By Holden Mann

NERC Requests FERC Defer Standards Implementation.)

“The [FERC] chairman and I have talked, and we both agree that we don’t want FERC and NERC to be a burden to industry while we’re in this very constrained operating posture,” NERC CEO Jim Robb said at the Member Representatives Committee’s premeeting informational conference call last week. “[We] want to [be] very clear that our commitment is to work with industry to address these issues together.”

Delays to Ensure COVID-19 Preparedness

As NERC requested, the following cybersecurity supply chain standards that are scheduled to become effective July 1 will be delayed to Oct. 1:

• CIP-005-6 (Electronic security perimeter(s))
• CIP-010-3 (Configuration change management and vulnerability assessments)
• CIP-013-1 (Supply chain risk management)

The following standards scheduled to take effect Oct. 1 will be moved to April 1, 2021:

• PER-006-1 (Specific training for personnel)
• PRC-027-1 (Coordination of protection systems for performance during faults)

In addition, the July 1 compliance deadlines for two standards that are already effective will be pushed back to Jan. 1, 2021. Under PRC-002-2 (Disturbance monitoring and reporting requirements), which took effect July 1, 2016, entities are required to demonstrate 50% compliance with requirements R2-R4 and R6-R11, while PRC-025-2 (generator relay loadability) requires entities to establish compliance with certain measures.

“It is now necessary to balance the important role these NERC reliability standards play in protecting the reliability and security of the bulk power system with the need for registered entities to respond to the immediate challenges of COVID-19,” FERC said. “Therefore, we expect entities to continue their work in implementing the standards and to take advantage of the additional time to ensure they are fully compliant with these reliability standards when they become enforceable.”

Critics Warn of Reliability Risks

NERC’s request sparked limited opposition, with FERC receiving filings of support from Reliable Energy Analytics, the ISO/RTO Council, the American Public Power Association, Edison Electric Institute and others. However, the commission did note critical responses from advocacy group Protect Our Power and from author and activist Michael Mabee.

Both Protect Our Power and Mabee warned that FERC should not overlook the security benefits provided by the affected standards that prompted the original deadlines. Protect Our Power’s filing called for the commission to provide a 30-day delay for CIP-013-1, rather than 90 days; Mabee went further, saying that NERC and the broader industry knew of the possibility of a pandemic for years and should not be allowed to claim COVID-19 as a reason for deferral.

Moreover, he said the pandemic has made the U.S. more vulnerable to physical and cyberattacks on the grid, and that implementing the CIP standards should be completed sooner rather than later.

“Now is not the time to defer protections to the electric grid that the industry has had ample time to prepare for — because of a pandemic that the industry is telling the public they are prepared for. Granting NERC’s motion places the U.S. in further danger and is not in the public interest,” Mabee said in his filing (emphasis in original).

FERC noted that as it considered NERC’s request on an expedited basis, both objections arrived following the end of the comment period. However, the commission said that it would have denied both motions on their merits even if they had been submitted on time, as even if registered entities could have been expected to be prepared for a pandemic by now, “it is nevertheless reasonable to provide them additional flexibility” to address the impacts of COVID-19.