On March 7, 2014 the Federal Energy Regulatory Commission (FERC) issued an order giving the North American Electric Reliability Corporation (NERC) 90 days to submit for approval one or more reliability standards designed to increase physical protection of facilities that are critical to the reliability of the U.S. bulk power system. The order is a response to pressure on FERC from a number of U.S. senators following the recent public attention given to an attack on a transmission substation in California last year. Several U.S. senators lauded the order in press releases on Monday, noting that they will be “closely monitoring FERC and NERC’s progress on the standards as they move forward.”
FERC directs NERC to develop reliability standards that will require owners and operators of “critical facilities” to identify their critical facilities, evaluate the risks to those facilities, and develop and implement a plan to protect those facilities against physical threats. At the same time, FERC recognizes that a “one size fits all” approach to physical security is not appropriate. NERC is called upon to submit a proposal on an expedited basis, by June 5, 2014. FERC also directs NERC to develop and contemporaneously submit an implementation plan that requires owners and operators to implement the reliability standards in a “timely fashion.”
FERC’s 90-day deadline is extraordinarily short, particularly given the often glacial pace of the NERC standards development process. (By way of comparison, the NERC stakeholder process for version 1 of the NERC Critical Infrastructure Protection standards took several years.) It will be a major challenge for NERC to develop and file the required standards in the time permitted, but it may also provide NERC with an opportunity to demonstrate its ability to respond to recent criticisms that NERC’s processes are too slow and inefficient.
FERC’s order defines “critical facilities” as those facilities of which damage could cause instability, uncontrolled separation, or cascading failures on the grid. FERC does not provide detailed guidance on how the industry might apply this definition when complying with a future NERC reliability standard, but it does specify that methodologies should be based on objective analysis, technical expertise, and experienced judgment. With a broad range of possible interpretations, owners and operators will want to monitor the standard development process to ensure future compliance and to assess potential compliance costs.
The FERC order also encourages NERC to require third-party oversight of owner and operator compliance. FERC encouraged NERC to ensure that verification from entities “with appropriate expertise” in evaluating risk assessments and security plans will occur at various stages of the compliance process. Such oversight could be performed by FERC, NERC, or another relevant entity.
Questions regarding the potential sharing of sensitive security information with agencies and third parties will need to be carefully considered. In the past, FERC has urged Congress to adopt changes to the Freedom of Information Act that exempt from disclosure sensitive information identifying the vulnerabilities of the power grid. NERC has been asked to include in its proposed reliability standards a procedure that will ensure confidential treatment of sensitive or confidential information, while balancing the need to share information in connection with future compliance monitoring.
The pace of development and procedural restrictions on communications will present challenges to stakeholders wishing to communicate directly with FERC during development of the standards. Commissioner Norris, although agreeing with the need to develop reliability standards to address physical security of the grid, expressed concern about the potential lack of opportunity for industry feedback and the lack of transparency that may result. In an earlier statement, Commissioner Norris had expressed concern about overreaction among elected officials to the California substation incident. He called proposals to increase physical barriers to grid infrastructure “a 20th century solution for a 21st century problem,” concluding that “[w]e should be cautious about expending valuable time and resources, not to mention piling up billions in consumer costs in rate base, with the deployment of walls and fences.” Given his concerns and the likelihood that FERC will have a new chairman by the time the proposed rules are considered, it is unclear how quickly FERC will act and how it will respond to NERC’s proposals.
FERC has indicated that it will consider the reliability standards submitted by NERC in a future rulemaking docket, which will include an opportunity for comment. In the interim, anyone wishing to participate in the reliability standard development process must file with FERC to intervene by March 28, 2014.