NERC has submitted the first of two compliance filings directed by FERC earlier this year, providing information about its oversight of regional entities, the development process for reliability guidelines and the role of the Electricity Information Sharing and Analysis Center (E-ISAC) in developing reliability standards (RR19-7).

FERC ordered the filing on Jan. 23 in response to NERC’s five-year performance assessment, with the deadline originally set for April 22. (See NERC Wins Another 5 Years as ERO.) The commission later extended the due date to May 1 in light of the COVID-19 pandemic, and then again to June 1. (See FERC Extends NERC Compliance Filing Deadline Again.)

RE Audit Expansion Proposed

NERC’s Rules of Procedures (ROP) and the delegation agreements it signed with REs in 2007 require it to perform “comprehensive” audits of their compliance monitoring and enforcement programs (CMEP) at least once every five years.

However, FERC noted in January that NERC’s performance assessments for both 2014 and 2019 failed to mention whether it had actually performed any such audits in the relevant period. The commission required NERC to produce any RE audits it had performed or provide a plan to perform them within the next 18 months.

In its filing, NERC disclosed that it had “conducted two [CMEP] audits of the regional entities” since 2014 that examined confidential information and conflict-of-interest procedures, as well as internal controls evaluations. NERC also performed two “non-CMEP audits” during the period to examine REs’ implementation of the event analysis process and of Section 215 of the Federal Power Act.

The audit reports were not provided in the public filing; NERC requested that the commission treat the information as privileged material because it “reflects confidential business information as well as NERC’s investigative audit process.”

Along with information on its audit history, NERC outlined a proposal to enhance RE audits by expanding the scope of its internal audit program — which currently focuses on CMEPs, the Organization Registration and Certification Program (ORCP) and its bulk electric system exception activities — to encompass such functions performed by the entire ERO Enterprise. These audits, dubbed “regulatory programs audits” in the proposal, would be carried out at least once every three years, either by NERC or an outside auditor.

Under the proposal, the organization would also conduct a separate “nonregulatory programs” audit every year with participation by observers from FERC. The nonregulatory programs audit would cover other delegated functions performed by the REs outside of the CMEP, ORCP and BES exception activities.

Clarity on Reliability Guideline Development

FERC also ordered NERC to explain its guidance development process, how it determines if guidance documents are addressing the risk they are designed to, and “how and at what interval NERC will evaluate whether components of the guidance document should be incorporated into the reliability standards.” The mandate was prompted by concern that unlike reliability standards, which have a transparent development process, guidelines may be “based on the input of a limited number of interested participants.”

In response, NERC explained the difference between reliability standards — which set requirements for operation of the bulk power system — and reliability guidelines, which “[outline] approaches for managing potential risks to reliability.” While it emphasized that it “carefully considers” whether a guideline or a standard is best suited for a particular circumstance, the organization also acknowledged that it lacked a formal framework for addressing known and emerging reliability risks.

NERC has already begun the process of formalizing its existing process. At February’s meeting of the Member Representatives Committee, Chief Engineer Mark Lauby outlined a proposed risk management framework. (See NERC Developing Risk Mitigation Framework.) The framework, which NERC included in the compliance filing, comprises six steps:

• Identifying risks and creating a risk registry;
• Prioritizing risks;
• Identifying and evaluating mitigation strategies;
• Deploying mitigation strategies;
• Measuring the strategies’ success; and
• Monitoring the residual risk.

Reliability guidelines may be selected in the third step as the best method for addressing moderate- or low-impact sustained risks, or risks in areas that fall outside NERC’s jurisdiction. Responsibility for guideline development previously fell within the charters of the Operating, Planning and Critical Infrastructure Protection committees; these procedures will be consolidated under the new Reliability and Security Technical Committee (RSTC) after its first meeting next week.

The RSTC will also be responsible for evaluating the effectiveness of guidelines after they are posted. Under the RSTC charter, comments are accepted on an ongoing basis and must be reviewed every quarter. At any time, the committee may update a guideline, and every third year the guideline must be reviewed for continued applicability, usefulness and effectiveness. Metrics for evaluation of guidelines include:

• performance of the BPS before and after the guideline’s introduction;
• use and effectiveness of the guideline as reported by industry via survey;
• industry assessment of the extent to which the guideline addresses risks; and
• additional metrics specific to each guideline as determined by the RSTC.

E-ISAC Information Sharing Detailed

The final section of NERC’s filing details how the E-ISAC shares industry information with the ERO and the role that its data play in developing reliability standards. FERC requested the material because of concern that while E-ISAC’s code of conduct prohibits sharing information received from registered entities with enforcement staff, it may be permitted to share such information for the purposes of developing standards.

NERC said in its filing that the E-ISAC operates under “broad information-sharing restrictions” that generally restrict personnel from sharing any voluntarily reported information with non-ISAC staff at NERC. Limited exceptions are allowed. Specifically, such information may be shared only with:

• NERC’s president and CEO for providing oversight of the E-ISAC;
• NERC’s general counsel for providing legal advice to the ERO;
• other persons or entities to whom the submitting entity has provided permission for such sharing; and
• persons or entities authorized to review such information by the Electric Subsector Coordinating Council (ESCC).

In spite of these restrictions, NERC acknowledged that some E-ISAC data may be used to inform development of reliability standards. This is generally limited to information provided through the E-ISAC but also publicly available through other avenues. The E-ISAC may also share nonpublic reports that anonymize and aggregate otherwise protected information. Such reports might include trending analysis or analysis of a specific threat, vulnerability or risk, as long as no specific entities are implicated.

NERC plans to enhance the coordination between the E-ISAC and the Standards Department with quarterly meetings between relevant personnel so that relevant information may be exchanged more smoothly and frequently, in hopes of establishing a “regular feedback loop” to help strengthen standards development.

The E-ISAC also features prominently in the second compliance filing ordered by FERC, which is due on Sept. 28 (extended from the original deadline of July 21). NERC last week posted the draft filing for comment. It details proposed revisions to the E-ISAC’s relationship with the ESCC, along with changes to NERC’s sanction guidelines to clarify how the ERO Enterprise applies monetary and nonmonetary penalties to registered entities. The comment period runs through July 10. (See NERC Seeks Comments on Proposed ROP Changes.)