FERC on Nov. 21 agreed to a final rule ordering utilities to adopt the North American Energy Standards Board’s (NAESB) latest updates to its Standards for Business Practices and Communication Protocols for Public Utilities (RM05-5).

The rulemaking issued at the commission’s monthly open meeting requires utilities to implement version 004 of the standards starting 12 months after the publication of the final rule in the Federal Register. By this point entities must have implemented the cybersecurity standards; the rest must be adopted by 18 months after publication.

NAESB published and filed version 004 of the standards on July 31, 2023, following their development by the organization’s Wholesale Electric Quadrant (WEQ). FERC proposed adopting them in April of this year, saying their use “would enhance the electric industries’ systems and software security measures and improve efficiencies of certain business processes transactions.” (See FERC Proposes Adopting NAESB’s Latest Revisions.)

Version 004 modifies multiple existing standards from the suite:

• • WEQ-000: Abbreviations, acronyms and definition of terms
  • WEQ-001: Open access same-time information system (OASIS)
  • WEQ-002: OASIS Standards and Communication Protocol (S&CP)
  • WEQ-003: OASIS data dictionary
  • WEQ-004: Coordinate interchange
  • WEQ-005: Area control error equation special cases
  • WEQ-006: Manual time error correction
  • WEQ-008: Transmission loading relief (TLR) – Eastern Interconnection
  • WEQ-012: Public Key Infrastructure (PKI)
  • WEQ-013: OASIS implementation guide
  • WEQ-015: Measurement and verification of wholesale electricity demand response
  • WEQ-021: Measurement and verification of energy efficiency products
  • WEQ-022: Electric industry registry
  • WEQ-023: Modeling

Also included in the adoption is a new set of standards, WEQ-024 (Cybersecurity business practice standards). NAESB said the WEQ-024 standards “reorganizes existing NAESB cybersecurity business practice standards” in response to a recommendation from the Department of Energy and Sandia Labs after a 2019 assessment of the cybersecurity elements in a previous version of the standards.

FERC said it declined to adopt WEQ-010 out of consistency with its “past practice of not incorporating by reference … any optional model contracts and related documents because we do not require the use of such contracts.” In addition, the WEQ-025 standard has also been omitted, along with related changes to WEQ-000, because they use terms that are similar to FERC’s pro forma open access transmission tariff.

The commission said public utilities whose tariffs do not automatically incorporate all new NAESB standards without modification must submit compliance filings no later than 120 days after the final rule’s publication. Compliance filings must include two separate tariff records; the first must include a reference to the NAESB cybersecurity standards with a proposed effective date 12 months after publication, and the second must refer to all version 004 standards in the final rule with an effective date 18 months after publication.

Utilities must specify in their tariff records, for all of the NAESB standards adopted, whether the standard is incorporated by reference; if not, which tariff provision complies with the standard, and any standards for which the utility has been granted a waiver, extension of time or other variance.