RENSSELAER, N.Y. — NYISO soon could significantly tighten its security and information protection requirements, according to a presentation given to stakeholders last week.
Troutman Pepper, an energy law firm, advised the Transmission Planning Advisory Subcommittee and Electric System Planning Working Group meeting that as digitization grows, enhancing NYISO’s critical energy and electric infrastructure information (CEII) protection has become increasingly important.
Kat O’Konski, an associate at Troutman Pepper, said, “there is a pressing need” to improve CEII requirements because both “physical and cyber assaults on the grid are at a record high.” (See Feds Charge Idaho Man in Dam Attacks; NERC’s Cancel Details Grid Threats to House Energy Subcommittee; DERs’ Deployment Leads to Increasing Cyber Threats.)
Troutman wants to toughen measures around NYISO’s data dissemination by requiring third parties working with and around the ISO’s supply chain to implement more stringent protocols for CEII sharing and access.
These enhancements include mandatory cyber-training for certain workforces and obtaining cybersecurity risk insurance, as well as recommending that sensitive data be stored in multiple geographically isolated data centers to provide an added layer of redundancy.
Troutman requested that its proposals to tighten NYISO’s security and information-sharing procedures be approved quickly but some stakeholders were skeptical about the proposed implementation timeline and whether the CEII protections were more restrictive than protective.
Doreen Saia, an attorney with Greenberg Traurig, said Troutman was unrealistic to expect its proposals could be approved before the end of the year, given the number of meetings and the upcoming holiday season, as well as considering the breadth of the proposal.
Stu Caplan, partner at Troutman Pepper, asked what a realistic timeline would be. Saia responded that her firm would need at least a month or more to review the requirements, but that multinational organizations likely would need even more time to comply with the requirements, particularly those related to geographic data storage.
Glenn Haake, vice president of regulatory affairs at Invenergy, concurred with Saia, noting how multinational companies might struggle with these requirements, particularly if the rules vary by country of origin.
O’Konski sought to mollify these concerns by noting how Troutman’s proposals are intended to create a single set of CEII standards applicable for everyone.
Kevin Lang, partner at Couch White, in reference to expanding the list of personnel required to obtain CEII clearance, said Troutman needs to consider that not every NYISO market participant has the same level of resources as transmission owners and to ensure its requirements are not preventing smaller businesses from accessing the ISO’s data.
There was a consensus on the need for enhanced CEII protections and no one opposed the measures outright, but stakeholders wanted to guarantee a balance between security and accessibility.
Troutman will return with a more detailed proposal and requested feedback be sent to either Caplan or O’Konski by Sept. 28.
System & Resource Outlook
NYISO updated stakeholders that the base case lockdown date for the biennial System & Resource Outlook report has been set for Oct. 15.
The base case serves as the foundational set of initial conditions, scenarios and assumptions used in the Outlook’s modeling.
The 20-year forecasting report examines how New York’s transmission system develops, performs, and responds to the state’s aggressive climate and energy legislation. (See “System & Resource Outlook,” NYISO Previews New York City Transmission Needs Assessment.)
