By Holden Mann

Citing the need to “provide registered entities with regulatory certainty” during the COVID-19 pandemic, NERC has requested that FERC delay the implementation of several reliability standards that are scheduled to take effect this year (RM15-4, et al.). The organization asked that FERC consider the request on an expedited time frame and issue its decision as soon as possible.

Under NERC’s request, the following cybersecurity supply chain standards that are scheduled to become effective July 1 would be delayed to Oct. 1:

• CIP-005-6 (Electronic security perimeter(s))
• CIP-010-3 (Configuration change management and vulnerability assessments)
• CIP-013-1 (Supply chain risk management)

In addition, the following standards scheduled to take effect Oct. 1 would be moved to April 1, 2021:

• PER-006-1 (Specific training for personnel)
• PRC-027-1 (Coordination of protection systems for performance during faults)

Two other standards that are already effective would see some compliance deadlines pushed back. Under PRC-002-2 (Disturbance monitoring and reporting requirements), which took effect July 1, 2016, entities are required to demonstrate 50% compliance with requirements R2-R4 and R6-R11 by July 1; this would be moved back to Jan. 1, 2021. Also, PRC-025-2 (Generator relay loadability) requires entities to establish compliance with certain measures by July 1; this deadline would also be deferred to Jan. 1, 2021.

NERC said extending these deadlines would be “just, reasonable, not unduly discriminatory … would not adversely impact reliability” and would allow utilities to focus on the response to COVID-19 rather than on time-consuming compliance activities. The organization indicated that implementation delays for additional standards may be warranted depending on the progress of the outbreak and subsequent recovery efforts.

NERC Pursues Active Pandemic Response

The request for delay follows a number of steps by NERC and FERC in response to the pandemic. In March the organizations announced they would use regulatory discretion to relax compliance burdens for utilities related to maintaining personnel certification, performance of required periodic actions, and on-site activities such as audits and certifications. (See FERC, NERC Relax Compliance in Light of COVID-19.)

Last week, FERC agreed to give NERC more time to complete two compliance filings ordered earlier this year. (See FERC Extends NERC Compliance Filing Deadline Again.)

NERC said last week that the industry has “[taken] aggressive steps” in response to the pandemic, with most utilities either having a written response plan or currently developing one, and a majority pledging to support mutual aid requests from others involved in a pandemic emergency. (See Industry Pandemic Prep Encouraging, NERC Says.) The organization’s own response includes the issuance of a Level 2 alert in March, activation of its Business Continuity Plan and shifting upcoming meetings to conference calls or video conferences.

In addition, GridSecCon, the annual security conference sponsored by the Electricity Information Sharing and Analysis Center scheduled for Oct. 20-23, has been canceled this year.

According to the World Health Organization’s latest situation report, more than 1.2 million coronavirus infections have been confirmed worldwide since the disease was first reported in Wuhan, China. More than 67,000 deaths have been directly attributed to the virus globally.