FERC has approved NERC’s request for a $3.8 million budget variance to support development of the ERO Secure Evidence Locker (SEL), part of the organization’s Align software project to improve and standardize compliance monitoring and reporting processes across the ERO Enterprise (RR19-8).

NERC requested the variance on June 8, after receiving authorization from the Board of Trustees the previous month. (See “Align Expenditure Moves to FERC for Approval,” Align Tool Set for 2021 Rollout.) NERC’s filing did not provide a reason for the modification.

The organization will pursue a 60-month term for the loan rather than the normal 36 months because of current low interest rates. Annual debt servicing costs are expected to total $430,000 from 2021 to 2025 and will be incorporated in the Business Plan and Budgets for those years. NERC also estimates $570,000 in software, support and maintenance expenses for the ERO SEL in 2021 — based on licensing agreements with hardware and software vendors — with slight increases expected in future years.

SEL to Provide Secure Data Storage

Align grew out of the CMEP (Compliance Monitoring and Enforcement Program) Technology Project, begun by NERC in 2014. After NERC selected BWISE Information Security to develop the Align tool in 2018, the organization set its rollout date for September 2019. However, the project was delayed last summer because of concerns over the vendor’s sale to SAI Global, an Australia-based company whose investors include Baring Private Equity Asia, a Hong Kong-based private equity firm. (See NERC Investigating Chinese Tie to Software Vendor.) NERC CEO Jim Robb said earlier this year that the tool is now expected to be released in the first quarter of 2021.

The SEL was conceived as a way to provide secure storage where potentially sensitive information collected as evidence can be kept separate from work papers managed through the Align tool itself. Security features of the SEL and training of CMEP staff will prevent the improper access, use or transfer of evidence stored in the locker. NERC’s development plan includes an independent third-party security review of the SEL before launch; the organization expects to conduct annual reviews thereafter.

Several regional entities maintain their own digital lockers to store evidence associated with NERC’s Critical Infrastructure Protection reliability standards. NERC says the SEL, which will store “evidence associated with CMEP processes,” is not intended to replace these systems and that, in fact, REs are welcome to construct their own lockers for CMEP evidence as an additional security measure, though all such systems are expected to “meet certain functionality criteria.”

NERC originally planned to roll out the SEL in an update to Align, but development was accelerated at the request of registered entities last year after the tool’s first delay. As of the Align team’s most recent stakeholder update in March, it was targeting a fourth-quarter release for the SEL, though in its variance request, NERC said a delay to the first quarter of next year may be necessary “due to supply chain disruption caused by the COVID-19 health crisis.”