide evidence that will be used to determine that it complied with its Reliability Coordinator's Operating Instructions, unless the instruction could not be physically implemented, or such actions would have violated safety, equipment, regulatory or statutory requirements. In such cases, the Transmission Operator, Balancing Authority, Generator Operator, or Distribution Provider shall have and provide copies of the safety, equipment, regulatory, or statutory requirements as evidence for not complying with the Reliability Coordinator’s Operating Instructions. If such a situation has not occurred, the Transmission Operator, Balancing Authority, Generator Operator, or Distribution Provider may provide an attestation.

R3: Registered entities are expected to provide evidence that will be used to determine that it informed its Reliability Coordinator of its inability to perform an Operating Instruction issued by its Reliability Coordinator in Requirement R1.

Reference: The Rationale for Requirement R3 page 12 of the Standard states: An entity's testing practices should, over time, examine the various failure modes of its data exchange capabilities.

Response: It is best practice to test all redundant functionality every 90 day. IRO-002-5 R3 is specific to testing data exchange capabilities. Data exchange capabilities must be tested every 90 days.

Question: 2 (IRO-002-5 R3)

1. Does the test require the RC to fail over to the back-up infrastructure (e.g., required to transfer from the primary EMS to the back-up EMS, transfer from the primary firewall to the back-up firewall)?

   Response: IRO-002-5 R3 does not require failover to back-up EMS. Testing the redundancy would include a process to verify information housed in the backup data exchange servers matches the data in the production servers. The comparison process would be similar to comparing a hot standby EMS (backup EMS) with the data in the production EMS. CIP standards will need to be included to cover the testing of a firewall.

2. Or, does providing evidence the back-up infrastructure is functional (i.e., available and on hot stand-by) meet the requirement?
   Response: A timely comparison process testing the validity of the data housed in the back-up data exchange is sufficient for demonstrating compliance. 

Question: 3 (IRO-002-5 R2R20)
Can redundant functionality data exchange infrastructure located outside the primary Control Center be presented as evidence to meet R2 compliance (e.g. EMS servers or firewalls at the back-up Control Center)?

MOD-033 R1 requirement R1.2 has an exception that states, “If no dynamic local event occurs within the 24 calendar months, use the next dynamic local event that occurs.”

Dynamic local event is not a defined term. Dynamic events happen often (e.g., breaker operations), but are not always measurable enough or have sufficient data recorded to be used for comparison.

Is it acceptable for an entity to define criteria for what is an acceptable local event, and can the exception be used if there is no acceptable event in 24 months?

Example: For an event to be considered acceptable, the following criteria must be met:

• Sufficient EMS data is available, and
• Event must result in a perturbation of a portion of the system, and
• Sufficient event recorder data  is available.

Response:
Per MOD-033, for the dynamics validation, the target of validation is those events that the Planning Coordinator (PC) determines are dynamic local events.

A dynamic local event could include such things as closing a transmission line near a generating plant. A dynamic local event is a disturbance on the power system that produces some measurable transient response, such as oscillations. It could involve one small area of the system or a generating plant oscillating against the rest of the grid.

Therefore, it is the PC that has to identify the dynamic event.  If something other than what the PC has identified is determined to be such an event, then the PC would still determine what is to be used.

If no dynamic local event occurs within the 24 calendar months, use the next dynamic local event that occurs.

If we have been issued a specific voltage/reactive schedule by the BA/TOP for our plant to meet that specifies a minimum MVAR output below the capability rating curve for the units, can the test points for our MOD-025-2 testing documentation conform to that same schedule?

The purpose of MOD-025-2 is to verify the actual real and reactive power capability of generators. The verification should be conducted per MOD-025-2, Attachment 1; so the Transmission Planners’ model data is consistent from the different units in their footprint. The verification process should compare the unit’s real/reactive output capability to the designed operating range (D-curve) of the unit, not the TOP’s voltage schedule.

2.2. Verify Reactive Power capability of all applicable Facilities, other than wind and photovoltaic, for maximum overexcited (lagging) and under-excited (leading) reactive capability for the following conditions:

2.2.1 At the minimum Real Power output at which they are normally expected to operate collect maximum leading and lagging reactive values as soon as a limit is reached.

Does this mean minimum capable / minimum stable generation or literally normal minimum? Specifically, for a base-load plant and/or a plant with contractual and/or environmental constraints, do we test at that normal operating output (i.e., base-load or minimum identified by the contract or regulation); or do we test at minimum stable capability understanding that Min capability is not ‘normal’ for the plant and would only occur if there was an event that necessitated it.

The minimum Real Power output level is determined by the manner in which the designated unit is dispatched. If the unit operates on a contractual basis, the output specified in the contract can be used as a basis for establishing a normal minimum. If the contract affecting the normal minimum changes, a resubmission of generator data to the Transmission Planner would be required. If the unit can be dispatched anywhere in its designed operating range, normal would be defined as the minimum stable capability at which the unit can operate on a continuous basis without tripping a reverse power relay or other low limit device.

Will a new Regional Guide be provided for MOD-025-2; and if so, when should we expect to see it?

No, the SERC Regional Criteria, Verification of Generator Real and Reactive Power Capability, associated with MOD-024-1 and MOD-025-1 is being retired. 

MOD-025-2 / MOD-026-1 / MOD-027-1: Please explain how to be compliant and when each is effective. 

SERC cannot comment on how to be compliant. The MOD Standards will be included in future SERC outreach activities. SERC staff is currently reviewing the material to plan the appropriate outreach initiatives. 

Below is the requested effective date information.

MOD-025-2 
  40%  of applicable Facilities are to be compliant by 7/1/2016  
  60%  of applicable Facilities are to be compliant by 7/1/2017  
  80%  of applicable Facilities are to be compliant by 7/1/2018  
  100%  of applicable Facilities are to be compliant by 7/1/2019

MOD-026-1  R1, and R3 through R6:  Effective date is 7/1/14  
MOD-026-1 R2:  
  30% of the entity’s applicable gross MVA are to be compliant by 7/1/2018  
  50% of the entity’s applicable gross MVA are to be compliant by 7/1/2020 
  100% of the entity’s applicable gross MVA are to be compliant by 7/1/2024

MOD-027-1  R1, and R3 through R5:  Effective date is 7/1/14  
MOD-027-1 R2:  
  30% of the entity’s applicable units gross MVA are to be compliant by 7/1/2018
  50% of the entity’s applicable units gross MVA are to be compliant by 7/1/2020
  100% of the entity’s applicable units gross MVA are to be compliant by 7/1/2024

MOD-025-2 does not specifically address the qualifications of personnel performing verification.  In most situations, state law governs engineer licensure.  However, it is the responsibility of each registered entity to ensure qualified personnel performs work when certifying compliance with Reliability Standards.

Solar farms are considered dispersed power producing resources that are covered under Inclusion I4 of the NERC BES definition. The BES portion of the solar farm begins from the point where those resources aggregate to greater than 75 MVA to a common point of connection at a voltage of 100 kV or above. The summation of the inverter ratings should be used to calculate the 75 MVA threshold. MOD-025 would be applicable to the solar farm as a Generating plant/Facility greater than 75 MVA in accordance with section 4.2.3. of MOD-025-2.

Leading and lagging Reactive Power tests can be performed at different times.  For the unit to be considered compliant, both tests must be complete and submitted by the implementation milestone dates.

Additional information

Milestone dates:
Each Generator Owner and Transmission Owner shall have verified at least:
  40 percent of its applicable Facilities by 07-01-2016.
  60 percent of its applicable Facilities by 07-01-2017.
  80 percent of its applicable Facilities by 07-01-2018.
100 percent of its applicable Facilities by 07-01-2019.

Per MOD-025-2 Attachment 1 Paragraph 1 under Periodicity for conducting a new verification: 
The first verification for each applicable Facility under this standard must be a staged test.

Question 2:
Requirement 2 has the 90 day window for submitting the report to Transmission Planning.  Will Nuclear still be compliant if they send the report after the 90 day period?

The 90 calendar-day submittal deadline is enforceable at the milestone dates of the implementation plan. Thus, each Generator Owner must submit verification data to its Transmission Planner for at least 40% of its generation units prior to July 1, 2016. The only exclusion for Nuclear units is the requirement to perform Reactive Power verification at minimum Real Power output. 

Reference:
The Violation Severity Levels in the standard identify the consequences of exceeding the 90 calendar days specified in Requirement 2.2.

The next test date is based on the previous verification date, not the date the form is submitted. 

Question 2:
If the test for Reactive Power lagging and leading are performed at different times, is it ok to hold the data for the pending test until all data is gathered? If so, what is the maximum allowable time between the two tests?

If the data is recorded from a staged test, then the data must be submitted within 90 days per requirement 1.2 and 2.2.  If the staged lagging and leading test are more than 90 days apart, then two forms are required.  If the data is selected from historical operational data, then the elapsed time between the lagging and leading test could exceed 90 days, as long as the dates selected are within the 66 calendar month compliance window.  However, paragraph 2 of MOD-025-2, Attachment 1 states, “If data for different points is recorded on different days, designate the earliest of those dates as the verification date, and report that date as the verification date on MOD-025 Attachment 2 for periodicity purposes.” 

Question 3:
Is the Real and Reactive Power capability change of 10 percent based on design/equipment change or what the unit could actually verify during an operational test?

The 10 percent change is based on design changes or discovery of equipment changes that are expected to affect the unit’s capability for more than six months.

This project came on line in early December, and COD was on December 26.

Per NERC, MOD-025, 026 and 027 tests are to be completed and results submitted to SERC (per NERC) within 12 months of Commercial Operation. Since we have facilities in other jurisdictions – other Regional Authorities have different / additional requirements. We have been progressing on the basis that we need to comply within 12 months. Could you kindly let us know if this “understanding” is correct - if not what exactly is the requirement in SERC?

For Generating Units that qualify for the 10 year exemption for excitation systems/governors, is the Generator Owner obligated to provide ANY model data to the Transmission Planner under MOD-026/027 and possibly MOD-032?  What if changes or updates are made to these systems?  If they still qualify for the exemption are we required to provide models or notify of changes?

My reason for asking – The majority of my units qualify for this exemption and will likely never go over the 5%.  I have sent notification to the TP with this statement and showed the calculations for these units as described in the Attachments at the back of the standard.  They seem to think I still owe them model data, even if it isn't verified. I do not agree.

We will also be upgrading some of these exempt units over the next couple of years hence my changes/upgrades question.

 MOD-026-1 and MOD-027-1 do not require initial generator verification for generators with an average capacity factor of 5% or less over the three most recent calendar years.  To meet this exclusion, the capacity factor must be calculated as specified in Appendix F of the GADS Data Reporting Instruction on the NERC website.  If the GADS capacity factor calculation is 5% or less, a letter should be sent to the Transmission Planner stating the facts and circumstances of each generator that meets this exclusion.  Notification of changes and/or models are not required, as long as the unit meets the net capacity factor exclusion.

What three-year period do we use for the initial implementation date? Is it our choice?

The most recent three calendar years, to be recalculated every 10 years.

Standards each have staged implementation periods based on percent of applicable unit gross MVA or percent of applicable Facilities respectively.

How will the percent of applicable unit gross MVA or percent of applicable Facilities be audited?  Entities are asking to ensure they know how to determine the percentages?  (Is it based on unit type, fossil, nuclear, hydro, etc., entire fleet, or another measure?)

For entities with facilities in multiple Regions are the percentages based on facilities in each Region or can the percentage be based on their total facilities in all regions?

First identify the applicable qualifying units in the Eastern Interconnect that meet one or more of the following criteria:

• Those that are 100 MVA or greater, per generator, and directly connected at 100 kV or greater; or a generation plant with 100 MVA or greater generation connected at 100 kV or greater.
• For those units that are connected in the ERCOT Region, those that are 50 MVA or greater, per generator, and directly connected at 100 kV or greater; or a generation plant with 75 MVA or greater generation connected at 100 kV or greater.
• Also any technically justified unit that meets NERC registry criteria and is required by the Transmission Planner. (MOD-026-1)

From this list of applicable generation, the total MVA shall be used for the percentage calculations and this may cross several regions. This includes all types of generation in the total MVA: hydro, nuclear, steam, wind, and solar. The registered entity shall be able to show how the total MVA and percentage were calculated and the records to show that the tests were performed and verified.

The capacity factor must be calculated as specified in Appendix F of the GADS Data Reporting Instruction on the NERC website to meet this exemption. If the GADS capacity factor calculation is 5% or less, the GO should send a letter to the Transmission Planner stating the facts and circumstances of each generator that meet this exemption.

Unit 1 is selected for model verification and the required model and verification is submitted. Unit 2 and 3 submit their required model data and state they are sister units to Unit 1 which was verified.

Question 1:  Is this all that is required or would there need to be additional information for a sister unit?

Units 2 and 3 that meet the equivalency criteria documented in NERC Standards MOD-026-1, Attachment 1, Row Number 4, Verification Condition section (see below) and the MOD-027-1, Attachment 1, Row Number 5,  Verification Condition section (see below), necessitate completion of the corresponding Required Action sections of Attachment 1 for both NERC Standards.  If Entergy Units 2 and 3 do not meet the equivalency criteria, individual unit modeling and verification will be required for both Units 2 and 3. 

Please note that verification of a “different” equivalent unit during each 10-year verification period is required and that MOD-026-1/MOD-027-1, Attachment 1, Row 1, applies when calculating generator fleet compliance during the 10-year implementation period.

Also, please note that all Units that implement system changes after initial models have been verified are subject to MOD-026-1 R4 and MOD-027-1 R4 compliance and the obligation to notify its Transmission Planner within 180 calendar days of making system “changes”.

Later, Unit 1 upgrades is control system and performs model verification and submits the required data.

Question 2:  Would Unit 2 or 3 need to perform model verification since the original verification was performed for Unit 1?

Units 2 and 3 that meet the equivalency criteria documented in NERC Standards MOD-026-1, Attachment 1, Row Number 4, Verification Condition section (see below) and the MOD-027-1, Attachment 1, Row Number 5,  Verification Condition section (see below), necessitate completion of the corresponding Required Action sections of Attachment 1 for both NERC Standards.  If Units 2 and 3 do not meet the equivalency criteria for the model that was verified, individual unit modeling and verification will be required for both Units 2 and 3.

After the Unit 1 upgrade, Unit 2 upgrades is control system which is identical to Unit 1. 

Question 3:  If the control system, parameters, and settings are the same as Unit 1, does Unit 2 need to perform model verification or is it covered as a sister unit?

If Unit 2 does not meet the equivalency criteria documented in NERC Standards MOD-026-1, Attachment 1, Row Number 4, Verification Condition section (see below) and the MOD-027-1, Attachment 1, Row Number 5,  Verification Condition section (see below), completion of the corresponding Required Action sections of Attachment 1 for both NERC Standards is required.  If Unit 2 does meet the equivalency criteria, as stated above, it may qualify as an equivalent unit.

October 18, 2019
Do I include the combined-cycle steam turbines that meet Attachment 1, Row 7 in the total MVA calculation to determine applicable percent complete?  What about a unit that is retiring in 2023 before the 100% deadline?  Or, an existing unit that is being repowered in 2021 with different characteristics?  I am looking for guidance on the total MVA included units.

Yes, combined-cycle steam turbines, as shown in Attachment 1, Row 7 that meet the applicable facility as listed in MOD-027-1, should be included in determining the entity’s total MVA. The standard does not have any provisions to exclude these units from the total MVA calculation. A written statement must be provided to the TP showing compliance per Requirement R2, as stated in Attachment 1, Row 7. In accordance with the periodicity specified in MOD-027 Attachment 1. This unit is still applicable to the total MVA calculation until the actual retirement and needs to be included in the total MVA until the retirement date. The key milestone dates and applicable percentages in 2023 must be met. This unit would also be included at its current MVA in the total MVA calculation. Sufficient evidence of its total MVA and percentage of MVA prior to the repower event in 2021 should be provided to the TP. If the unit MVA changes during the repower operation in 2021, retain and provide evidence of the change in the unit MVA and total MVA. The key milestone dates and applicable percentages prior to and after the repower event in 2021 must be met.

Per MOD-026 and MOD-027, if you have existing applicable units that have a current average net capacity factor over the most recent three calendar years, beginning on January 1 and ending on December 31 of 5% or less, they are eligible for a capacity factor exemption. A written statement to the Transmission Planner stating that an exemption is being applied is required.

The 10-year timeframe begins on the date of the written submittal.

• NERC Alert A-2015-02-02-01, Generator Governor Frequency Response
• Memo from Nano Sierra (FERC) to the ERAG MMWG dated September 9, 2010
• Memo from Nano Sierra (FERC) to the ERAG MMWG dated April 27, 2011
• Memo from ERAG Management Committee to the MMWG dated April 28, 2011
• Email providing FRCC’s response to the September 9, 2010 FERC memo
• MMWG Procedure Manual, page 42, section 9.2.D.2

Based on these documents, our Transmission Planner does not include nuclear plant governors in their system models.

The question is, can the nuclear industry get an exemption from the MOD-027-1 reporting requirement to provide governor models to our Transmission Planner since they are not going to use them?

If the planner does not use the data, is it necessary?

Auditors are required to audit to the standard as written. The standard includes an exclusion (MOD-027-1 Attachment 1). 

Follow-up question to above. They would like to include steam turbine generators for Combined Cycle plants to the question to SERC on MOD-027 applicability.

“Though we don’t have the “paper trail” of documents for them like we do for nuclear, these [Combined Cycle] units run with their steam valves wide open and, as such, do not respond to grid frequency deviations.  For this reason, our Transmission Planner does not include their governors in the models either.”

Auditors are required to audit to the standard as written.

MOD-027-1 Requirement R2 Part 2.1.1. allows entities to use frequency excursion event data to verify the Generator Owner’s turbine/governor and load control or active power/frequency control model.

Question 1:  Attachment 1 Row 3 “Verification Condition” states, “Applicable unit is not subjected to a frequency excursion per Note 1 by the date otherwise required to meet the dates per Rows 1, 2, 4, or 6.”   Row 3 “Required Action” states, “Requirement 2 is met with a written statement to that effect transmitted to the Transmission Planner,” and then states, “Transmit the verified model, documentation and data to the Transmission Planner on or before 365 calendar days after a frequency excursion per Note 1 occurs and the recording equipment captures the applicable unit’s real power response as expected.”

Is Row 3 allowing an applicable unit to exceed its verification date (Row 1 phased implementation, Row 2 periodic 10 year verification, Row 4 new unit/equipment verification, or Row 6 verification plan) by submitting a statement to the Transmission Planner stating that it is waiting for a frequency excursion event?  And that when a frequency excursion event does occur, Row 3 is stating that the verification report be sent to the Transmission Planner within 365 calendar days of when the frequency event occurred?

Yes. Based on the information provided, once the frequency excursion event occurs, the clock starts on the 365 days for the verification report to be sent to the Transmission Planner.

Question 2:  Other than Row 3, is there any requirement which limits the use of historical operating data for a frequency excursion event?  The MOD-025-2 standard limits the use of historical operating data to within two years prior to when the real or reactive power verification performed.

Not at this time.

Question 3:  Other than Row 3, is there any requirement which requires the verification report be submitted within a specific time-frame to the Transmission Planner for a frequency excursion event?  The MOD-025-2 standard places a 90 calendar day time-frame to submit a verification report from when historical operating data is selected or when test data is recorded.

Not at this time.

MOD-031-1 is part of the ongoing annual process for Planning Coordinators and Balancing Authorities to collect demand, energy, and related data to support reliability studies and assessments. The schedule for issuing data request should continue to follow the normal data request process that has been established. Any data request issued after 7/1/16 should be compliant with MOD-031-1. Any data request issued after 10/1/16 should be compliant with MOD-031-2.

No. However, according to MOD-025-2, MOD-026-1 and MOD-027-1 each Generator Owner shall provide its Transmission Planner with verified Generator data.

We are planning our testing for NERC standards MOD-026 and MOD-027. I wanted to ask for information on coordinating this testing with SERC. We are planning on performing the tests in 2017, but do not have any dates at this time. I would like to have this information for planning of the tests.

There are no requirements to coordinate with SERC during the development of the control models required by MOD-026-1 and MOD-027-1.  If you have specific Reliability Standards related questions, please submit those questions via the SERC FAQ process.

For an entity that is a member of PJM (where PJM would be the RC, BA and TOP), is the “Real-time operator” considered to be PJM or the operator at the entity who receives directions from PJM?  

PJM requires the entity operators to be PJM Certified but not NERC Certified.  Would NERC require the entity’s operators to be NERC Certified based upon the requirements of PER-003-2?       

If you’re performing reliability related tasks pertinent to RC, BA, or TOP, you need to be NERC Certified at that specific level.

PJM Manual 40 Rev 20- Effective 1/24/2019 / Sec 3.2.1 Transmission Owner Operators, subsection NERC Certification, states operators must be NERC Certified.

PER-005-2 does not require entities to separate reliability related tasks from desk qualifications. An entity should keep compliance with PER-005-2 in mind when deciding to separate or not separate.

The entity should provide data or evidence of compliance that shows that it has reviewed, and updated, if necessary, its list of BES company specific Real-time reliability-related tasks identified in PER-005-2 Requirement R1 part 1.1 each calendar year. The entity shall keep data or evidence to show compliance for three years or since its last compliance audit, whichever time frame is greater, unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.

I have three questions related to PER-006-1 R1 that will be active on 10/1/2020.

Will we need to have trained all real-time plant control operators by 10/1/2020, or is there an expected time-frame that is reasonable to train?
NERC Standard PER-006-1 implementation plan requires the entity to be compliant by the effective date of 10/1/2020. Therefore, the Generator Operator will be required to have completed the necessary training by that date.

New team members will need to be trained within how much time?
The Standard does not specify a timeframe that training must be completed by new applicable plant personnel that have been hired after 10/1/2020. The Generator Operator should consider that they provide training in a reasonable timeframe to ensure that reliable Real-time operations of the Bulk Electric System will not be jeopardized.

If a contractor operates the solar sites, can a small portion that only applies to solar be the only subset trained?
The NERC registered Generator Operator is responsible to ensure that training has been provided to any plant personnel, contracted or entity employee, who is responsible for the Real-time control of a generator and receive Operating Instructions from the Generator Operator’s Reliability Coordinator, Balancing Authority, Transmission Operator, or centrally located dispatch center.

The Reliability Standard is applicable to registered Generator Operators regardless of voltage, generating capacity, or point of interconnection.

PRC-001 R1 states that the GOP needs to be familiar with the purpose and limitations of protection system schemes applied in its area.  Is there specific guidance from SERC on what SERC believes is good evidence and who specifically is the target audience for the training?

For this Reliability Standard, GOP is defined as the Registered Entity and not the person sitting on the desk.  There should be staff or contractor(s) available to address protection systems issues as they arise.  Staff could include the actual operator, electricians, instrumentation crew, etc. Training records, qualification records, etc. have been used as evidence of compliance in the past. The key question is: who is contacted to decide what to do when a protection device is triggered?  Is it the operator or other staff?

1. Under R3 if the settings or set points stayed the same with a change out, do you need to coordinate?
2. When the standard says coordinate when you have changes to protection systems is that directed at when performance changes and if the performance does not change then no coordination is needed?

Responses

1. The standard states all new and changes to protective systems shall be coordinated. In a circumstance where the settings or set points stay the same as a result of a protective systems change out, at a minimum a notification shall be made to the appropriate entity indicating no setting changes resulted from the protective systems change out.
2. Whether or not the performance of the protective systems change, a notification shall be made to the appropriate entity when performance changes evidence of a relay coordination study or a letter of agreement on the settings between the responsible entities is required.

Question 1:
As of July 1, 2016, registered entities must be compliant with PRC-002-2, R1.1 and R5.1.  Compliance with R1.1 and R5.1 determines the number of devices that an entity must install. Once the number of devices is determined, then the registered entity shall be at least 50 percent compliant by July 1, 2020.

Example: Suppose an entity must install five (5) devices identified by R1.1 and R5.1. For 50 percent compliance, five devices * 50 percent = 2.5 devices; and rounded up to the nearest whole number equals three (3) devices that must be installed by July 1, 2020.  The remaining two (2) devices must be compliant by July 1, 2022.

Question 2:
Per the PRC-002-2 Implementation Plan, registered entities that own only one (1) identified BES bus, BES Element, or generating unit shall be fully compliant within six (6) years of the effective date (July 1, 2022).

Yes. The DDR should be located between the high/low-side of the GSU and the interconnection with the network transmission.  The basis for this comes from the rationale section in R5 which states: “With the exception of HVDC circuits, DDR data is only required for one end or terminal of the BES Elements selected. For example, DDR data must be provided for at least one terminal of a Transmission Line or generator step-up (GSU) transformer, but not both terminals. For an interconnection between two Responsible Entities, each Responsible Entity will consider this interconnection independently, and are expected to work cooperatively to determine how to monitor the BES Elements that require DDR data. For an interconnection between two TOs, or a TO and a GO, the Responsible Entity will determine which entity will provide the data.”

PRC-002-2
R12. Each Transmission Owner and Generator Owner shall, within 90-calendar days of the discovery of a failure of the recording capability for the SER, FR or DDR data, either: [Violation Risk Factor: Lower] [Time Horizon: Long-term Planning]

• Restore the recording capability, or
• Submit a Corrective Action Plan (CAP) to the Regional Entity and implement it.

Registered entities should provide CAPs relevant to PRC-002-2, R12 to SERC via SERCComply@SERC1.org. The CAP must contain a list of actions and an associated timetable for implementation to remedy a specific problem. Form and format is at the discretion of the registered entity.

• Must the entity comply with R12 for these devices now; and
• Must the entity retain evidence of these devices complying with the SER, FR, or DDR data recording capability requirements?

The R12 reporting process should be used for failure of SER, FR, or DDR equipment in locations required by PRC-002-2 R1 and R5.  If an entity has devices installed at locations not required by PRC-002-2, R1 and R5 reporting via the R12 process is not required.

The multi-regional registered entity shall follow the reporting protocol of the lead regional entity for submission of Corrective Action Plan(s) in accordance with PRC-002-2, R12. The lead regional entity will coordinate activity with any affected regional entity.

R5. Each Transmission Owner, Generator Owner, and Distribution Provider that owns the Protection System component(s) that caused the Misoperation shall, within 60 calendar days of first identifying a cause of the Misoperation: [Violation Risk Factor: High]

[Time Horizon: Operations Planning, Long-Term Planning]

• Develop a Corrective Action Plan (CAP) for the identified Protection System component(s), and an evaluation of the CAP’s applicability to the entity’s other Protection Systems including other locations; or
• Explain in a declaration why corrective actions are beyond the entity’s control or would not improve BES reliability, and that no further corrective actions will be taken.

Question:
My question is in regards to an entity that is registered as a JRO for multiple other independent companies that would be registered as a TO if another entity was not registered as a JRO on their behalf. When applying the following portion of PRC-004-4(i) R5: “Develop a Corrective Action Plan (CAP) for the identified Protection System component(s), and an evaluation of the CAP’s applicability to the entity’s other Protection Systems including other locations,” should the CAP for the Protection System components be evaluated across all independent entities registered within the JRO, or should the CAP just be evaluated  only within Protection System components within the singular independent company?

The CAP needs to be evaluated only within Protection System components within the singular independent company.  From a BES reliability perspective, the JRO should communicate the CAP to all independent entities for their benefit.

August 22, 2018
We recently completed PRC-005 battery load testing. A battery string has failed the load test, and it will be replaced with new batteries. Are we required to load test the new battery string, or should the next load test be done during the next testing interval?

Per Table 1-4(a), Verification that the station battery can perform as manufactured by conducting a performance capacity test is a required maintenance activity that must be performed when replacing a component of a Protection System.  Any Protection System element that receives a failed test result must be resolved and documented prior the end of the maintenance interval. Once the corrective actions have been completed, the maintenance records shall be updated to reflect the successful results.

May 4, 2017
PRC-005:  Timers are not defined.  Are timers considered protective equipment?

Yes, because timers are essential for the proper operation of the protection system.

Where PRC-005 equipment is owned by Registered Entity A but used by Registered Entity B for a protection system applicable to PRC-005, which Registered Entity is responsible to demonstrate compliance?

For previous guidance please refer to March 17, 2014 PRC-005 SERC lesson learned.
Both will be reviewed to identify which Registered Entity maintains and which Registered Entity coordinates the protection systems equipment.  Documents stating which Registered Entity performs which duties help the audit team quickly identify the responsible party.

Yes, if the batteries are in use for a period of time greater than the minimum testing interval for batteries (four months).

April 6, 2020
Can I get an interpretation of the meaning of distributed UFLS and nondistributed UFLS? These terms are not defined in PRC-005 or the Glossary of Terms. Additionally, can someone direct me to the appropriate table that addresses batteries (Vented Lead Acid) for distributed UFLS?  

A distributed UFLS or UVLS scheme contains individual relays, which make independent Load shed decisions based on applied settings and localized voltage and/or current inputs.

A non‐distributed UFLS or UVLS scheme involves a system where there is some type of centralized measurement and Load shed decision being made. 

A non‐distributed UFLS/UVLS scheme is comparable to an SPS scheme. 

If the Vented Lead Acid battery bank associated with the distributed UFLS serves both a BES device, as well as a non-BES interrupting device used for UFLS. In such case, the battery bank will be subject to Table 1-4(a), if it not the case use Table 3 Protection System dc supply.

Description of the Violation, Issue, or Trend
As generating units are being retired, Protection System maintenance and testing activities required by PRC-005 can be problematic if Generator Owners (GO) and Transmission Owners (TO) do not successfully address the Protection System components that will remain in service after the unit has been retired. There have been instances where the Protection System devices that had been the responsibility of the GO prior to the retirement of the unit remained in service after the retirement and became the responsibility of the TO.  The unsuccessful transfer of that responsibility has resulted in noncompliance for some Registered Entities.

Risk Considerations
The risk to the BPS depends on the number and types of devices involved.

Description of Mitigation Activity
Registered Entities can mitigate or prevent the violation by incorporating a review of the roles and responsibilities of Protection System devices associated with generating facilities into the unit retirement process.

Description of the Violation, Issue, or Trend
Lack of verification of routine maintenance and testing work performed by contractors led to the following: 

1. Work-orders being closed-out as completed in the database when the work had not been performed
2. Incomplete maintenance and testing documentation caused Protection System device testing and maintenance to be missed and/or test results to not be entered into the database
3. Records were not retained by either the Registered Entity or the contractor as evidence

Risk Considerations
In general, this type of violation poses a minimal to moderate risk to the BPS depending on the number and types of devices involved.

Description of Mitigation Activity
Registered Entities have mitigated the violation in several ways:

1. Enhanced their procedures for scoping contracted projects
2. Implemented requirements for contractors to provide all maintenance and test records as part of the project documentation 
3. Performed a thorough review of the documentation to verify completion of the work orders

Other Factors or Comments
Lack of oversight due to weak internal controls is a common factor.

Description of the Violation, Issue, or Trend
Large construction projects performed by contractors resulted in newly installed Protection System devices not to be entered into the Registered Entity database. Therefore, maintenance and testing was not conducted.

Risk Considerations
In general, this type violation poses a moderate risk to the BPS because of the potential for maintenance and testing on these Protection System devices to be missed for an extended period of time.

Description of Mitigation Activity
Registered Entities have mitigated the violation by revising procedures for construction projects with PRC-005 implications to include special consideration for contractor work to ensure compliance with the Registered Entity PRC-005 program.

Other Factors or Comments
Registered Entities typically utilize contractors in large construction projects. Failure to follow internal procedures for the handling of records has occurred due to the work being done by contractors and not Registered Entity employees resulting in devices not being entered in the database.

What “auxiliary relays” must be included in the Protection System Maintenance Plan in order to be compliant with PRC-005-6?

The Protection Systems addressed by PRC-005-6 are defined as the Protection Systems that are “installed for the purpose of detecting Faults on Bulk Electric System elements (lines, buses, transformers, etc.).” The “auxiliary relays” are relays that may be in the trip circuit between the trip coil of the circuit breaker or lockout relay and the fault detection relay.   Those “auxiliary relays” and their output contacts must be tested as part of the DC control circuits of the protection system (see Table 1-5).

While other protection systems (such as those included for fire, loss of cooling, overexcitation, vibration, loss of fuel and host of others) may be present, they are not included in the definition of transmission Protection System or generator Protections System for purposes of PRC-005-6.  Later versions of PRC-005 may include specific system/devices such as those mentioned, but they are exempt from compliance until such time as they are included in an approved implementation plan. Of course, registered entities are encouraged to periodically test those functions, but it is not necessary to include them as part of the PSMP.

PRC-005-2 - Supplemental Information, Section 15.4:  Can SERC provide clarity regarding communication system batteries not being considered as applicable to V2?

PRC-005-2 applies to station batteries that supply trip current to the trip coils of the interrupting devices that are part of a Protection System.

Batteries used for the sole purpose of supplying power for communication facilities are not included.

If a Registered Entity decides to implement more stringent requirements than the Reliability Standard, is the Registered Entity going to be audited to the implementing procedures or to the NERC Standard Requirements?

For example, if the Registered Entity's maintenance and testing program requires relays to be calibrated every two years and the Registered Entity goes beyond two years (but within the table in PRC-005-2 of six years), is the Registered Entity going to be held accountable to the implementing procedure? 

The intervals specified in PRC-005-2 govern.  The program must be conducted in accordance with PRC-005-2.  For example, your interval is four years, the PRC-005-2 specified interval is six years, and maintenance is conducted in five years.  That is not an issue.

How will SERC audit PRC-005-2?

In accordance with the implementation plan, each TO, GO, and DP shall maintain documentation to demonstrate compliance with PRC-005-1b, PRC-008-0, PRC-011-0, and PRC-017-0 until that registered entity meets the requirements of PRC-005-2. Each registered entity shall be responsible for maintaining each of their Protection System components according to their maintenance program already in place for the legacy standards (PRC-005-1b, PRC-008-0, PRC-011-0, and PRC-017-0) or according to their maintenance program for PRC-005-2, but not both. Once a registered entity has designated PRC-005-2 as its maintenance program for specific Protection System components, it cannot revert to the original program for those components. While registered entities are transitioning to the requirements of PRC-005-2, each entity must be prepared to identify:

• All of its applicable Protection System components; and
• Whether each component has last been maintained according to PRC-005-2 or under PRC-005-1b, PRC-008-0, PRC-011-0, or PRC-017-0.

For activities being added to a registered entity’s program as part of PRC-005-2 implementation, evidence may be available to show only a single performance of the activity until two maintenance intervals have transpired following initial implementation of PRC-005-2.

An entity has a BES carrier set powered by a customer-owned DC system at a customer owned substation.  Does the registered entity have any maintenance or testing compliance responsibilities related to PRC 005-2 for the batteries or charger at this type of location?

For general information on components considered to be in scope for PRC-005, see Figure 1 and 2 Legend – components of Protection Systems in Supplementary Reference and FAQ PRC-005-X Protection System Maintenance April 2014. The legend describes station DC supply batteries, battery chargers, and any control power system which has the function of supplying power to the protective relays, associated trip circuits and trip coils. It excludes “any power supplies that are not used to power protective relays or their associated trip circuits and trip coils.”

It also explains that communications systems necessary for correct operation of protective functions include “tele‐protection equipment used to convey specific information, in the form of analog or digital signals, necessary for the correct operation of protective functions” and exclude “any communications equipment that is not used to convey information necessary for the correct operation of protective functions." If the battery and charger are elements of an applicable communication system, they should be maintained as part of the communication system. See PRC-005-2 Table 1-2 for the minimum expected maintenance and testing activities.

Yes. The path between the UFLS relay and the multifunction relay should be tested every 12 years.

Yes, timing relays are essential to the proper functioning of the Protection System and should be calibrated at the same frequency of the relay.

An entity cannot transition a component to the PRC-005-2 program until it has performed all PRC-005-2 maintenance activities.  An entity can only maintain the component in one version of the standard, no revision is allowed.  New components placed in service after April 1, 2015 must be maintained in accordance with PRC-005-2.

Example of Complete Trip Path Testing from Table 1-5 Using Overlap from Table 1-1:

Table 1-1 6Y Activity

1) Test Equipment is connected to the Protective Relay Inputs (via test block) to inject a voltage signal to simulate conditions to pick up the protective relay (outputs are isolated via test block);

2) Output voltage (or continuity from closed contact) is monitored to ensure the protective relay picked up;

3) Current is injected into the circuit to operate the protective relay target (where applicable);

Table 1-5 12Y (non-SPS) Activity

4) DC voltage is jumped to the output of the protective relay and the next trip path component (Aux Relay/Timer) is verified to have operated appropriately,

5) The LOR is electrically operated to actuate the breaker trip coil.

Question 1:
If a unit has the ability to run back to 50% power if one generator CB trips, would this scheme be part of PRC-005-2 or only that the unit would trip for loss of both generator CBs? We need to know specifically if it is the tripping of any Generator Circuit Breaker or if NERC only cares if you completely trip the unit from the grid.

Tripping the entire generator or adjusting the generator to protect BES Facilities (e.g., electrical path of generator, GSU, or other equipment) to maintain system stability, acceptable voltage, or power flows would meet the definition of SPS/RAS and is included in the scope of facilities to be maintained under PRC-005-2 and PRC-005-6. If the runback scheme is initiated to protect the turbine from overspeed or other turbine condition, this is not considered an SPS/RAS. 

Question 2:
PRC-005-2: Is Periodic calibration of Timing Relays required? If so, what frequency? (These relays do not sense voltage or current, but their function is vital to the operation of the circuit trip path)

Follow up response and question based on SERC response:
If timing relay calibrations are required, we need clear guidance on what is required and which table to use for these calibrations. In addition, this needs to be clear in order to determine the correct maintenance timeframe (6Y or a 12Y).

Any input or output of the Protective Relay that “affects the tripping” is included as essential to the proper functioning of the Protective Relays and should be tested for proper operation at the same interval as the Protection Relay.  Each input should be “picked up” or “turned on and off” and verified as changing state by the relay. Therefore, testing for proper operation, not calibration, of the timing relays is required.

Question 3:
The response did not answer the question. We are specifically questioning the method to meet Table 1-5 by using overlap from Table 1-1. Table 1-1 is the only table which includes protective relays and Table 1-5 is for the control circuitry for protective functions. We need to determine if example below using overlap meets the intent of Table 1-5 or if passing current through the relay output contacts to pick up a downstream device without using overlap is required.

It appears the example given does meet most of the requirements of Table 1-5.  In addition, ensure trip coil testing includes operation of the interrupting device.

Below is a proposed method for microprocessor relay testing developed to satisfy requirements of PRC-005-2.

1. Test Current Transformers (CTs) and Potential Transformers (PTs) at the same time as the relays because they are the inputs to the relays.
2. Verify the microprocessor settings file is the same as what the registered entity has on record.
3. Use a fluke meter to measure the inputs the relay is presently seeing, and compare that value to what the relay is reading.
4. Pulse the relay output to the auxiliary relay to verify the output signal.

The registered entity would use the above method instead of testing each individual element in the relay.  The reasoning behind this is that the relay is microprocessor-based. Therefore, there are no mechanical components that change. If the input is reading correctly and the output is functioning, the relay is operating properly. The registered entity would only test and verify the individual elements in the event of settings changes.

Can you provide any feedback on this method?

When verifying the microprocessor relay settings, ensure that each setting in the relay is compared to a known specified value. Using a meter to measure the values of CT/PT inputs is an acceptable method to obtain a value to compare with the relay value or other device measuring the same current/voltage.  Pulsing the relay to provide a signal to an auxiliary relay should also include verification of the signal through the trip coil circuit of the auxiliary relay. Overall, the testing should verify that all inputs, outputs, and trip circuitry necessary for the proper operation of the Protection System function as designed.

For PRC-005-2, can SERC provide guidance on the percentage implementation and if it is based on Registration or by individual generator?

Percentage implementation for PRC-005-2 R3 and R4 is not based on Registration or individual generators, but rather is dependent on the percentage of Protection System Components that are maintained under the maintenance programs described in the Standard.  Protection System Components are defined in Tables 1-1, 1-2, 1-3, 1-4, 2, and 3 of PRC-005-2.  Certain percentages of Protection System Components must be compliant with R3 and R4 by specific dates, with the percentages based on the allowable maintenance interval for the given Component type.

PRC-005-2 R1, R2, and R5 do not allow for phased-in compliance.  Only R3 and R4 allow for various percentages to be met at different times.

The details of enforcement dates and percentages with respect to the various Requirements can be found on pages 4-6 of the PRC-005-2 Implementation Plan.

PRC-005-6 standard addresses Protection Systems that are installed for the purpose of detecting Faults on BES Elements.  Breaker failure relaying is the use of a current monitoring relay to determine whether or not current continues to flow into a faulted circuit sometime after a circuit breaker has been instructed to interrupt the circuit.  Therefore any breaker failure relay that detects the failure of a breaker that is defined as a BES breaker, or non-BES breaker that trips a single BES generator, or an aggregate of BES generators is considered an applicable relay that would fall under the testing requirements of PRC-005-6.

1. We did not include excitation transformer protection relays in our V1.1b program.  Since the excitation transformers connect directly to the generator bus the relays are now included in versions 2 through 6.  My question is should we have included them in our V1.1b program, or can we use the V2 implementation plan and phase them in?  Per our V1.1b program, we would need to test both units’ relays by the end of the 2016 calendar year instead of being able to wait until 4/1/17 and 4/1/19 to complete the testing under the V2 implementation plan.
2. Are AVRs generally considered part of a Protection System?  I don’t consider them to meet the definition of Protection System, but we’ve had some discussion back and forth and want to make sure we got it right.  I looked through the PRC-005 FAQ document and can’t find anything that addresses an AVR.

Question 1
Excitation transformers were not explicitly listed in PRC-005-1.1b, and not all entities include these components in their Protection System Maintenance Program (PSMP).  Entities should transition these components to PRC-005-2(i) as soon as practical, but no later than the dates allowed by the component milestone dates in the PRC-005-2(i) implementation plan. 

Note:  PRC-005-2(i) Implementation Plan will be retired 12/31/2016 and superseded with the PRC-005-6 Implementation Plan. 

Question 2
If the Automatic Voltage Regulating (AVR) system is configured to trip a BES generator either directly or via lockout or auxiliary tripping relays, then the associated Protection System components should be included in the PSMP. In addition, PRC-019-2 requires that the AVR control settings be coordinated at least every five (5) calendar years.

Question - Does "alarming for loss of function", as used in the table, refer to alarming the loss of the channel function only; or does it also include alarming the loss of the other associated communications equipment (i.e.,  relay panel  transmitters, and receivers) that makes up the overall communications system?  Please also reference Section "15.5.1 Frequently Asked Questions" in the NERC "Supplementary Reference and FAQ – PRC-005-6 Protection System, Automatic Reclosing, and Sudden Pressure Relaying Maintenance and Testing" dated October 2015.

The alarming for loss of function encompasses everything from the alarm origin to the location that corrective action can be initiated. This would include all associated communication equipment between these two points.

1. For Automatic Reclosing Components, Sudden Pressure Relaying Components, and dispersed generation resources maintenance activities with maximum allowable intervals of six (6) calendar years, as established in Tables 4‐1, 4‐2(a), 4‐2(b), 4‐3, and 5:

• The entity shall be at least 30% compliant on the first day of the first calendar quarter thirty‐six (36) months following applicable regulatory approval of PRC‐005‐6 (or, for generating plants with scheduled outage intervals exceeding three years, at the conclusion of the first succeeding maintenance outage) or, in those jurisdictions where no regulatory approval is required, on the first day of the first calendar quarter forty‐eight (48) months following NERC Board of Trustees’ adoption of PRC‐005‐6 or as otherwise made effective pursuant to the laws applicable to such ERO governmental authorities.

Is the correct date for this 30% threshold 1/1/2018?

The 30 percent milestone date of compliance for Automatic Reclosing, Sudden Pressure and Dispersed Generation Resources is January 1, 2019.

• Are Modern AVRs, which are microprocessor based and trip the generator under certain conditions, also subject to PRC-005-6 requirements?
• If yes, which functions of AVRs which trip the unit are under the scope of the standard?
• What are the requirements for testing these functions which are not provided by discrete relays but are written in the software?

The Applicability section of NERC Standard PRC-005-6 specifically addresses “Protection Systems … installed for the purpose of detecting Faults on BES Elements,” and this would appear to bring such non-BES Protection Systems into the scope of PRC-005-6.

Question
Are Transmission Protection Systems that are designed to detect faults on BES Elements in order to isolate non-BES generation facilities from the transmission network to be included in an entity’s program for compliance with PRC-005-6?

For a protection system that detects a fault on the BES to be excluded from applicability of PRC-005-6, the protection system must meet all the following criteria:

Sudden Pressure Relaying (SPR) installed on distribution transformers are not included in PRC-005-6. Applicability as listed in 4.2.1, 4.2.5, and 4.2.6 describes which SPRs are applicable to the standard.

Does PRC-005-6 R1 require a maintenance and testing program for potential transformers (PTs) whose function is to protect buses within the plant that provide power to the plant for auxiliary equipment to operate while the plant is out-of-service?

As referenced in 4.2.5.1 of the Standard, PRC-005-6 requires maintenance and testing for “Protection Systems that act to trip the generator either directly or via lockout or auxiliary tripping relays.”

Relays and their associated components, which are designed to trip breakers serving station auxiliary, need not be included in the program.

March 5, 2020
I am seeking clarification of the PRC-005-6 provisions for monitoring and alarming of protection system components. I am working with a generation facility that is only staffed Monday through Friday during normal business hours unless they have an operating schedule. The Facility is interested in installing a battery monitoring system to monitor many of the parameters that are required per the PRC-005-6. However, as the Facility is unmanned over the weekend they would not be able to meet the 24 hour provisions called out in table 2 of the standard. The monitoring system would have an audible alarm associated with it, so as soon as the facility was manned any alarm would be received and corrective action initiated. In this scenario, would the monitoring and alarming system be sufficient to extend and/or reduce the maintenance activities as outlined in table 1-4(f) of the standard?

Per the standard, the alarm circuits must alert, within 24 hours, at a location wherein corrective action can be initiated. As stated in your question, there is more than a 24 hour gap in coverage throughout the weekend. Therefore, the alarm attributes used to justify extended maximum maintenance intervals and/or reduced maintenance activities does not meet the requirement for a monitored system.

If UFLS protection is added to the breaker bypass relay then more load will be shed than necessary when the breaker is out for maintenance, because the load at the substation would also be tripped off. If UFLS protection is not added to breaker bypass relay, then load will not be shed when the breaker is out for maintenance.

Revised Response:
If the breaker is part of a UFLS design scheme, the bypass configuration should also perform the intended design function for the UFLS scheme during maintenance, unless the percent of load shedding to be implemented can be met without the contribution of the breaker undergoing maintenance.

The NERC glossary defines Peak Demand as:

1. The highest hourly integrated Net Energy For Load within a Balancing Authority Area occurring within a given period (e.g., day, month, season, or year).
2. The highest instantaneous demand within the Balancing Authority Area.
   1. What is the given period for PRC-006-SERC R4?
   2. Is it the previous calendar year of January 1 – December 31?
   3. Can an entity choose between summer and winter peak, or do they have to use the greater of the two?

The given period for PRC-006-SERC-01 is the previous calendar year of January 1 – December 31.

The answer is based on the following language from PRC-006-1

R1. Each Planning Coordinator shall develop and document criteria, including consideration of historical events and system studies, to select portions of the Bulk Electric System (BES), including interconnected portions of the BES in adjacent Planning Coordinator areas and Regional Entity areas that may form islands.

R2. Each Planning Coordinator shall identify one or more islands to serve as a basis for designing its UFLS program…

R5. Each Planning Coordinator, whose area or portions of whose area is part of an island identified by it or another Planning Coordinator which includes multiple Planning Coordinator areas or portions of those areas, shall coordinate its UFLS program design with all other Planning Coordinators whose areas or portions of whose areas are also part of the same identified island …

Note that we are talking about UFLS for an island and the island can be as large as a Regional Entity (SERC)

In the scenario, generation in A is supplying load in B via a pseudo tie.  If the load in B changes, then ACE in A changes and BA A responds.  Frequency in A will be the same as B.  If UFLS action is needed, it will be needed in both areas.  If both A and B have included the load at B in their calculations and take credit for the load, the system may not shed enough load to make a difference on the interconnection.  Therefore, either A or B should take the load, but not both.  The question becomes, which one should take it?  For that answer, we look at the islanded situation where the pseudo tie is broken.

I have a compliance / implementation question around the inter-relationship between PRC-006-2 and PRC-024-2. 

The implementation plan for PRC-006-1 (now PRC-006-2) states that, for Requirement R4, “Parts 4.1 through 4.6 of Requirement R4 shall become effective and enforceable one year following the receipt of generation data as required in PRC-024-1”.  Requirement R4 requires PCs to conduct a UFLS design assessment “at least once every five years that determines through dynamic simulation whether the UFLS program design meets the performance characteristics in Requirement R3 for each island identified in Requirement R2.”  Parts 4.1 through 4.7 specify things to model in the dynamic simulations, with Parts 4.1 through 4.6 being linked to PRC-024-1.

The implementation plan for PRC-024-1 (now PRC-024-2) requires Generator Owners to reach initial compliance in four stages.

•  40% of applicable Facilities compliant by 7/1/2016
•  60% of applicable Facilities compliant by 7/1/2017
•  80% of applicable Facilities compliant by 7/1/2018
• 100% of applicable Facilities compliant by 7/1/2019

I understand that the SERC DSG has outlined the scope for a UFLS study to be performed this year (attached).  This study should help facilitate the PCs within SERC being able to comply with the “at least once every five years” aspect of PRC-006-2 R4, as the last regional UFLS study was completed in 2012.  Presumably, the PCs within SERC will be able to request and utilize PRC-024-2 data from GOs within their footprint that are meeting the above PRC-024-2 milestone dates.

My question is: What is the ERO’s intent for PCs complying with PRC-006-2 R4 during the initial phase-in of PRC-024-2?  Following completion of the SERC UFLS study in 2017, is there an expectation that the SERC PCs will also perform simulation-based UFLS assessments in 2018, 2019, and 2020 (one year following each PRC-024-2 milestones above)?  Or, is the compliance expectation that PCs in SERC shall complete their next PRC-006-2 R4 assessment in 2022 (five years after 2017)?

If a Planning Coordinator uses a 2017 SERC DSG UFLS design assessment, the next design assessment will not be required until 2022.  The generator “no trip zone” as prescribed in PRC-024-2 Attachment 1 and Attachment 2 will not change.  For instances where generators are unable to meet the relay setting criteria described in PRC-024-2 Attachment 1 and Attachment 2 these should be documented in accordance with PRC-024-2 R3.

The operator is a company that both owns and operates a number of facilities throughout the country and generally combines this under a single GO/GOP registration per region.  However, the facility in question has separate GO and GOP registrations that reflects only that plant due to having a separate ownership structure. 

The question is, would the plant have to be 100% compliant as of July 1 or would they be able to be classified as 1 of x number of facilities in the operating company’s fleet and only 40% of those would have to have been compliant on July 1?

The Reliability Standard applies to the Generator Owner function by NCR number.  For applicable individual units at a single generating plant/Facility, the entity must be at least 40 percent compliant as of July 1, 2016.  The units to be compliant is equal to 40% of the total units rounded up to the next whole unit.  Example: (8 units X 40% = 3.2) rounded up would require 4 units to be compliant as of July 1, 2016.

PRC-019, Requirement R1, states “At a maximum of every five calendar years, each Generator Owner and Transmission Owner with applicable Facilities shall coordinate the voltage regulating system controls...”

Question: Our initial coordination study was completed by a third party in 2016 and included required documentation from Section G of the Standard. Therefore, our next analysis would be due in 2021.  For the upcoming 2021 analysis, is it sufficient to state that the plant has not undergone any equipment changes or relay settings changes that would affect the coordination?  The P-Q Diagram, R-X Diagram, and/or Inverse Time Diagrams were reviewed during the initial study, what additional evidence would SERC look for from the 5-year review?

From the perspective of a small generating facility, a full study similar to the initial study requires hiring a third party, and if nothing has changed an entity would be paying them to restate the same information from the 2016 study.

The entity is required to coordinate the voltage regulating system controls every five (5) calendar years after the initial coordination has been completed in accordance with the Implementation Plan. Your next coordination review will be in 2021.

R2 states that we have 90 calendar days following the identification OR implementation of systems, equipment or setting changes to perform the coordination as described in R1.

Facility A is required to be available 24-7 during the summer peak period from June 1 to September 30.  If we assume that the 90 day period starts when PRC-019 took effect on July 1, 2016, then we would have to shut down Facility A for a period of time to implement the settings change during the summer peak period, which can be a reliability issue. 

This is where clarification is needed:  We are interpreting the “OR implementation” to be that we can delay the R1 coordination until we implement the settings change.  Is that correct? 

If so, we could schedule the settings change in October when Facility A is released from its 24-7 obligation; and we would still have 90 days for the R1 coordination.  Correct?

The 90 calendar day window in R2 is focused on the need for setting changes to occur based on an identified coordination problem. The trigger for the 90 day period to begin could be caused by one of the following:

1. Discovery that current settings are not correct;
2. Replacing or installing new equipment or components that require re-coordination of settings; or
3. Changes in the capability or settings of the Facility “unit” or other equipment that affects setting coordination.  

The 90 calendar day window is only applicable to Facilities that are compliant with R1.  If the Facility is not part of the percentage milestone calculation, R2 does not apply.

Example

An entity has 10 generating units.  As of July 1, 2016, four of those units had to be compliant with the standard meaning that the entity completed coordination of the settings on those units in accordance with R1 by July 1, 2016.  The entity is in the process of evaluating the coordination on two more units in order to meet compliance with the 60% milestone by July 1, 2017.  During the settings evaluation, the entity determines that one of the units requires a setting change. The applicable Facility is not included in the 40 percent milestone calculation, therefore the 90 calendar day window does not yet apply.  The coordination change to this unit is required by July 1, 2017 in order to be considered in the 60% compliant calculation.

Please explain how to be compliant and when each is effective. 
SERC cannot comment on how to be compliant. SERC staff is currently reviewing the material to plan the appropriate outreach initiatives. 

Below is the requested effective date information.

PRC-019-1  
  40% of applicable Facilities are to be compliant by 7/1/2016
  60% of applicable Facilities are to be compliant by 7/1/2017
  80% of applicable Facilities are to be compliant by 7/1/2018
  100% of applicable Facilities are to be compliant by 7/1/2019

PRC-024-1  
  40% of Facilities are to be compliant by 7/1/2016
  60% of Facilities are to be compliant by 7/1/2017
  80% of Facilities are to be compliant by 7/1/2018
  100% of Facilities are to be compliant by 7/1/2019

• Precisely 60 months from completion of the last coordination study?
  • For example, if the last study was completed 6/1/2016, the next one must be completed < 6/1/2021
• Do you have until the end of the year five years after the last coordination study was completed?
  • This would be similar to PRC-005-6
  • However, with PRC-005, the terms Calendar Month and Calendar Year are defined in the Supplementary Reference
  • In PRC-005, if the last study was completed 6/1/2016, a five Calendar Year requirement means the next one must be completed < 12/31/2021.

Example 1:
For 50 wind turbines rated at 1.5 MW with one voltage regulation controller at the collector bus, compliance date for voltage regulation controller is 1 unit X 40 percent = 0.4. Rounded up would require the single voltage regulation controller to be compliant as of July 1, 2016.

Example 2:
For 50 wind turbines rated at 1.5 MW with an individual voltage regulation controller on each turbine, compliance date for voltage regulation controllers is 50 units X 40 percent = 20 units to be compliant as of July 1, 2016.

Entities should coordinate voltage regulator with the Facility Protection Systems in a manner to prevent the generator from tripping unnecessarily.

This is regarding PRC-023-2 or 023-3.  Entity X is the TP, and it is not providing the list directly to the GO.  Entity X is requiring that the GO access a secure confidential "extranet."  This is not the same with other TPs that provide the information directly to the registered GO.  This is setting the GO up for an instance where the GO is not specifically informed of being on the list.

This is an issue between the Entity X Registered Entities and Entity X.  The Reliability Standards state that the PC is required to provide the list of circuits to all RE, RC, TO, GO, and DP within their PC area within 30 days of creating the list. If your company is not identified as being on the list, it would be a good practice to confirm this with the PC.

PRC-023-2 and -3:

R6. Each Planning Coordinator shall conduct an assessment at least once each calendar year, with no more than 15 months between assessments, by applying the criteria in Attachment B to determine the circuits in its Planning Coordinator area for which Transmission Owners, Generator Owners, and Distribution Providers must comply with Requirements R1 through R5. The Planning Coordinator shall: [Violation Risk Factor: High] [Time Horizon: Long Term Planning]

6.1 Maintain a list of circuits subject to PRC-023-2 per application of Attachment B, including identification of the first calendar year in which any criterion in Attachment B applies.

6.2 Provide the list of circuits to all Regional Entities, Reliability Coordinators, Transmission Owners, Generator Owners, and Distribution Providers within its Planning Coordinator area within 30 calendar days of the establishment of the initial list and within 30 calendar days of any changes to that list.

Background:
PRC-023-2 included a table of the effective dates of the requirements in PRC-023-2 in Section 5. Effective Dates (pages 1 through 4 of the standard).

PRC-023-3 moved the table of the effective dates of the requirements in PRC-023-3 from the body of the standard to the Implementation Plan for PRC-023-3, Requirements R1 through R6 table on pages 3 through 6 of the PRC-023-3 – Transmission Relay Loadability Implementation Plan document.

PRC-023-4 does not have a table of the effective dates of the requirements in PRC-023-4 in the body of the standard nor in the Implementation Plan for the Revised Definition of “Remedial Action Scheme”, which is associated with PRC-023-4.

We consider the Implementation Plan for PRC-023-3, Requirements R1 through R6 table on pages 3 through 6 of the PRC-023-3 – Transmission Relay Loadability Implementation Plan document to be Effective because we find nothing to indicate that the PRC-023-4 Implementation Plan (transition from SPS to RAS) retires or changes the PRC-023-3 Implementation Plan.

This has come into question by some Registered Entitles because there is no table of the effective dates of the requirements in PRC-023-4 nor its associated Implementation Plan document.

Yes, all aspects of the Implementation Plan for PRC-023-3, Requirements R1 through R6 table on pages 3 through 6 of the PRC-023-3 Transmission Relay Loadability Implementation Plan, will remain applicable to PRC-023-4. Entities with newly classified Remedial Action Schemes (RAS) resulting from the application of the revised definition must be fully compliant with any applicable RAS twenty-four months from the Effective Date of the revised definition of RAS. This additional time applies only to existing schemes that must transition to RAS due to the revised definition. The effective date for the definition of Remedial Action Scheme was effective 7/1/2017. Therefore any circuits that have been newly identified by the entity for inclusion due to the change in the RAS definition will have this additional time, until 7/1/2019, for implementation.

Notification to the TOP or BA for new or changes to protective systems via email or some other documented means of communication is sufficient for coordination and compliance.  However, making a change to a protective system without proper coordination could cause unintended operation or non-operation of an interconnected entity’s protection, thus potentially having an adverse impact to the BPS. Following up emails with phone calls or other means of contact with the TOP is encouraged in this situation to ensure that the overall protection system will functionally operate as designed.

The protection systems referenced in the Implementation Plan are the relay protective devices as stated in Requirements 1 and 2. These devices are separate and apart from the Protection Systems listed in the NERC Glossary (PRC-005).

One of my facilities in the SERC region has determined that they have two relays per unit (4 simple cycle units) subject to PRC-024 that will require setting changes.  They have contacted Transmission Planner and received the okay to make the changes from a transmission standpoint. However, the unit manufacturer will not approve changes recommended by a third-party engineering firm. The plant is hesitant to make any changes to a machine without that okay.  They have been waiting for weeks to get approval before making changes, but are at a point that they will not be able to make them before the July 1, 2016 compliance date.

From a compliance standpoint: 1) is it sufficient that they have made the relay setting determinations and have a plan to implement the changes, 2) does this need to be self-reported, or 3) would this be considered an equipment limitation under R3, until we get approval from the manufacturer that there are no limitations? 

The determination of required changes to relay settings and a plan to implement the changes does not meet compliance with PRC-024-2. Ordinarily, the failure to make the changes in a manner that achieves compliance in accordance with the 5-year implementation plan should be self-reported. However, depending upon the manufacture’s reasons for denying the changes, there may be a valid equipment limitation as described in R1 and R2.  If so, the entity is required to document the limitation and communicate the limitation to the Planning Coordinator and Transmission Planner in lieu of making the changes as required in R1 and R2.  See PRC-024-2 R3 for details.

The implementation guide for PRC-025-2 puts the determination responsibility on the Generator Owner, Transmission Owner, or Distribution Provider to decide whether replacement or removal of the relay(s) is necessary. If it is determined that replacement or removal rather than setting changes is necessary, then the implementation date of October 1, 2021 is applicable. The entity should keep some form of documentation to support their basis for making this determination.

Is PRC-025-1 intended to replace the GO's obligations under PRC-023-3?

No, PRC-023-3 is still applicable to GOs.  GOs need to review PRC-023-3 to determine if they have applicable Facilities.  PRC-025-1 applies to Generator Loadability, PRC-023-3 applies to Transmission Loadability.  Both Reliability Standards are applicable to TO, GO, and DP.  PRC-023-3 is also applicable to PCs.

October 18, 2019
Facilities applicable to PRC-025-2 include blackstart resources in the TOP’s system restoration plan. Table 1 – Relay Loadability Evaluation Criteria that is associated with PRC-025-2 notes a connection point via a GSU for each relay loadability setting option specified for synchronous generation units. How should PRC-025-2 Table 1 – Relay Loadability Evaluation Criteria be applied to a blackstart resource that uses PRC-025-2 applicable elements but connects directly via a 14kV bus (no GSU)?

Per the Standard, Blackstart resources in the Transmission Operator’s system restoration plan are applicable. Thus, it is necessary to include all load-responsive protective relays at the terminals’ Elements (generator). Consequently, relay functions such as 21, 50, 51,51V-R, 51V-C from the Blackstart Unit to the low side of the three winding transformer (GSU) would apply to the loadability requirement in PRC-025-2 using an appropriate option for your application in Table 1. The following option may apply under your scenario (1a, 1b, 1c, 2a, 2b, 2c, 3, 7a, 7b, 7c, 8a, 8b, 8c, 9a, 9b and 9c). Refer to your site Relay Functional Diagrams and compare it to Figure 5 on page 37 of the Standard as an illustration of the connections that may apply to you for each of the Table 1 options provided in PRC-025-2. It is important to note that standard does not require that you use any of the protective functions listed above.

PRC-025-2 does not require the Generator Owner, Transmission Owner, or Distribution Provider to use any of the protective functions listed in Table 1. However, each Generator Owner, Transmission Owner, and Distribution Provider that applies load-responsive protective relays on their respective Elements listed in Section 4.2, Facilities, which includes Unit Auxiliary Transformers, shall use one of the Options in Table 1, Relay Loadability Evaluation Criteria to set each load-responsive protective relay element according to its application and relay type. The start-up transformer in this scenario would be applicable to PRC-025-2 because it would be functioning as the Unit Auxiliary Transformer and would need the same protective functions applied to it as the normal Unit Auxiliary Transformer.

June 5, 2019
PRC-025 is applicable to UATs.  If however, during normal plant operations, a problem occurs with the UAT and the plant operators switch auxiliary load to their start-up transformer in order to keep the generator in service, is the start-up transformer now applicable to PRC-025 because it’s supporting auxiliary power to keep the generating unit online?

PRC-025-2 does not require the Generator Owner, Transmission Owner, or Distribution Provider to use any of the protective functions listed in Table 1. However, each Generator Owner, Transmission Owner, and Distribution Provider that applies load-responsive protective relays on their respective Elements listed in Section 4.2, Facilities, which includes Unit Auxiliary Transformers, shall use one of the Options in Table 1, Relay Loadability Evaluation Criteria to set each load-responsive protective relay element according to its application and relay type. The start-up transformer in this scenario would be applicable to PRC-025-2 because it would be functioning as the Unit Auxiliary Transformer and would need the same protective functions applied to it as the normal Unit Auxiliary Transformer.

PRC-026 R1, which became effective January 1, 2018, requires the Planning Coordinator to provide annual notification of BES elements to the GO and TO. If the GO/TO receives a notification in late 2017 and another notification in early 2018, should both notifications be considered annual notifications and the BES listing on each notification evaluated and dispositioned in accordance with R2, R3 and R4?

In addition, if the BES listing changes with each annual notification, does the new listing supersede the previous listing and the actions required by R2, R3, and R4 are no longer applicable to the BES elements on the previous listing?

PRC-026-1, Requirement 1, which came into effect on 1/1/2018, requires the Planning Coordinator (PC), at least once each calendar year, to provide each Generator Owner (GO) and Transmission Owner (TO) notification of each generator, transformer, and transmission line BES Element in its area that meets at least one or more of the criteria listed in R1.

According to the implementation plan, the 36 months for the GO and TO in Requirement R2 (and Requirements R3 and R4) is intended to allow the entity an opportunity to address the initial influx of identified Elements in Requirement R1. However, there is no obligation for the GO or TO to perform Requirement R2, R3, or R4 until the effective date of these Requirements. Therefore, the 36 month period allows the entity the opportunity to assess each of the notification lists received from the PC prior to the 1/1/2020 implementation date for R2, if they choose to do so prior to its required compliance obligation.

When Requirement 2 becomes effective on 1/1/2020, it starts a 12-month clock for the GO/TO to perform the required determinations for any list received from the PC. R3 and R4 requires a corrective action plan and its implementation, if necessary.

The PC is required to perform its assessment annually and submit a list annually. After 1/1/2020, receipt of that list starts another 12-month clock for that list.

The Standard Requirement Effective Dates are:

PRC-026-1     R1       1/1/2018
PRC-026-1     R2       1/1/2020
PRC-026-1     R2.1    1/1/2020
PRC-026-1     R2.2    1/1/2020
PRC-026-1     R3       1/1/2020
PRC-026-1     R4       1/1/2020

Would you verify and provide some clarification for PRC-026-1 based on the examples and questions below?

PRC-026

• R1 - PC notifies GO or TO with elements that meet criteria of R1
• R2 - once GO has been notified
• Within 12 full calendar months
• Determine whether protective relays applied meet the criteria of Attachment B
• Become aware of a generator, Transformer, or transmission line tripped in response to a stable or unstable power swing, meet the criteria of Attachment B
• Example: if a GO is notified by the PC on 12/17/18, typically they would have to make the determination of R2 by 12/17/19, since the requirement doesn’t take effect until 1/1/2020.
• Q1: This determination must take place by the 1/1/2020 effective date?
• R3 – within six full calendar months of determining the Protective System does not meet the Attachment B criteria, the entity must develop a CAP.
• Once the determination of R2 has been completed a CAP must be completed within six calendar months
• Example: Determination of R2 is complete on 11/15/19
• Q2: R3 CAP has to be developed by 5/15/2020?
• Do the relays have to meet Attachment B by the 5/15/2020? Or; for this first effective date of 1/1/2020?
• Can the implementation of the CAP run past the six month development process of the CAP? Example: Six months to develop the CAP is 5/15/2020. Can the CAP completion take 9 months or a year?

Responses:

Question 1: There is no obligation on the GO/TO to perform Requirement R2, R3, or R4 until the effective date of these Requirements.

If a GO/TO is notified on or before 1/1/20 the determination for Requirement R2 must take place before 1/1/2021. If a GO/TO is notified any time after 1/1/20, then the determination for Requirement R2 must take place within 12 full calendar months of the notification date.

Question 2, first bullet: The GO/TO must develop the CAP within 6 full calendar months of determining a load-responsive protective relay does not meet the PRC-026-1 – Attachment B pursuant to Requirement R2. If the determination for R2 is made on or before 1/1/20, then the CAP is due before 7/1/2020.  If the determination for R2 is made any time after 1/1/20, then the CAP is due within 6 full calendar months of the determination date.

Question 2, second bullet 2: The implementation of the CAP could go beyond the six month development process. If this occurs, the GO/TO must update each CAP if actions or timetables change until all actions are complete.

Refer to the FAQ_Implementation_Plan_PRC_026_1_04102018.pdf at the link below for more details.

https://www.nerc.com/pa/Stand/Project%202010133%20Phase%203%20of%20Relay%20Loadability%20st1/FAQ_Implementation_Plan_PRC_026_1_04102018.pdf

Option 2 is a Fault current based methodology. If an entity elects to initially use Option 2, Fault current baseline(s) must be established prior to the effective date of the standard. In a time interval not to exceed six-calendar years following the effective date of this standard, an entity must perform a Fault current comparison. Page 12 of 17 in the standard provides a specific example for Option 2, and it does not appear a coordination study is required as the entity set up the Fault current baseline(s).

October 16, 2019
Requirement R1.1 of PRC-027 requires a review and update of Short Circuit Model Data for the BES elements under study.  Does this data refer to the Short Circuit data submitted to the TP under MOD-032?  If not, can you specify what data our engineers need to be reviewing in order to comply with the standard?

Entities can obtain the short-circuit model data submitted to the TP such as MOD-032 planning data from either the Transmission Planners, Planning Coordinators or Transmission Owners.  A review and if necessary an update of the short-circuit study topology may be necessary to ensure that information accurately reflects the physical power system that will form the basis of the Protection System Coordination Study and development of Protection System relay settings.

Reviews could include:

1. A review of applicable BES line, transformer, and generator impedances and Fault currents.

2. A review of the network model to confirm the network in the study accurately reflects the configuration of the actual System, or how the System will be configured when the proposed relay settings are installed.

3. A review, where applicable, of interconnected Transmission Owner, Generator Owner, and Distribution Provider information.

June 21, 2017
Once the initial assessment has been coordinated and new relay/limiters settings have been implemented to bring those Facilities into compliance, does that mean these are considered “setting changes that will affect the coordination”, therefore requiring the Facility to perform another coordination as described in R1?

Additional coordination would not be required if the setting changes described were completed as a result of the initial assessment to bring the facility into compliance with R1.  The 90 calendar day window in R2 is only applicable to those facilities that are already compliant with R1 as part of the PRC-019-2 implementation plan.  If subsequent coordination problems are identified after initial compliance is achieved, R2 would apply.

The Standard states, “Each UFLS entity must annually review that the amount of UFLS load shedding implemented is within a certain tolerance as specified by SERC Standard PRC-006-SERC-02 Requirement R4 or Requirement R5 by May 1 of the current year.” It also states, “the percent of load shedding to be implemented shall be based on the actual or estimated distribution substation or feeder demand (including losses) of the UFLS entities at the time coincident with the previous year actual Peak Demand.” If the previous year’s actual Peak Demand switched from its usual peak season (example: switch from Page 1 of 2 summer to winter due to an abnormally cold period in the previous winter), is the UFLS plan expected to be implemented based on this new season peak?

Yes, the intent of the standard is that registered entities base the amount of UFLS load shedding implemented on the previous year’s actual Peak Demand.

In the case where the previous year’s actual Peak Demand switches seasons, does the May 1 time frame still apply?

Refer to item 4 in the Guideline and Technical Basis section of the subject standard. The answer depends upon the extent of changes required to the UFLS plan. As stated in the Guideline and Technical Basis section of the standard, "the May 1 date applies only to implementation of the existing percentages of load shedding specified by the Planning Coordinator.“ The 18-month time frame specified in PRC-006-SERC-02 Requirement R6 is intended to allow sufficient budgeting, procurement, and installation time for additional equipment or for significant setting changes to existing equipment necessary to meet a revised load shedding scheme design that has been specified by the Planning Coordinator. During this 18-month transition period, the May 1 measurement of R4 or R5 would not apply.

Item 4 in the Guideline and Technical Basis section of the PRC-006-SERC-02 standard copied below for reference:

4. Basis for May 1 and 18 month time frames

Each UFLS entity must annually review that the amount of UFLS load shedding implemented is within a certain tolerance as specified by SERC Standard PRC-006-SERC-02 Requirement R4 or Requirement R5 by May 1 of the current year. May 1 was chosen to allow sufficient time after the previous year’s peak occurred to make adjustments in the field to the implementation if necessary to meet the tolerances specified in Requirement R4 or Requirement R5. Therefore, the May 1 date applies only to implementation of the existing percentages of load shedding specified by the Planning Coordinator. On the other hand, the 18-month time frame specified in PRC-006-SERC-02 Requirement R6 is intended to allow sufficient budgeting, procurement, and installation time for additional equipment, or for significant setting changes to existing equipment necessary to meet a revised load shedding scheme design that has been specified by the Planning Coordinator. During this 18-month transition period, the May 1 measurement of R4 or Requirement R5 would not apply.

PRC-006-SERC-1 R6, which requires the UFLS Registered Entity to implement certain specified changes to the UFLS scheme within 18 months of notification by the PC goes into effect October 1, 2015.  If changes are recommended by the PC prior to October 1, 2015, can the UFLS Registered Entity take longer than 18 months from notification to implement those changes?

No.  PRC-006-SERC-1 R6 is currently effective.  R6 becomes enforceable October 15, 2015.  The UFLS Registered Entity has 18 months to implement the changes after it is notified by the PC.

“R6. Each UFLS entity shall implement changes to the UFLS scheme which involve frequency settings, relay time delays, or changes to the percentage of load in the scheme within 18 months of notification by the Planning Coordinator.”

No, SERC will sample certain days of the audit period per NERC Sampling Methodology.

Yes, an entity must perform an RTA every 30 minutes. During the transition to the alternate control center, the RTA can be performed by the TOP’s RC or another designated registered entity.

1. TOP-001 R20-R24:  What is an acceptable or reasonable time frame to have each and all components of data exchange infrastructure tested?
   An entity's testing practices should, over time, examine the various failure modes of its data exchange capabilities. When an actual event successfully exercises the redundant functionality, it can be considered a test for the purposes of the proposed requirement. An entity may identify different test scenarios and develop a schedule to conduct a redundant functionality test using one such scenario every 90 calendar days.
2. Is there a maximum or discouraged time frame not to go over?
   An entity must conduct a redundant functionality test within 90 calendar days of its most recent test (no more than 90 calendar days between tests).  An entity should determine which individual components or combinations of components should be removed from service to test the redundant functionality of the remaining available data exchange path(s). 
3. Is DAC1 included in this standard”?
   

   In general, data exchange infrastructure in the context of the requirements in scope does not include the following:

   • An Entity’s devices or components (e.g. front end processors, application servers etc.) that are not associated with ICCP or an equivalent protocol.
   • Remote Terminal Units (RTU’s) or other similar types of Data Collection Units (DCU’s).  Entities are not required to have redundant RTUs, DCUs or similar type of field communication devices utilized for obtaining telemetry information.
   • Infrastructure that is not within the TOP’s Primary Control Center is not addressed by the requirement.
4.  Does all equipment need to be tested in 90 days?
   No, not all equipment has to be tested in 90 days.  See response in 1 and 2 above. The requirements do not identify specific components of an entity’s data exchange infrastructure that need testing for redundant functionality.  The tests for redundant functionality are highly dependent on an entity’s data exchange infrastructure configuration.

Each Balancing Authority and Transmission Operator shall notify its Reliability Coordinator and known impacted interconnected entities of all planned outages, and unplanned outages of 30 minutes or more, for telemetering and control equipment, monitoring and assessment capabilities, and associated communication channels between the affected entities.

Is the intent for BAs and TOPs to submit ALL planned outages (individual RTU outages) to the RC or is the intent for BAs and TOPs to submit planned outages that may impact their monitoring tools (multiple RTUs in one area)?

The responsible entity is required to notify its RC of all planned outages as prescribed by its RC, which could include daily groupings.  Any notification method is acceptable. As stated in the measure, acceptable evidence includes dated operator logs, voice recordings or transcripts of voice recordings, electronic communications, or other equivalent evidence.

R23. Each Balancing Authority shall have data exchange capabilities, with redundant and diversely routed data exchange infrastructure within the Balancing Authority's primary Control Center, for the exchange of Real-time data with its Reliability Coordinator, Transmission Operator, and the entities it has identified it needs data from in order for it to perform its Real-time monitoring and analysis functions. [Violation Risk Factor: High] [Time Horizon: Same-Day Operations, Real-time Operations]

The data infrastructure cabling should be routed through an independent tray and conduit system within the primary control center.

October 18, 2019
We have a clarification question regarding the question asked in the July SERC Newsletter. What is SERC's expectation in regards to “redundant and diversely routed data”? Should the data infrastructure cabling be routed through an independent tray and conduit system within the primary control center? (How do you verify that during the onsite audit?) Did you have any onsite experience related to this requirement in SERC? I understand that some of the FRCC members have a different interpretation than SERC.

From the July 2019 SERC Newsletter
Question: June 24, 2019
Concerning TOP-001-4 R23: When evaluating diversely routed data exchange infrastructure, does SERC require redundant cabling to be in separate cable trays or conduit, or can the wiring be within the same cable tray or conduit within the primary Control Center?

Response:
R23: Each Balancing Authority__ shall have data exchange capabilities, with redundant and diversely routed data exchange infrastructure within the Balancing Authority’s primary Control Center, for the exchange of Real-time data with its Reliability Coordinator, Transmission Operator, and the entities it has identified it needs data from in order for it to perform its Real-time monitoring and analysis functions. [Violation Risk Factor: High] [Time Horizon: Same-Day Operations, Real-time Operations]

Per the NERC Reliability Standard TOP-001-4 Supplemental guidance and the Recent NERC implementation guidance:

• The requirements in scope do not directly contemplate specific physical criteria or distances to achieve diverse routing.  Entities may choose to achieve diverse routing through physical or logical means.  An entity applying a risk-based approach may consider the overall strategy of data exchange infrastructure setup within its Primary Control Center in determining whether adequate redundancy and diversity in routing has been achieved to avoid single points of failure that could halt the flow of Real-time data.
• The entity may not need specific physical criteria or distances to achieve diverse routing.  For example, while it may not be a best practice, depending on the entity’s individual circumstances, the entity may run multiple cables through the same tray or conduit as long as the cables are connected to different components.

SERC verifies this requirement during an on-site audit by reviewing forms or documents of evidence provided by the entity listed in the measurement for this requirement.

R2: a TOP and BA may submit an Operating Plan for an identified period of time (such as the weekend, or until further notice) provided that there is a daily assessment of whether changes have occurred to the assumptions about operating conditions (e.g., outages, system topology/system configuration, weather and/or load, etc.) that result in the need to submit an updated plan. If, and only if, the RC agrees to the interval and conditions that would require an updated Operating Plan.

R4: a TOP and BA may submit an Operating Plan for an identified period of time (such as the weekend, or until further notice) provided that there is a daily assessment of whether changes have occurred to the assumptions about operating conditions (e.g., weather, outages and/or load, etc.) that result in the need to submit an updated plan. If, and only if, the RC agrees to the interval and conditions that would require an updated Operating Plan.

(Transmission Operator):
a.  If the Operational Planning Analysis performed in TOP-002-4 R1 reveals no SOL exceedances, then R2 does not require development of an Operating Plan, and the TOP does not need to submit a plan to the RC for R6. However, the TOP should document next day operating plans or other confirmation that no SOL exceedances were identified so:

i.  The Reliability Coordinator is aware that the work was performed and there wasn't a communications failure.
ii.  The Reliability Coordinator can determine if a discrepancy exists between its own analysis and Transmission Operator's plan.
iii.  The documentation of the requirement provides a full record of the daily Operational Planning Analysis and the effort made by the entity to meet compliance.

(Balancing Authority):
In accordance with TOP-002-4, R7, each BA shall submit its Operating Plan(s) for next-day operations to the RC.  A specific plan document is not necessary if all parts R4 (4.1 through 4.4) of TOP-002-4 are being provided to the Reliability Coordinator through alternate means (e.g. electronically, ICCP, etc.).

R3.  Each Transmission Operator shall distribute its data specification to entities that have data required by the Transmission Operator’s Operational Planning Analyses, Real-time monitoring, and Real-time  Assessment.

R4.  Each Balancing Authority shall distribute its data specification to entities that have data required by the Balancing Authority’s analysis functions and Real-time monitoring.

R5.  Each Transmission Operator, Balancing Authority, Generator Owner, Generator Operator, Load-Serving Entity, Transmission Owner, and Distribution Provider receiving a data specification in Requirement R3 or R4 shall satisfy the obligations of the documented specifications using: [Violation Risk Factor: Medium] [Time Horizon: Operations Planning, Same-Day Operations, Real-time Operations]
5.1. A mutually agreeable format
5.2. A mutually agreeable process for resolving data conflicts
5.3. A mutually agreeable security protocol

1. What type of data specifications from the TOP and BA is SERC looking for? TOP-002-2.1b is retired.  Is information below the evidence required for R5?
   

   TOP-002-2.1b	TOP-003-3
   R3	R5	CROW?
   R13		At request (TOP-001-4)
   R14	R5	CROW/Portals
   R15	R5	Portals
   R18	Retired

   
   
2. Is each TOP and BA required to send out data specifications to Transmission Operator, Balancing  Authority, Generator Owner, Generator Operator, Load-Serving Entity, Transmission Owner, and  Distribution Provider each year?

The data specification is determined by the entity. Data specification is based on what data is required by the TOP and BA to ensure that the TOP can perform its Operational Planning Analyses, Real-time monitoring, and Real-time Assessments and the BA can perform its analysis functions and Real-time monitoring. NERC Standard TOP-003-3 Requirement R1 part 1.1 thru 1.4 and Requirement R2 parts 2.1 thru 2.2 specifies what the documented specification must include, but is not limited to.

The documented specification for data shall include the periodicity for providing data and is determined by the entity based on the need of the TOP and BA to ensure that the TOP can perform its Operational Planning Analyses, Real-time monitoring, and Real-time Assessments and the BA can perform its analysis functions and Real-time monitoring.

When physically manning or video monitoring a substation during a loss of communication event, the entity must take into consideration its ability to monitor data that is necessary to perform its Real-time monitoring and Real-time Assessments. The BA or TOP shall develop an Operating Process or Operating Procedure in accordance with NERC Standard TOP-010-1(i) Requirement R1 and R2 that addresses the quality of the Real-time data necessary to perform its Real-time monitoring and Real-time Assessments. The process or procedure is required to address the necessary actions that are to be taken by an entity or entities responsible for providing the data when data quality affects Real-time Assessments.

If the issue occurs in only one Near-term planning horizon sensitivity study, corrective action plan can be delayed until 2026.

When does the 24 month period in Requirement R6 begin per the implementation plan if GIC data is received under R5 prior to the enforceable date of R6?  Our position is that, if GIC data is received prior to the effective date of R6, the 24-month period in R6 triggers on the first day that R6 is effective or at worst can’t reach back prior to the effective date of R5.

Each Planning Coordinator/Transmission Planner must provide the maximum effective GIC value for all applicable transformers to the respective Transmission Owner/Generator Owner, as required by TPL-007-1, R5, no later than January 1, 2019. The Transmission Owner/Generator Owner shall conduct a thermal impact assessment on an applicable transformer within 24 months from the date of receipt of the maximum effective GIC value and provide the results to the Planning Coordinator/Transmission Planner, as required by TPL-007-1, R6, no later than January 1, 2021.

Background
Part 5.1 of Requirement R5 of NERC Standard TPL-007-1 requires the Planning Coordinator (PC) and/or Transmission Planner (TP) to provide to the applicable Transmission Owners (TOs) and Generator Owners (GOs) the “maximum effective GIC value for the worst case geoelectric field orientation for the benchmark GMD event described in Attachment 1” of the Standard.  This information is necessary for the applicable TOs and GOs to complete the required thermal impact assessment described in Requirement R6. However, Requirement R6 explicitly defines a threshold below which the applicable TOs and GOs are not required to perform the assessment.

Question
If the PC and/or TP determines that none of the applicable BES power transformers in the planning area have maximum effective GIC values equal to or in excess of the specified 75 A per phase threshold considering the worst case geoelectric field orientation for the benchmark GMD event, is it acceptable to meet compliance with Part 5.1 of Requirement R5 through a blanket notification to all applicable TOs and GOs in the planning area?  The blanket notification would provide the GIC value as “less than 75 A per phase” rather than individual GIC values by applicable transformer.

Response:
TPL-007-1 R5 requires the Planning Coordinator or Transmission Planner to provide the maximum effective GIC value for the worst case geoelectric field orientation for the benchmark GMD event described in Attachment 1 to the Transmission Owner or Generator Owner that owns applicable BES power transformers even if the threshold of 75A is not exceeded.

Response:
SERC would consider R5 and R6 separate from the timing requirements in R4. However, information developed in R5 is necessary when the entity is required to perform the GMD Vulnerability Assessment required in R4. R6 thermal assessments must be repeated or reviewed using previous assessment results each time the planning entity performs a GMD Vulnerability Assessment

For R5, the GIC information is necessary for determining the thermal impact of GIC on transformers in the planning area and must be provided to the entities responsible for performing the thermal impact assessment in R6. GIC information provided in R5 is part of the GMD Vulnerability Assessment Process since it includes documented evaluation of susceptibility to localized damage due to GMD.

Implementation dates for R4, R5 and R6 are as follows:

• R4 – 1/1/2022
• R5 – 1/1/2019
• R6 – 1/1/2021

Description of the Violation, Issue, or Trend 
Transmission Operators (TOPs) should ensure that new generators are properly issued a voltage or reactive power schedule and reporting requirements prior to commercial operation. Generator Operators (GOPs) should ensure that they have received their TOP's schedules and reporting requirements and that they are included in its procedures and operator training prior to commercial operation. 

Risk Considerations
Registered entities must ensure that voltage levels, reactive flows, and reactive resources are monitored, controlled, and maintained within limits in real-time to protect equipment and the reliable operation of the Interconnection.

Description of Mitigation Activity
Registered entities should comply with VAR-001-5 (for TOPs) and VAR-002-4.1 (for GOPs).    Operator training concerning specific system characteristics and alarm responses is considered good practice.

Other Factors or Comments
VAR-001-5 R4 allows the TOP to notify a GOP of its exemption from: 1) following a voltage or Reactive Power schedule, 2) having its automatic voltage regulator (AVR) in service or from being in voltage control mode, or 3) having to make any associated notifications. This exemption could be useful for intermittent sources such as wind and solar or other situations where strict adherence to the Requirements is difficult or impossible and does not pose a substantial risk to reliability.

Description of the Violation, Issue, or Trend
The Generator Operator (GOP) does not meet the generator voltage or Reactive Power schedule issued by the Transmission Operator (TOP).  Reasons for this include voltage schedules that give a single voltage to maintain without an associated bandwidth, voltage schedule bandwidths that are more conservative than necessary for reliable operation, failure to maintain evidence, failure to communicate with the TOP, and loss of indicators that the voltage was reaching levels outside of the bandwidth.

Risk Considerations
In general, this type of violation can pose a minimal, moderate, or serious risk to the Bulk Power System (BPS)  depending on many factors, including (but not limited to):

1. the size of the units impacted;
2. the magnitude of the departure from the schedule;
3. the duration of the departure from the schedule;
4. system conditions at the time of the departure from the schedule; and
5. mitigating factors in place, such as alarming.

Description of Mitigation Activity
Mitigating actions have included:

1. implementing back-up notification systems;
2. re-evaluating the bandwidth in the schedule;
3. revising procedures and re-training employees;
4. developing data retention policies and practices specific to VAR-002; and
5. conducting periodic reviews to ensure communication between the GOP and TOP occurs as required in applicable situations.

Other Factors or Comments
Where the loss of indicators was a contributing factor, many times the loss of indicators was an unintended consequence of performing work that took the indicators off-line  as part of another maintenance or installation project.

Description of the Violation, Issue, or Trend
The GOP not notifying the TOP of a change in status and/or the expected duration.  One example is late notification after an Automatic Voltage Regulator (AVR) trips from automatic controlling voltage to manual.  Another example is failure to notify the TOP in advance of an AVR status change that is controlled by the GOP (not a trip). Registered Entities also fail to notify the TOP of the expected duration of the change in status.  Registered Entities also communicate incorrect information to the TOP, such as the GOP notifying the TOP that the AVR returned to auto when in fact the AVR did not return to auto and the GOP notifying the TOP that it placed the AVR in manual control mode and the Power System Stabilizer (PSS) remained in service when in fact the PSS did not remain in service.

Risk Considerations
In general, this type of violation can pose a minimal to moderate  risk to the BPS depending on many factors, including:

1. the size and number of the units impacted and what other units in the area had the AVR in auto controlling voltage;
2. mitigating factors in place, such as alarming;
3. the need for voltage support at that location; 
4. operator training and experience in operating plants and units in manual; and
5. type of unit and plant (base load, peak, etc.).

Description of Mitigation Activity
Mitigating actions have included:

1. retraining operators on the procedures and expectations;
2. installing alarming and notification indicators;
3. training of operators on the operation of the AVR and PSS; and
4. conducting periodic reviews of VAR event lots for completeness and accuracy and bringing incomplete or incorrect VAR Logs to the attention of the manager so that coaching can be provided.

Other Factors or Comments

1. To reduce the risk of sustaining a violation, some Registered Entities  surveyed all of their units to identify those that had an operating PSS, had AVRs that operated in other than automatic voltage control, and had adequate alarms to indicate abnormal operation.  The Registered Entities changed operating procedures, indicators, and alarms accordingly.
2. When placing the AVR in auto following a trip, some operators believe that notifying TOP is not required since the operator is placing the AVR in the required mode.