FERC on May 23 approved NERC’s proposed reliability standard for protecting electronic communication between control centers, along with the ERO’s plan for collecting data on winterization of generating units. 

NERC began development on CIP-012-2 (Cybersecurity — communications between control centers) in 2020, following a directive from the commission upon the approval of its predecessor CIP-012-1 (RD24-3). At the time, FERC said the standard needed further changes to protect the availability of communications links and data as required by Order 822, the impetus for the original standard. (See NERC Reliability Standards Get FERC Approval.) 

The ERO submitted the new standard in January, promising that it “expands the protections required by … CIP-012-1 by requiring responsible entities to mitigate the risk” of lost communications between control centers, along with the loss of real-time intra-control center assessment and monitoring data. 

NERC said the applicability and scope of CIP-012-2 are unchanged from the current standard; all responsible entities that own or operate control centers will be required to comply, except for facilities that “only communicate real-time data with other control centers regarding a co-located field asset [such as] a transmission station or generation facility.”  

The only change from CIP-012-1 is the addition of two new parts to requirement R1. Part 1.2 requires entities to implement protections for the availability of data in transit between control centers, while part 1.3 mandates that entities have methods for recovering lost communication links.  

In a filing, FERC said the proposed standard was “just, reasonable [and] not unduly discriminatory or preferential,” and addressed the directives in its order. The commission approved NERC’s request for the standard to take effect on the first day of the first quarter that comes 24 calendar months after the effective date of the order; as a result, the standard will become enforceable on July 1, 2026. 

ERO Outlines Data Collection Proposal

NERC’s cold weather data collection plan arose from FERC’s order last year approving EOP-012-1 (Extreme cold weather preparedness and operations) and EOP-011-3 (Emergency operations). (See FERC Orders New Reliability Standards in Response to Uri.)  

The commission directed NERC to submit within 12 months a plan for gathering data on generating unit winterization; for performing an analysis of the risk posed by proposed technical, commercial or operational constraints in EOP-012-1; and for analyzing the “actual performance of freeze protection measures during future extreme cold weather events.”  

NERC provided its plan to the commission in a compliance filing in February, explaining that it intends to submit an annual informational filing to FERC covering the required information; the first such filing will be made Oct. 1, 2025. Data for this first filing will be collected through a Section 1600 data request. This will be done for the second filing in 2026, possibly accompanied by additional data requests under NERC’s Compliance Monitoring and Enforcement Program. 

Information to be required from data requests to generator owners includes: 

• • identity and location of generating units; 
  • identity and megawatts of generation of units for which owners have declared constraints under EOP-012, along with the constraint declaration type and rationale; 
  • megawatts of generation within the owner’s fleet that are currently capable of operating at the unit’s extreme cold weather temperature;  
  • projected megawatts for which the generator owners and operators expect to implement and complete corrective action plans each year; 
  • the number of generator cold weather reliability events experienced in the previous winter; and 
  • megawatts of generating units that might be susceptible to the causes of the previous winter’s cold weather events. 

In its filing this week, FERC noted that no interventions or protests were filed by the March 12 due date. The commission concluded that the proposal meets its directives, and approved NERC’s data collection plan.