This comment form is no longer interactive because the comment period is closed.

2016-02 Modifications to CIP Standards | CIP-002-6 (Draft 3)

Description:

Start Date: 06/03/2019
End Date: 07/17/2019

Associated Ballots:

Ballot Name Project Standard Pool Open Pool Close Voting Start Voting End
2016-02 Modifications to CIP Standards CIP-002-6 AB 3 ST 2016-02 Modifications to CIP Standards CIP-002-6 09/14/2017 07/02/2019 07/08/2019 07/17/2019

Filter:

Hot Answers

Daniela Hammons, CenterPoint Energy Houston Electric, LLC, 1, 7/17/2019

- 0 - 0

“Please see comments submitted by the Edison Electric Institute” 

Ayman Samaan, On Behalf of: Ayman Samaan, , Segments 1, 3, 5, 6

- 0 - 0

Other Answers

Stacy Lee, On Behalf of: City of College Station, , Segments 1

- 0 - 0

Kjersti Drott, Tri-State G and T Association, Inc., 1, 6/11/2019

- 0 - 0

Steven Rueckert, Western Electricity Coordinating Council, 10, 6/14/2019

- 0 - 0

Black Hills agrees with the approach, but wonder if there might be inconsistency among entities in how BES Transmission Lines are counted, i.e. does segmentation of a transmission path increase the "number" of lines?

Maryanne Darling-Reich, On Behalf of: Black Hills Corporation - MRO, WECC - Segments 1, 3, 5, 6

- 0 - 0

Ginger Mercier, On Behalf of: Prairie Power, Inc. - SERC - Segments 1, 3

- 0 - 0

Jeanne Kurzynowski, On Behalf of: CMS Energy - Consumers Energy Company - RF - Segments 1, 3, 4, 5

- 0 - 0

Leanna Lamatrice, 7/5/2019

- 0 - 0

Public Utility District No. 1 of Chelan County, Segment(s) 3, 1, 5, 6, 11/29/2018

- 0 - 0

Val Ridad, Silicon Valley Power - City of Santa Clara, 3, 7/8/2019

- 0 - 0

Sandra Pacheco, Silicon Valley Power - City of Santa Clara, 5, 7/8/2019

- 0 - 0

DTE Energy - DTE Electric, Segment(s) 5, 4, 3, 2/27/2017

- 0 - 0

None

Aaron Cavanaugh, On Behalf of: Bonneville Power Administration, WECC, Segments 1, 3, 5, 6

- 0 - 0

Neil Swearingen, On Behalf of: Salt River Project, WECC, Segments 1, 3, 5, 6

- 0 - 0

NSRF appreciates the additional clarity of Criterion 2.12, and the establishment of a bright line between Medium and Low Impact Control Centers.

MRO NSRF, Segment(s) 3, 4, 5, 6, 1, 2, 7/19/2017

- 0 - 0

Lana Smith, San Miguel Electric Cooperative, Inc., 5, 7/10/2019

- 0 - 0

Santee Cooper, Segment(s) 1, 3, 5, 6, 7/11/2019

- 0 - 0

Bruce Reimer, Manitoba Hydro , 1, 7/11/2019

- 0 - 0

We agree that the proposed revision adds clarity to differentiate between medium- and low-impact BES Cyber Systems at Control Centers. However, simple changes to the proposal would avoid TO control room inclusion within the usage of the term “Control Center,” which may create a lack of clarity under other NERC Reliability Standards that use the defined term “Control Centers.” Our position is that the language proposed below ensures TO control room BCS are appropriately categorized without using this revision to CIP-002 to create a new threshold for identifying Control Centers that perform the reliability tasks of a TOP.

We also recommend that the SDT consider if conforming changes to CIP-002 Attachment 1 Criteria 1.3 are needed for consistency with its proposed changes to CIP-002-6 Criteria 2.12, or our proposed changes below.

As an alternative, we propose the following modification to Criteria 2.12 to address TO control rooms that have the capability to perform monitoring and control of BES Transmission Lines while keeping the weighting proposed by the SDT (proposed language in bold + underline):

“Control Centers or backup Control Centers, not included in High Impact Rating above, that monitor and control BES Transmission Lines, or facilities hosting operating personnel that have the capability to monitor and control BES Transmission Lines, with an "aggregate weighted value" exceeding 6000 according to the table below. The "aggregate weighted value" for a Control Center or backup Control Center is determined by summing the "weight value per line" shown in the table below for each BES Transmission Line monitored and controlled by the Control Center or backup Control Center. The "aggregate weighted value" for a facility hosting operating personnel that has the capability to monitor and control BES Transmission Lines is determined by summing the "weight value per line" shown in the table below for each BES Transmission Line that could be monitored and controlled by the facility hosting operating personnel.”

Thomas Savin, 7/11/2019

- 0 - 0

Tim Womack, Puget Sound Energy, Inc., 3, 7/11/2019

- 0 - 0

Tennessee Valley Authority, Segment(s) 1, 3, 5, 6, 10/18/2018

- 0 - 0

Larry Snow, On Behalf of: Cogentrix Energy Power Management, LLC, NPCC, SERC, RF, Segments 5

- 0 - 0

Alex Ybarra, 7/12/2019

- 0 - 0

Dominion, Segment(s) 3, 5, 1, 4/6/2017

- 0 - 0

Kevin Salsbury, Berkshire Hathaway - NV Energy, 5, 7/15/2019

- 0 - 0

Roger Fradenburgh, On Behalf of: Nicholas Lauriat, Network and Security Technologies, 1

- 0 - 0

Please refer to comments from the MRO NERC Standards Review Forum (NSRF).

Andy Fuhrman, On Behalf of: Theresa Allard, Minnkota Power Cooperative Inc., 1

- 0 - 0

Tony Skourtas, Los Angeles Department of Water and Power, 3, 7/15/2019

- 0 - 0

Sandra Revnell, On Behalf of: Wolverine Power Supply Cooperative, Inc., , Segments 1

- 0 - 0

The proposed language will not reduce the confusion regarding the identification of medium impact BES Cyber Systems. Many entities in the RF footprint have Control Centers that monitor BES Transmission Lines but only control those lines under direction from the registered TOP. The language in this Draft of CIP-002-6 does not make clear that these entities must identify BES Cyber Systems in such Control Centers as medium impact. RF suggests changing the phrase “that monitor and control” to “that are capable of controlling or monitoring.”

Anthony Jablonski, ReliabilityFirst , 10, 7/16/2019

- 0 - 0

Reclamation recommends simplifying the Impact Rating Criteria using the following methodology:

BES Cyber Systems are to be rated as high, medium, or low impact as follows:

A high impact BES Cyber System is a Control Center that has one or more of the following characteristics:

  1. Is used to operate transmission lines of 500kV or above;

  2. Supports a sum greater than 2500kV of transmission lines above 230kV;

  3. Supports generation with an aggregate capacity greater than 3000MW;

  4. Is identified as supporting an IROL or is necessary to avoid an Adverse Reliability Impact.

A medium impact BES Cyber System has one or more of the following characteristics:

  1. Supports generation with the aggregate capacity between 1500 – 3000MW;

  2. Supports a sum between 1500 – 2500kV of transmission lines above 230kV;

  3. Supports a RAS that could negatively affect an IROL or that can perform automatic Load shedding of 300MW or more.

A low impact BES Cyber System has one or more of the following characteristics:

  1. Supports a sum less than 1500kV of transmission lines above 230kV;

  2. Supports transmission only between 100 – 230kV;

  3. Supports generation with an aggregate capacity between 75 – 1500MW;

  4. Supports any single generator greater than 20MW not already identified as a Medium Impact BES Cyber System;

  5. Supports any Facilities that are designated a blackstart resource;

  6. Supports any other RAS not already identified as a medium impact BES Cyber System.

Richard Jackson, U.S. Bureau of Reclamation, 1, 7/16/2019

- 0 - 0

Chinedu Ochonogor, 7/16/2019

- 0 - 0

N/A

Tho Tran, On Behalf of: Lee Maurer, Oncor Electric Delivery, 1

- 0 - 0

Nick Batty, On Behalf of: Nick Batty, , Segments 4

- 0 - 0

FirstEnergy, Segment(s) 4, 3, 5, 6, 9/5/2018

- 0 - 0

NCPA is not a Transmission Operator and has No Comment.

Marty Hostler, Northern California Power Agency, 5, 7/16/2019

- 0 - 0

Agree

Gerry Adamski, Cogentrix Energy Power Management, LLC, 5, 7/16/2019

- 0 - 0

MISO appreciates the additional clarity of Criterion 2.12, and the establishment of a bright line between Medium and Low Impact Control Centers.

- 0 - 0

RSC no Dominion annd Con Ed, Segment(s) 10, 2, 4, 5, 7, 3, 1, 0, 6, 7/17/2019

- 0 - 0

Pam Feuerstein, Intermountain REA, 3, 7/17/2019

- 0 - 0

 

 

Stephanie Burns, On Behalf of: Michael Moltane, International Transmission Company Holdings Corporation, 1

- 0 - 0

FMPA, Segment(s) , 1/18/2019

- 0 - 0

Larry Heckert, Alliant Energy Corporation Services, Inc., 4, 7/17/2019

- 0 - 0

Larry Watt, Lakeland Electric, 1, 7/17/2019

- 0 - 0

Patricia Boody, Lakeland Electric, 3, 7/17/2019

- 0 - 0

sean erickson, Western Area Power Administration, 1, 7/17/2019

- 0 - 0

Jesus Sammy Alcaraz, On Behalf of: Imperial Irrigation District, , Segments 1, 3, 5, 6

- 0 - 0

Transmission Line Impact Criteria should be based on the Short Circuit MVA (6,000 MVA or greater) , and not on arbitrary weighting factors.

Spencer Tacke, Modesto Irrigation District, 4, 7/17/2019

- 0 - 0

EEI member companies generally support this change.

Mark Gray, On Behalf of: Edison Electric Institute, NA - Not Applicable, Segments NA - Not Applicable

- 0 - 0

Texas RE appreciates the standard drafting team’s (SDT) work on revising this standard.  Texas RE does have two concerns regarding Criterion 2.12.  Primarily, Texas RE is concerned that the new Criterion 2.12 will result in some entities who were previously classified as medium impact to be classified as low impact, thus taking away the applicability of requirements CIP-003-CIP-011.  Currently, under high impact rating 1.3, a Transmission Owner or Transmission Operator that owns Control Center(s) or backup Control Center(s) that is not used to perform the functional obligations of the Transmission Operator for one or more of the assets that meet criterion 2.2, 2.4, 2.5, 2.7, 2.8, 2.9, or 2.10 would not have identified high impact BES Cyber Systems.  Under medium impact rating 2.12, however, those BES Cyber Systems would be identified as medium impact, which states, “2.12. Each Control Center or backup Control Center used to perform the functional obligations of the Transmission Operator not included in High Impact Rating (H), above”.

 

The Texas RE region has several entities in its footprint that could potentially change from a medium impact to low impact, which could reduce reliability as they would not be obligated to comply with CIP-003-CIP-011.  The following scenarios could take place as a result of the change.

Texas RE appreciates the standard drafting team’s (SDT) work on revising this standard.  Texas RE does have two concerns regarding Criterion 2.12.  Primarily, Texas RE is concerned that the new Criterion 2.12 will result in some entities who were previously classified as medium impact to be classified as low impact, thus taking away the applicability of requirements CIP-003-CIP-011.  Currently, under high impact rating 1.3, a Transmission Owner or Transmission Operator that owns Control Center(s) or backup Control Center(s) that is not used to perform the functional obligations of the Transmission Operator for one or more of the assets that meet criterion 2.2, 2.4, 2.5, 2.7, 2.8, 2.9, or 2.10 would not have identified high impact BES Cyber Systems.  Under medium impact rating 2.12, however, those BES Cyber Systems would be identified as medium impact, which states, “2.12. Each Control Center or backup Control Center used to perform the functional obligations of the Transmission Operator not included in High Impact Rating (H), above”.

The Texas RE region has several entities in its footprint that could potentially change from a medium impact to low impact, which could reduce reliability as they would not be obligated to comply with CIP-003-CIP-011.  The following scenarios could take place as a result of the change.

  • Example #1: A TO or TOP that monitors and controls substation(s) that are operating less than 200 kV and not connected to three or more other Transmission stations or substations and does not have an "aggregate weighted value" exceeding 3000 (Criterion 2.5) would not have identified high impact BES Cyber Systems. However, the current language of Criterion 2.12 would identify those BES Cyber Systems as medium impact.

  • Example #2: A TO or TOP that monitors and controls substation(s) that are operating 345 kV and are connected to one or two other Transmission stations or substations and does not have an "aggregate weighted value" exceeding 3000 (Criterion 2.5) would not have identified high impact BES Cyber Systems. However, the current language of Criterion 2.12 would identify those BES Cyber Systems as medium impact.

     

With the proposed modifications in CIP-002-6 Attachment 1, Criterion 2.12 uses the "aggregate weighted value" exceeding 6000. In both scenarios above, the identified medium impact BES Cyber Systems could now be identified as low impact BES Cyber Systems if all the BES Transmission Lines did not have an "aggregate weighted value" exceeding 6000.

Secondly, Texas RE recommends adding a requirement that entities should consider the impact of locations where the impact of the sub-100 kV Transmission Line resulted in the inclusion of that line as a BES Transmission Line, since a sub-100kV system contributed to the September 2011 southwest blackout.  In the aggregate weight table there is no provision for Transmission Lines below 100 kV that have been flagged as part of the weighting system.

 

Texas RE also noticed two additional items with regards to the standard.  First, the rationale box for Criterion 2.12 states “The proposed criterion establishes a weighted value for BES Transmission Lines based on voltage class for BES Transmission Lines operated between 100 and 499 kV.”  This comment form, however, states “The proposed criterion establishes an average MVA line loading based on voltage class, for BES Transmission Lines operated between 100 and 499 kV.”  Texas RE inquires as to which is correct.

Lastly, Texas RE has the following additional comments regarding the Guidelines and Technical Basis:

  • Texas RE is of the understanding that Guidelines and Technical Basis are being converted to Technical Rationale and/or Implementation Guidance in accordance with the Technical Rationale Transition Plan.  Since CIP-002-6 is open for development, it seems that the SDT should be following Track 2 of the Transition Plan.  It also appears that the content related to Criterion 2.12 should be considered for development as Implementation Guidance and should follow the Compliance Guidance Policy.

  • Under “Generation” on page 29, “Bas” should be “BAs”.

  • On page 30, the second paragraph includes a reference to TPL-003, for which there is no currently effective version:  “If it is determined through System studies that a unit must run in order to preserve the reliability of the BES, such as due to a Category C3 contingency as defined in TPL-003, then BES Cyber Systems for that unit are categorized as medium impact.”  Texas RE recommends updating language to: “If it is determined through System studies that a unit must run in order to preserve the reliability of the BES, such as due to an event identified in the TPL Standards, then BES Cyber Systems for that unit are categorized as medium impact.”

  • On page 30, in the third paragraph, it states “The TPL standards require that, where the studies and plans indicate additional actions, that these studies and plans be communicated by the Planning Coordinator or Transmission Planner in writing to the Regional Entity/RRO. Actions necessary for the implementation of these plans by affected parties (generation owners/operators and Reliability Coordinators or other necessary party) are usually formalized in the form of an agreement and/or contract.”  This language is not used in TPL-001-4, but similar language addressing the use of non-consequential load loss is used in Footnote 12. Recommend updating this language to be consistent with the effective standards.

  • On page 31, in the second bullet, “interconnection” should be capitalized as it is a defined term in the NERC Glossary.

  • On page 31, under Transmission, the following statement appears to be out of date given the implementation of MOD-025-2: “Criterion 2.2 includes BES Cyber Systems for those Facilities in Transmission Systems that provide reactive resources to enhance and preserve the reliability of the BES. The nameplate value is used here because there is no NERC requirement to verify actual capability of these Facilities.”  Texas RE recommends the SDT update that statement.   

  • On page 32 strike “Attachment 1 of” in the sentence starting with “Additionally…”.  The link provided links to Attachment 1. 

  • On page 33, the second bullet from the bottom - The phrase “… and its Transmission provider” should be changed to “… and its Transmission Entity(ies)” as defined in NUC-001-3. In the last sentence on page 33, “Generation” should be lower case or changed from “Generation owner” to “Generator Owner”.

  • On page 34, in the first full sentence, “for” should not be deleted after “BES Cyber Systems”.

  • On page 34, in the third paragraph, there should be a space in “1500MW”.   

  • On page 34, the fourth paragraph references Load acting as a Resource (“LaaR”).  Since LaaR does not exists anymore in the ERCOT region, Texas RE recommends updating this paragraph.

  • On page 35, Texas RE requests the analysis and results of the analysis used by the SDT to validate that those facilities that may have significant impact are categorized at an appropriate level commensurate with the associated risk.  There are 108 registered BAs, 19 RCs, and 181 TOPs that have Control Centers.  GOPs and TOs acting as a TOP do not have clear numbers. 

  • Beginning on page 36, the Restoration Facilities section appears to have been written in 2012.  Texas RE suggests the SDT review it and make necessary updates.  For example, EOP-005-2 is no longer effective.

     

Rachel Coyne, Texas Reliability Entity, Inc., 10, 7/17/2019

- 0 - 0

Becky Webb, Exelon, 6, 7/17/2019

- 0 - 0

Eric Smith, 7/17/2019

- 0 - 0

Andrea Barclay, Georgia System Operations Corporation, 4, 7/17/2019

- 0 - 0

Westar and Kansas City Power & Light Co. support and incorporate by reference Edison Electric Institute's response to Question 1.

Westar-KCPL, Segment(s) 1, 3, 5, 6, 12/18/2018

- 0 - 0

IESO supports the comments submitted by NPCC

No further comment on this question

Leonard Kula, Independent Electricity System Operator, 2, 7/17/2019

- 0 - 0

Neville Bowen, Ocala Utility Services, 3, 7/17/2019

- 0 - 0

ACES Standard Collaborations, Segment(s) 1, 3, 5, 7/17/2019

- 0 - 0

Duke Energy, Segment(s) 1, 5, 6, 3, 7/17/2019

- 0 - 0

Patrick Wells, OGE Energy - Oklahoma Gas and Electric Co., 5, 7/17/2019

- 0 - 0

Constantin Chitescu, Ontario Power Generation Inc., 5, 7/17/2019

- 0 - 0

None

Michael Johnson, On Behalf of: Marco Rios, Pacific Gas and Electric Company, 1,3,5

- 0 - 0

Teresa Cantwell, Lower Colorado River Authority, 5, 7/17/2019

- 0 - 0

Trey Melcher, 7/17/2019

- 0 - 0

David Jendras, Ameren - Ameren Services, 3, 7/17/2019

- 0 - 0

Minnesota Power supports EEI's comments.

Jamie Monette, Allete - Minnesota Power, Inc., 1, 7/17/2019

- 0 - 0

LaTroy Brumfield, American Transmission Company, LLC, 1, 7/17/2019

- 0 - 0

Southern Company agrees with the proposed modification and appreciates the establishment of a bright line criteria between Low and Medium Impact Control Centers.  

Southern Company, Segment(s) 1, 3, 5, 6, 7/17/2019

- 0 - 0

Please see comments submitted by the Edison Electric Institute

Kenya Streeter, Edison International - Southern California Edison Company, 6, 7/17/2019

- 0 - 0

Hot Answers

Daniela Hammons, CenterPoint Energy Houston Electric, LLC, 1, 7/17/2019

- 0 - 0

“Please see comments submitted by the Edison Electric Institute” 

Ayman Samaan, On Behalf of: Ayman Samaan, , Segments 1, 3, 5, 6

- 0 - 0

Other Answers

Stacy Lee, On Behalf of: City of College Station, , Segments 1

- 0 - 0

Kjersti Drott, Tri-State G and T Association, Inc., 1, 6/11/2019

- 0 - 0

Steven Rueckert, Western Electricity Coordinating Council, 10, 6/14/2019

- 0 - 0

Maryanne Darling-Reich, On Behalf of: Black Hills Corporation - MRO, WECC - Segments 1, 3, 5, 6

- 0 - 0

Ginger Mercier, On Behalf of: Prairie Power, Inc. - SERC - Segments 1, 3

- 0 - 0

NO, WE DO NOT ARGEE, as the language of the “Planned Changes” treats High, Medium and Low Impact BES Cyber Systems/Assets all the same.  Specifically, when it comes to Low Impact System/Assets, the changes mandate less flexibility and would require immediate, “upon commissioning” compliance and rather than being documented and discovered during the once every 15 calendar months assessment, necessitate real-time tracking of all modification projects that might add to or change Low Impact BES Cyber Systems/Assets.

Additionally:

  • Much of the language dates back to the Implementation Plan of CIP-002 rev 2 and the document, Implementation Plan for Newly Identified Critical Cyber Assets when the focus was on much more critical and essential cyber assets that could potentially, significantly impact the reliability of the BES.  Applying these same implementation/new milestones (and thus immediately “upon commissioning”) and requirements to Low Impact BES Cyber Systems/Assets in not appropriate to the risk.
  • To put things in perspective, Low Impact BES Cyber Systems/Assets typically would have previously been considered “non-critical” cyber assets under the earlier CIP versions/requirements and thus required zero protections, ever.  Although, this may have resulted previously in some gap in protection, it is with this background that newly identified Low Impact BES Cyber Systems/Assets needs to be viewed. 

  • As such, a compliance implementation milestone table needs to be again utilized for not only Unplanned Changes, but Planned Changes as well.

  • Additionally, keeping in line with the once every 15 calendar months assessment of cyber systems/assets, Planned additions of Low Impact BES Cyber Systems/Assets should not require individual real-time tracking (that would be necessitated with compliance upon commissioning) and instead should be discovered during the once every 15 calendar months assessment and then compliant some time thereafter, following the assessment.  …12 months seems a reasonable duration for this.

  • Further, in contrast and to put things in better perspective, allowing 12 months for a High-Impact BES Cyber System/Asset (Or 24 months if a new asset type) for an Unplanned Change and yet requiring a Low Impact BES Cyber System/Asset as part of a “planned” modification to be compliant upon commissioning makes little sense, especially in a risk-based environment.

  • Planned additions of new (or recently re-categorized) Low Impact systems/assets should have an implementation table commensurate with their low-to-minimal-to-possibly virtually non-existent impact.

Jeanne Kurzynowski, On Behalf of: CMS Energy - Consumers Energy Company - RF - Segments 1, 3, 4, 5

- 0 - 0

Leanna Lamatrice, 7/5/2019

- 0 - 0

Public Utility District No. 1 of Chelan County, Segment(s) 3, 1, 5, 6, 11/29/2018

- 0 - 0

Val Ridad, Silicon Valley Power - City of Santa Clara, 3, 7/8/2019

- 0 - 0

Sandra Pacheco, Silicon Valley Power - City of Santa Clara, 5, 7/8/2019

- 0 - 0

DTE Energy - DTE Electric, Segment(s) 5, 4, 3, 2/27/2017

- 0 - 0

None

Aaron Cavanaugh, On Behalf of: Bonneville Power Administration, WECC, Segments 1, 3, 5, 6

- 0 - 0

Neil Swearingen, On Behalf of: Salt River Project, WECC, Segments 1, 3, 5, 6

- 0 - 0

MRO NSRF, Segment(s) 3, 4, 5, 6, 1, 2, 7/19/2017

- 0 - 0

Lana Smith, San Miguel Electric Cooperative, Inc., 5, 7/10/2019

- 0 - 0

Santee Cooper, Segment(s) 1, 3, 5, 6, 7/11/2019

- 0 - 0

Bruce Reimer, Manitoba Hydro , 1, 7/11/2019

- 0 - 0

Thomas Savin, 7/11/2019

- 0 - 0

Tim Womack, Puget Sound Energy, Inc., 3, 7/11/2019

- 0 - 0

The revision is likely to be interpreted that the categorization of a BES Cyber System will become effective when the BES Cyber System is part of generation that is first tied to the grid.  This does not allow the entity to perform necessary testing and commissioning online during a time period when the BA understands that the generation associated with the new BES Cyber System is not yet reliable.  During the time when the BA understands this generation to be unreliable due to further testing, the BA’s function maintains grid reliability without dependence on the load from the generation associated with the new BES Cyber System.

Tennessee Valley Authority, Segment(s) 1, 3, 5, 6, 10/18/2018

- 0 - 0

As the Regions seem to arbitrarily define Planned or Unplanned Changes, various situations could create serious compliance issues, especially for generation entities.

An example of this would be purchase of generation assets and controlling those assets from a Low Impact Control Center. Incorporating the control of those assets may possibly change the impact classification of that Control Center to Medium or High. As the generation sector of our industry is seeing increased sale and purchase of generation facilities, as well as a decrease in the amount of time for sales and purchases to close, this would place an undue and unobtainable burden to have such a Control Center compliant to the new impact classification.

Until there are clearly defined definitions of Planned and Unplanned Changes which are administered uniformly and address such situations as described above, we do not support this proposal.

Larry Snow, On Behalf of: Cogentrix Energy Power Management, LLC, NPCC, SERC, RF, Segments 5

- 0 - 0

Alex Ybarra, 7/12/2019

- 0 - 0

The phrase “…effective upon the date the new BES Cyber System is capable of impacting the BES.” is ambiguous and could lead to different interpretations of the “impact” date. An example would be when a new generator is being tested to validate it can sync to the grid before the BES Cyber System has been installed, tested, and placed in service. At this point in time, the generator can technically impact the BES, although in a non-substantive manner, but the generator owner will have coordinated with the RC/TOP/TP to make allowances for this testing and that the generator test run could end abruptly and accommodations are made to minimize any potential impacts. Dominion Energy suggests that the following language, used by SERC and published on their website, be used in place of the phrase: “Newly built Elements that are classified as BES Elements under the BES definition should be compliant prior to that Element being placed in service and added to the pool of BES Assets.”

Dominion, Segment(s) 3, 5, 1, 4/6/2017

- 0 - 0

Kevin Salsbury, Berkshire Hathaway - NV Energy, 5, 7/15/2019

- 0 - 0

Roger Fradenburgh, On Behalf of: Nicholas Lauriat, Network and Security Technologies, 1

- 0 - 0

Andy Fuhrman, On Behalf of: Theresa Allard, Minnkota Power Cooperative Inc., 1

- 0 - 0

Tony Skourtas, Los Angeles Department of Water and Power, 3, 7/15/2019

- 0 - 0

Sandra Revnell, On Behalf of: Wolverine Power Supply Cooperative, Inc., , Segments 1

- 0 - 0

Section A.5:

  1. “[T]he categorization of the BES Cyber System shall become effective upon the date the BES Cyber System meets the new impact criteria in Attachment 1, regardless of when the Responsible Entity performs its review of identifications under Requirement R2[.]” This may be misleading in that the only “new” impact criterion in this version is 2.12. RF recommends the wording be changed to, “[T]he categorization of the BES Cyber System shall become effective upon the date the BES Cyber System meets at least one criterion at a higher impact rating in Attachment 1, regardless of when the Responsible Entity performs its review of identifications under Requirement R2[.]”

  2. The language is not clear that it applies to a new asset coming into scope as a BES asset, and therefore will have new low impact BES Cyber Systems (LIBCS). As the Standard does not require identification of LIBCS, but only identification of the assets containing LIBCS, it’s not clear that the language “planned change resulting in a new BES Cyber System” and “planned change resulting in a change in categorization for an existing BES Cyber System” will be effective in capturing new LIBCS. The language should directly address changes resulting in additional identified assets that contain LIBCS coming into scope for CIP-002. There are similar concerns for unplanned changes.

  3. The language regarding initial performance of periodic obligations will result in very long lead times for some Requirements. For example, testing of an incident response plan for new low impact BES Cyber Systems (LIBCS) resulting from an unplanned change would not be required until 5 years after identification of the LIBCS. The initial performance of periodic requirements should be tightened to a more reasonable timeframe in order to reduce risk to the BES.

     

Section E is meant to incorporate the existing Interpretation. There are two problems with this:

  1. The SDT did not fulfill the language of the NERC RoP regarding Interpretations:  “The Interpretation shall stand until such time as the Interpretation can be incorporated into a future revision of the Reliability Standard or the Interpretation is retired due to a future modification of the applicable Requirement.” [Standard Processes Manual, RoP Appendix 3A, Section 7] Since this revision of the Standard is an opportunity where the SDT can incorporate the Interpretation, it is incumbent upon the SDT to do so.

  2. Placing the reference to the Interpretation in a section that is not identified by the Standard Processes Manual Section 2.5 may render the Interpretation unenforceable: “The only mandatory and enforceable components of a Reliability Standard are the: (1) applicability, (2) Requirements, and the (3) effective dates. The additional components are included in the Reliability Standard for informational purposes, to establish the relevant scope and technical paradigm, and to provide guidance to Functional Entities concerning how compliance will be assessed by the Compliance Enforcement Authority.” [Standard Processes Manual, Section 2.5]

Anthony Jablonski, ReliabilityFirst , 10, 7/16/2019

- 0 - 0

Richard Jackson, U.S. Bureau of Reclamation, 1, 7/16/2019

- 0 - 0

Chinedu Ochonogor, 7/16/2019

- 0 - 0

Propose including "and rely upon to perform reliability tasks."

Tho Tran, On Behalf of: Lee Maurer, Oncor Electric Delivery, 1

- 0 - 0

Nick Batty, On Behalf of: Nick Batty, , Segments 4

- 0 - 0

FirstEnergy, Segment(s) 4, 3, 5, 6, 9/5/2018

- 0 - 0

No however I am willing to agree that all changes, regardless if Planned or Unplanned, should be treated equally.  If Unplanned changes allow an entity two years to become compliant then NERC should not descriminate against those that have Planned changes.  Both should be allowed two years to become compliant.  Fairness!

Marty Hostler, Northern California Power Agency, 5, 7/16/2019

- 0 - 0

As the Regions seem to arbitrarily define Planned or Unplanned Changes, various situations could create serious compliance issues, especially for generation entities.

An example of this would be purchase of generation assets and controlling those assets from a Low Impact Control Center. Incorporating the control of those assets may possibly change the impact classification of that Control Center to Medium or even possibly High. As the generation sector of our industry is seeing increased sale and purchase of generation facilities (especially in the private equity arena), as well as a decrease in the amount of time for sales and purchases to close, this proposed change would place an undue and unobtainable burden to have such a Control Center compliant to the new impact classification immediately upon acquisition.

Until there are clearly defined definitions of Planned and Unplanned Changes which are administered uniformly and address such situations as described above, we do not support this proposal.

I suggest that the proposed definition of Unplanned Change in footnote 2 of Page 4 be modified to include this scenario as subpart (5):

(5) A change in the classification of a Control Center per application of CIP-002, R1 and/or R2 caused by the purchase of a generating facility that is incorporated for control in that Control Center following its acquisition.

Gerry Adamski, Cogentrix Energy Power Management, LLC, 5, 7/16/2019

- 0 - 0

- 0 - 0

RSC no Dominion annd Con Ed, Segment(s) 10, 2, 4, 5, 7, 3, 1, 0, 6, 7/17/2019

- 0 - 0

Pam Feuerstein, Intermountain REA, 3, 7/17/2019

- 0 - 0

Stephanie Burns, On Behalf of: Michael Moltane, International Transmission Company Holdings Corporation, 1

- 0 - 0

FMPA, Segment(s) , 1/18/2019

- 0 - 0

Larry Heckert, Alliant Energy Corporation Services, Inc., 4, 7/17/2019

- 0 - 0

Larry Watt, Lakeland Electric, 1, 7/17/2019

- 0 - 0

Patricia Boody, Lakeland Electric, 3, 7/17/2019

- 0 - 0

Clarifying planned and unplanned changes: they need to be more concise. The draft footnotes are too long and almost belong in the Glossary.

sean erickson, Western Area Power Administration, 1, 7/17/2019

- 0 - 0

Jesus Sammy Alcaraz, On Behalf of: Imperial Irrigation District, , Segments 1, 3, 5, 6

- 0 - 0

Spencer Tacke, Modesto Irrigation District, 4, 7/17/2019

- 0 - 0

EEI member companies generally support this change.

Mark Gray, On Behalf of: Edison Electric Institute, NA - Not Applicable, Segments NA - Not Applicable

- 0 - 0

Rachel Coyne, Texas Reliability Entity, Inc., 10, 7/17/2019

- 0 - 0

Becky Webb, Exelon, 6, 7/17/2019

- 0 - 0

Eric Smith, 7/17/2019

- 0 - 0

Unnecessarily Prescriptive:

We do not agree with the proposed modifications relating to “capable of impacting the BES.”  This change from the v5 Implementation Plan is unnecessary and overly prescriptive.  Specifically, the SDT has chosen to define “upon commissioning” without appreciating the complexity of commissioning or recognizing that commissioning is a process and not a point in time.  The proposed change does not reflect the reality of cyber-physical systems.  As defined in the NERC Glossary of Terms, the BES is comprised of Elements.  These Elements include electrical devices such as “a generator, transformer, circuit breaker” etc.  The BES Cyber Assets cannot be separated from the physical components that they control.  As such, if a breaker is an Element and an Element is part of the BES, then there is no time at which the BES Cyber Asset is not “impacting the BES” since even though the circuit breaker switched out of service, it is still itself part of the BES.  Ultimately, it appears that the changes proposed by the SDT in an attempt to provide clarity in certain circumstances, have inadvertently introduced unnecessary complexity and confusion into the commissioning process.

Alternative Proposal 1:

We propose that in place of the existing planned changes proposal that the SDT adopt the language as written in the version 5 Implementation Plan:

“For planned changes resulting in a higher categorization, the responsible entity shall comply with all applicable requirements on the update of the identification and categorization of the affected BES Cyber System and any applicable and associated Physical Access Control Systems, Electronic Access Control and Monitoring Systems and Protected Cyber Assets, with additional time to comply for requirements” that contain periodic obligations as provided in the version 5 Implementation Plan.

Alternative Proposal 2:

If the SDT insists on requiring that compliance be met “upon commissioning,” then we request that this obligation only apply to medium and high impact BES Cyber Systems and that the language state that the responsible entity shall comply with applicable periodic requirements within the first period following the commissioning as identified by the Responsible Entity, and with all other applicable requirements “upon commissioning as identified by the Responsible Entity.”  This modification recognizes the complexity of the commissioning process and allows for flexibility since the commissioning process is not the same for different types of assets or different types of entities.

Andrea Barclay, Georgia System Operations Corporation, 4, 7/17/2019

- 0 - 0

Westar and Kansas City Power & Light Co. support and incorporate by reference Edison Electric Institute's response to Question 2.

Westar-KCPL, Segment(s) 1, 3, 5, 6, 12/18/2018

- 0 - 0

No comment

Leonard Kula, Independent Electricity System Operator, 2, 7/17/2019

- 0 - 0

Neville Bowen, Ocala Utility Services, 3, 7/17/2019

- 0 - 0

ACES Standard Collaborations, Segment(s) 1, 3, 5, 7/17/2019

- 0 - 0

Duke Energy, Segment(s) 1, 5, 6, 3, 7/17/2019

- 0 - 0

Patrick Wells, OGE Energy - Oklahoma Gas and Electric Co., 5, 7/17/2019

- 0 - 0

Constantin Chitescu, Ontario Power Generation Inc., 5, 7/17/2019

- 0 - 0

PG&E believes the text of “capable of impacting the BES” will lead to interpretation differences between Entities and ERO Audit Teams due to the subjective nature of the text.  Could the impact occur when; a) the BCS is initially installed, b) when it is being tested, c) after testing, or d) when it is placed into production?

With new BCS installations occurring months before actual production usage, the subjective nature of “capable of impacting” could subject an Entity to an extended period of potential violations if their interpretation is different than the Audit Teams.  PG&E, as an active observer to the CIP Standard Drafting Team (SDT) meetings covering this modification, understands the difficulty in trying to create an unambiguous way to indicate when new BCS need to be covered by the CIP Requirements.  PG&E’s suggested correction for this condition is the creation of guidance, with examples of what would be considered “capable of impacting” for the different “asset” types in CIP-002. PG&E is willing to be part of the effort in drafting the guidance.

Michael Johnson, On Behalf of: Marco Rios, Pacific Gas and Electric Company, 1,3,5

- 0 - 0

Teresa Cantwell, Lower Colorado River Authority, 5, 7/17/2019

- 0 - 0

Trey Melcher, 7/17/2019

- 0 - 0

David Jendras, Ameren - Ameren Services, 3, 7/17/2019

- 0 - 0

Minnesota Power supports EEI's comments.

Jamie Monette, Allete - Minnesota Power, Inc., 1, 7/17/2019

- 0 - 0

LaTroy Brumfield, American Transmission Company, LLC, 1, 7/17/2019

- 0 - 0

Southern Company would like specific clarification within the Standard text in section 5, “Effective Dates”.  Southern asserts that the following text:

“By that time, the Responsible Entity must apply all Reliability Standard requirements applicable to its new categorization to the new BES Cyber System.”,

should be changed to

“By that time, the Responsible Entity must apply all CIP Reliability Standard requirements applicable to its new categorization to the new BES Cyber System.”

to provide this additional clarity. 

We would also like the SDT to consider modifications to the language “capable of impacting the BES”.  There are many aspects to commissioning assets that are complex and it is often such that it cannot be represented by a single date, but rather a series of steps across a period of time.  The integration of new generation resources – especially Wind and to some extent Solar facilities – involves bringing blocks of generation on-line piecemeal, in many cases under local control with multiple vendors and contractors involved.  During this transition period there are often temporary control measures in place and until the projects have been tested, integrated and transferred to the Control Center(s).  It is the full intent to appropriately secure facilities under development in both physical and cyber aspects. Southern asserts that, at a minimum, the compliance effective date for new generation resources should be on the date it is declared “commercial” under its Interconnection Agreement. 

Alternately, Southern proposes that if compliance must be met “upon commissioning,” then we request that this only apply to medium and high impact BES Cyber Systems and that the language state that the responsible entity shall comply with all applicable CIP requirements “upon commissioning, as identified by the Responsible Entity.”  This modification accommodates the complexity associated with the commissioning process and allows for the additional needed flexibility in commissioning different types of assets containing low impact BES Cyber Systems.

Southern Company, Segment(s) 1, 3, 5, 6, 7/17/2019

- 0 - 0

Please see comments submitted by the Edison Electric Institute

Kenya Streeter, Edison International - Southern California Edison Company, 6, 7/17/2019

- 0 - 0

Hot Answers

Daniela Hammons, CenterPoint Energy Houston Electric, LLC, 1, 7/17/2019

- 0 - 0

“Please see comments submitted by the Edison Electric Institute” 

Ayman Samaan, On Behalf of: Ayman Samaan, , Segments 1, 3, 5, 6

- 0 - 0

Other Answers

Stacy Lee, On Behalf of: City of College Station, , Segments 1

- 0 - 0

Kjersti Drott, Tri-State G and T Association, Inc., 1, 6/11/2019

- 0 - 0

Steven Rueckert, Western Electricity Coordinating Council, 10, 6/14/2019

- 0 - 0

Maryanne Darling-Reich, On Behalf of: Black Hills Corporation - MRO, WECC - Segments 1, 3, 5, 6

- 0 - 0

Ginger Mercier, On Behalf of: Prairie Power, Inc. - SERC - Segments 1, 3

- 0 - 0

NO, WE DO NOT ARGEE. Please see Consumers Energy response for question #2.

Jeanne Kurzynowski, On Behalf of: CMS Energy - Consumers Energy Company - RF - Segments 1, 3, 4, 5

- 0 - 0

Leanna Lamatrice, 7/5/2019

- 0 - 0

Public Utility District No. 1 of Chelan County, Segment(s) 3, 1, 5, 6, 11/29/2018

- 0 - 0

Val Ridad, Silicon Valley Power - City of Santa Clara, 3, 7/8/2019

- 0 - 0

Sandra Pacheco, Silicon Valley Power - City of Santa Clara, 5, 7/8/2019

- 0 - 0

DTE Energy - DTE Electric, Segment(s) 5, 4, 3, 2/27/2017

- 0 - 0

None

Aaron Cavanaugh, On Behalf of: Bonneville Power Administration, WECC, Segments 1, 3, 5, 6

- 0 - 0

Neil Swearingen, On Behalf of: Salt River Project, WECC, Segments 1, 3, 5, 6

- 0 - 0

MRO NSRF, Segment(s) 3, 4, 5, 6, 1, 2, 7/19/2017

- 0 - 0

Lana Smith, San Miguel Electric Cooperative, Inc., 5, 7/10/2019

- 0 - 0

Santee Cooper, Segment(s) 1, 3, 5, 6, 7/11/2019

- 0 - 0

Bruce Reimer, Manitoba Hydro , 1, 7/11/2019

- 0 - 0

Thomas Savin, 7/11/2019

- 0 - 0

Tim Womack, Puget Sound Energy, Inc., 3, 7/11/2019

- 0 - 0

Tennessee Valley Authority, Segment(s) 1, 3, 5, 6, 10/18/2018

- 0 - 0

As discussed in our answer to Question 2, arbitrary determinations of Planned and Unplanned Changes must be addressed across the regions.

Additionally, in some cases, where the region determines a planned change raises the impact from Low to Medium or High, the entity may be unable to meet all the requirements related to the new impact level, especially due to technical and resource limitations within the time period.

Larry Snow, On Behalf of: Cogentrix Energy Power Management, LLC, NPCC, SERC, RF, Segments 5

- 0 - 0

Alex Ybarra, 7/12/2019

- 0 - 0

Dominion, Segment(s) 3, 5, 1, 4/6/2017

- 0 - 0

Kevin Salsbury, Berkshire Hathaway - NV Energy, 5, 7/15/2019

- 0 - 0

Roger Fradenburgh, On Behalf of: Nicholas Lauriat, Network and Security Technologies, 1

- 0 - 0

Andy Fuhrman, On Behalf of: Theresa Allard, Minnkota Power Cooperative Inc., 1

- 0 - 0

Tony Skourtas, Los Angeles Department of Water and Power, 3, 7/15/2019

- 0 - 0

Sandra Revnell, On Behalf of: Wolverine Power Supply Cooperative, Inc., , Segments 1

- 0 - 0

Section A.5:

  1. “[T]he categorization of the BES Cyber System shall become effective upon the date the BES Cyber System meets the new impact criteria in Attachment 1, regardless of when the Responsible Entity performs its review of identifications under Requirement R2[.]” This may be misleading in that the only “new” impact criterion in this version is 2.12. RF recommends the wording be changed to, “[T]he categorization of the BES Cyber System shall become effective upon the date the BES Cyber System meets at least one criterion at a higher impact rating in Attachment 1, regardless of when the Responsible Entity performs its review of identifications under Requirement R2[.]”

  2. The language is not clear that it applies to a new asset coming into scope as a BES asset, and therefore will have new low impact BES Cyber Systems (LIBCS). As the Standard does not require identification of LIBCS, but only identification of the assets containing LIBCS, it’s not clear that the language “planned change resulting in a new BES Cyber System” and “planned change resulting in a change in categorization for an existing BES Cyber System” will be effective in capturing new LIBCS. The language should directly address changes resulting in additional identified assets that contain LIBCS coming into scope for CIP-002. There are similar concerns for unplanned changes.

  3. The language regarding initial performance of periodic obligations will result in very long lead times for some Requirements. For example, testing of an incident response plan for new low impact BES Cyber Systems (LIBCS) resulting from an unplanned change would not be required until 5 years after identification of the LIBCS. The initial performance of periodic requirements should be tightened to a more reasonable timeframe in order to reduce risk to the BES.

     

Section E is meant to incorporate the existing Interpretation. There are two problems with this:

  1. The SDT did not fulfill the language of the NERC RoP regarding Interpretations:  “The Interpretation shall stand until such time as the Interpretation can be incorporated into a future revision of the Reliability Standard or the Interpretation is retired due to a future modification of the applicable Requirement.” [Standard Processes Manual, RoP Appendix 3A, Section 7] Since this revision of the Standard is an opportunity where the SDT can incorporate the Interpretation, it is incumbent upon the SDT to do so.

  2. Placing the reference to the Interpretation in a section that is not identified by the Standard Processes Manual Section 2.5 may render the Interpretation unenforceable: “The only mandatory and enforceable components of a Reliability Standard are the: (1) applicability, (2) Requirements, and the (3) effective dates. The additional components are included in the Reliability Standard for informational purposes, to establish the relevant scope and technical paradigm, and to provide guidance to Functional Entities concerning how compliance will be assessed by the Compliance Enforcement Authority.” [Standard Processes Manual, Section 2.5]

Anthony Jablonski, ReliabilityFirst , 10, 7/16/2019

- 0 - 0

Reclamation recommends the categorization of the BES Cyber System become effective upon the date the modified BES Cyber System is capable of impacting the BES. This will allow time for testing and returning existing equipment to service without the need to document compliance of equipment that is not capable of causing an adverse reliability impact.

Richard Jackson, U.S. Bureau of Reclamation, 1, 7/16/2019

- 0 - 0

While AZPS generally agrees with and supports the concepts regarding Planned Changes, it is concerned that the inclusion of the phrase “or with the Responsible Entity’s advance knowledge” in the definition of a Planned Change could be interpreted more broadly than was intended and, therefore, impose an undue burden on Registered Entities. 

More specifically, where a change is occurring that may impact a Responsible Entity’s asset identification, but that is not being planned or performed by that Responsible Entity, the inclusion of the phrase “or with the Responsible Entity’s advance knowledge” assumes that such advance knowledge occurs far enough in advance of commercial operations for the impacted Responsible Entity to identify the impacts and implement compliance measures.  Such notification is not within the control of the impacted Responsible Entity and the implementing party may not fully realize or understand the impacts of its Planned Change on adjacent systems or facilities. 

For these reasons, a Responsible Entity may not have knowledge of such impacts far enough in advance of commercial operations to timely identify the impacts and implement the required compliance measures.  More specifically, if a Responsible Entity received notification from an adjacent system or a project participant that modifications were being made six months prior to the commercial operation of such modification, the Responsible Entity, through no fault of its own, would likely have a reportable non-compliance as it would have “advance knowledge” of the “Planned Change,” but would not have enough time to identify impacts and implement compliance measures.  Thus, in certain circumstances, the revisions to the concept of a Planned Change create an unrealistic or infeasible expectation. The definition of “Unplanned Changes” may be intended to cover this scenario, but the ambiguity of the language defining a “Planned Change” could lead to confusion and/or overlap.   To rectify this, AZPS recommends the following revisions to sentence 1 of footnote 1:

Planned changes are changes to the Bulk Electric System or Cyber Asset(s) that were planned and implemented by the Responsible Entity or where the Responsible Entity received notification of such change from the implementing party at least 24 months prior to commercial operations.

Chinedu Ochonogor, 7/16/2019

- 0 - 0

Propose including "and rely upon to perform reliability tasks."

Tho Tran, On Behalf of: Lee Maurer, Oncor Electric Delivery, 1

- 0 - 0

Nick Batty, On Behalf of: Nick Batty, , Segments 4

- 0 - 0

FirstEnergy, Segment(s) 4, 3, 5, 6, 9/5/2018

- 0 - 0

No if the drafting team feels it is necessary to categorize more than every 15-months they should change that language in the standard.  I don't recall NERC or the SAR requesting/authorizing this action.

Additionally, IRC 2.1 and 2.11 are Impact Rating Criteria based on historical data.  At least every 15-months an entity is to look back at the last 12-months of data and determine the Facilities' impact rating.  If these Planned and Unplanned Change definitions are to go into effect then IRC 2.1 and 2.11 need to be excluded or deleted from the standard.

 

Marty Hostler, Northern California Power Agency, 5, 7/16/2019

- 0 - 0

As discussed in our answer to Question 2, arbitrary determinations of Planned and Unplanned Changes must be addressed across the regions.

Additionally, in some cases, where the region determines a planned change raises the impact from Low to Medium or High, the entity may be unable to meet all the requirements related to the new impact level, especially due to technical and resource limitations within the time period. 

I urge the drafting team to consider the addition of subpart 5 to the definition of Unplanned Change in footnote 2 on Page 4 of the standard:

(5) A change in the classification of a Control Center per application of CIP-002, R1 and/or R2 caused by the purchase of a generating facility that is incorporated for control in that Control Center following its acquisition.

Gerry Adamski, Cogentrix Energy Power Management, LLC, 5, 7/16/2019

- 0 - 0

- 0 - 0

RSC no Dominion annd Con Ed, Segment(s) 10, 2, 4, 5, 7, 3, 1, 0, 6, 7/17/2019

- 0 - 0

Pam Feuerstein, Intermountain REA, 3, 7/17/2019

- 0 - 0

Stephanie Burns, On Behalf of: Michael Moltane, International Transmission Company Holdings Corporation, 1

- 0 - 0

FMPA, Segment(s) , 1/18/2019

- 0 - 0

Larry Heckert, Alliant Energy Corporation Services, Inc., 4, 7/17/2019

- 0 - 0

Larry Watt, Lakeland Electric, 1, 7/17/2019

- 0 - 0

Patricia Boody, Lakeland Electric, 3, 7/17/2019

- 0 - 0

Modifying Attachment 1 – Medium 2.1.2: while it is better to establish an MW value, it should be done across all High, Medium and Low. If MW value is going to be the risk bar, then let them revise Attachment 1 and simplify it.

sean erickson, Western Area Power Administration, 1, 7/17/2019

- 0 - 0

Jesus Sammy Alcaraz, On Behalf of: Imperial Irrigation District, , Segments 1, 3, 5, 6

- 0 - 0

Transmission Line Impact Criteria should be based on the Short Circuit MVA (6,000 MVA or greater) , and not on arbitrary weighting factors.

Spencer Tacke, Modesto Irrigation District, 4, 7/17/2019

- 0 - 0

EEI member companies generally support this change.

Mark Gray, On Behalf of: Edison Electric Institute, NA - Not Applicable, Segments NA - Not Applicable

- 0 - 0

Rachel Coyne, Texas Reliability Entity, Inc., 10, 7/17/2019

- 0 - 0

Becky Webb, Exelon, 6, 7/17/2019

- 0 - 0

Eric Smith, 7/17/2019

- 0 - 0

Not consistent with CIP-002 R2.1:

We do not agree with the proposed modifications for Planned Changes resulting in a new BES Cyber System.  BES Cyber Systems do not receive an impact rating except through performance of the process required in CIP-002 R1.  CIP-002 itself recognizes that BES Cyber Systems only receive a rating upon the application of this process by specifically requiring that the identifications resulting from this process be reviewed and updated at least once every 15 calendar months (CIP-002 R2.1).  If the application of CIP-002 R1 is in fact a continuous obligation, then there is no basis for CIP-002 R2, Part 2.1 to exist. 

No Rationale for Modifications to Planned Changes:

Further, the SDT has provided no rationale for the modifications related to planned and unplanned changes.  No Rationale Document has been developed and the summary in this informal comment form barely mentions this change even though it has a rippling impact across the entire suite of CIP standards.

Contradiction to V5 Implementation Plan:

The SDT appears to have taken it upon themselves to change the basis by which the CIP requirements become effective that was established in the CIPv5 implementation plan and existed prior to that in the Implementation Plan for Newly Identified Critical Cyber Assets and Newly Registered Entities (IPFNICCAANRE).  In the IPFNICCAANRE, planned changes were classified as a category 3 scenario and specified to be “Compliant upon Commissioning.”  Under the basis of version 3 where there were a limited number of Critical Assets and the standards themselves were specifically asset based, this approach was feasible.  Additionally, version 3 of CIP-002 contained an obligation to update the CIP-002 list of Critical Cyber Assets “as needed.”  Notably this obligation was removed in version 5.  The version 5 Implementation Plan specifically says that “Planned changes refer to any changes of the electric system or BES Cyber System as identified through the annual assessment under CIP-002-5, Requirement R2, which were planned and implemented by the responsible entity.”  The v5 implementation plan goes on to say that if a “modernization activity” is performed where Cyber Assets are installed that meet the criteria in CIP-002-5 Attachment 1, then the new Cyber Assets must be in compliance “upon the commissioning of the modernized transmission substation.”  Notably in this scenario in order for the changes to have been identified under CIP-002 during the annual assessment, the transmission facility must have existed and had existing Cyber Assets at the time of the annual assessment.  This example is no different than the execution of a recovery plan at an existing transmission substation.  One would not argue that since a BES Cyber System failed and needed to be replaced that the replacement BES Cyber System would not need to be in compliance until the next application of CIP-002.  However, in the event that a facility or a BES Cyber System did not exist at the time of the annual CIP-002 assessment, then the cyber system has no assigned impact categorization and cannot be obligated to meet the suite of CIP requirements.  Specifically, the v5 Implementation Plan goes on to state “For planned changes resulting in a higher categorization, the responsible entity shall comply with all applicable requirements in the Version 5 CIP Cyber Security Standards on the update of the identification and categorization of the affected BES Cyber System…”  The SDT has provided no basis for changing this established expectation in its newly modified Effective Date “clarifying language.”

New Conflicting Language:

The SDT has introduced new conflicting language into the Effective Date section.  The new language is conflicting as to when the initial performance of periodic requirements needs to be performed.  Specifically, in section 5.1, the language states “By that time, the Responsible Entity must apply all Reliability Standard requirements applicable…”  This specification of “all” does not indicate any exceptions.  Three paragraphs later, the section states “For requirements that contain periodic obligations, initial performance of those new obligations…shall occur within the first period following the date the new BES Cyber System could adversely impact the BES.”  These two statements conflict with each other.  It is apparent that the SDT intended to provide additional time for periodic obligations.  As such, it should not state that “all” requirements must be applied by the date if it intends to provide additional time for requirements with periodic obligations.

Alternative Proposal 1:

We propose that in place of the existing planned changes proposal that the SDT adopt the language as written in the version 5 Implementation Plan:

“For planned changes resulting in a higher categorization, the responsible entity shall comply with all applicable requirements on the update of the identification and categorization of the affected BES Cyber System and any applicable and associated Physical Access Control Systems, Electronic Access Control and Monitoring Systems and Protected Cyber Assets, with additional time to comply for requirements” that contain periodic obligations as provided in the version 5 Implementation Plan.

 Alternative Proposal 2:

If the SDT insists on requiring that compliance be met “upon commissioning,” then we request that this obligation only apply to medium and high impact BES Cyber Systems and that the language state that the responsible entity shall comply with applicable periodic requirements within the first period following the commissioning as identified by the Responsible Entity, and with all other applicable requirements “upon commissioning as identified by the Responsible Entity.”  This modification recognizes the complexity of the commissioning process and allows for flexibility since the commissioning process is not the same for different types of assets or different types of entities.

Andrea Barclay, Georgia System Operations Corporation, 4, 7/17/2019

- 0 - 0

Westar and Kansas City Power & Light Co. support and incorporate by reference Edison Electric Institute's response to Question 3.

Westar-KCPL, Segment(s) 1, 3, 5, 6, 12/18/2018

- 0 - 0

No comment

Leonard Kula, Independent Electricity System Operator, 2, 7/17/2019

- 0 - 0

Neville Bowen, Ocala Utility Services, 3, 7/17/2019

- 0 - 0

ACES Standard Collaborations, Segment(s) 1, 3, 5, 7/17/2019

- 0 - 0

Duke Energy, Segment(s) 1, 5, 6, 3, 7/17/2019

- 0 - 0

Patrick Wells, OGE Energy - Oklahoma Gas and Electric Co., 5, 7/17/2019

- 0 - 0

Constantin Chitescu, Ontario Power Generation Inc., 5, 7/17/2019

- 0 - 0

PG&E believes the text of “meets the new impact criteria in Attachment 1” will lead to interpretation differences between Entities and ERO Audit Teams due to the subjective nature of the text.  Could the “meets the new impact criteria” occur when; a) the change happens on initial installation, b) during testing, c) after testing, or d) when finally placed into production? 

Changes to existing facilities occur months before actual production usage and the subjective nature of “meets the new impact criteria in Attachment 1” could subject an Entity to an extended period of potential violations if their interpretation is different than the Audit Teams.  PG&E, as an active observer to the CIP Standard Drafting Team (SDT) meetings covering this modification, understands the difficulty in trying to create an unambiguous way to indicate when changes to BCS require changes in the application of the CIP Requirements.  PG&E’s suggested correction for this condition is the creation of guidance, with examples on what would be considered “meets the new impact criteria in Attachment 1” for the different “asset” types in CIP-002.  PG&E is willing to be part of the effort in drafting the guidance.

Michael Johnson, On Behalf of: Marco Rios, Pacific Gas and Electric Company, 1,3,5

- 0 - 0

Teresa Cantwell, Lower Colorado River Authority, 5, 7/17/2019

- 0 - 0

Trey Melcher, 7/17/2019

- 0 - 0

David Jendras, Ameren - Ameren Services, 3, 7/17/2019

- 0 - 0

Minnesota Power supports EEI's comments.

Jamie Monette, Allete - Minnesota Power, Inc., 1, 7/17/2019

- 0 - 0

LaTroy Brumfield, American Transmission Company, LLC, 1, 7/17/2019

- 0 - 0

Southern does not agree with the proposed modifications for Planned Changes resulting in a new BES Cyber System.  Until a BCS goes through the evaluation process required by CIP-002 R1, it does not have an impact rating.  As such, if registered entities are to continually assess new assets, there is no real reason to have CIP-002 R2 part 2.1 as these required evaluations should have happened already, negating the need for a cycle.

Southern Company, Segment(s) 1, 3, 5, 6, 7/17/2019

- 0 - 0

Please see comments submitted by the Edison Electric Institute

Kenya Streeter, Edison International - Southern California Edison Company, 6, 7/17/2019

- 0 - 0

Hot Answers

Although 24 months may be a reasonable amount of time for some substation projects either planned or unplanned, others can take more than 24 months due to circumstances beyond control, such as:

    • Scheduling outages,
    • Substation resources already assigned to planned work that cannot be delayed,
    • Vendor issues.

An example is changing an asset that contains Low Impact BES Cyber Systems to an asset containing  Medium Impact BES Cyber Systems with External Routable Connectivity (ERC) at an entity that previously did not have ERC at any substation.  Designing, purchasing, installing, and testing both an Electronic Access Control and Monitoring System (EACMS) and Physical Access Control System (PACS) could easily take 24 months or more.  Also, the number of requirement parts applicable to Medium Impact BES Cyber Systems with ERC is significantly more than  that of those without ERC. The additional work involved with those additional requirements will equate to even more periodic work.    Determining an approach to compliance, developing the new policies and procedures, and training could also take 24 months or more.  The additional work may require hiring new staff.

CenterPoint Energy Houston Electric, LLC recommends adding language to the Effective Dates section that provides a method for which an entity can extend the time needed to complete an unplanned project when it is apparent that the project will take more than 24 months.

Daniela Hammons, CenterPoint Energy Houston Electric, LLC, 1, 7/17/2019

- 0 - 0

“Please see comments submitted by the Edison Electric Institute” 

Ayman Samaan, On Behalf of: Ayman Samaan, , Segments 1, 3, 5, 6

- 0 - 0

Other Answers

Stacy Lee, On Behalf of: City of College Station, , Segments 1

- 0 - 0

Kjersti Drott, Tri-State G and T Association, Inc., 1, 6/11/2019

- 0 - 0

Steven Rueckert, Western Electricity Coordinating Council, 10, 6/14/2019

- 0 - 0

Maryanne Darling-Reich, On Behalf of: Black Hills Corporation - MRO, WECC - Segments 1, 3, 5, 6

- 0 - 0

Yes.  24 months should be adequate in most cases.  

Ginger Mercier, On Behalf of: Prairie Power, Inc. - SERC - Segments 1, 3

- 0 - 0

24 months should provide a Responsible Entity with enough time to implement all Reliability Standard requirements applicable to its new or changed categorization to the new or existing BES Cyber Systems due to unplanned changes.

Jeanne Kurzynowski, On Behalf of: CMS Energy - Consumers Energy Company - RF - Segments 1, 3, 4, 5

- 0 - 0

AEP supports the proposed modification to the unplanned changes section that provides 24 months for the implementation of the requirements.  AEP feels this would provide sufficient time to accomplish all the physical changes necessary to move from compliance for an asset containing low impact BES Cyber Systems to one where all the BES Cyber Systems are instantly categorized as medium.

Leanna Lamatrice, 7/5/2019

- 0 - 0

Public Utility District No. 1 of Chelan County, Segment(s) 3, 1, 5, 6, 11/29/2018

- 0 - 0

Val Ridad, Silicon Valley Power - City of Santa Clara, 3, 7/8/2019

- 0 - 0

Sandra Pacheco, Silicon Valley Power - City of Santa Clara, 5, 7/8/2019

- 0 - 0

DTE Energy - DTE Electric, Segment(s) 5, 4, 3, 2/27/2017

- 0 - 0

None

Aaron Cavanaugh, On Behalf of: Bonneville Power Administration, WECC, Segments 1, 3, 5, 6

- 0 - 0

Neil Swearingen, On Behalf of: Salt River Project, WECC, Segments 1, 3, 5, 6

- 0 - 0

Example: The compliance obligations for a Medium Impact Control Center are substantial and greatly exceed the Low Impact requirements. One can easily envision a GO repowering wind turbines and pushing a TOP’s Control Center over 1500 MW (Criteria 2.11 and 2.13). Assuming each is a different Responsible Entity, the TOP will have significant work to do upon notification from the GO of this unplanned change.

MRO NSRF, Segment(s) 3, 4, 5, 6, 1, 2, 7/19/2017

- 0 - 0

Lana Smith, San Miguel Electric Cooperative, Inc., 5, 7/10/2019

- 0 - 0

The proposed implementation timeline for a large facility such as a generator moving from a Low to Medium Impact could take substantially more time than 24 calendar months.  Recommend increasing the timeline to 36 calendar months.  Suggest the SDT tie the implementation timeline to the size of the asset or number of Cyber Systems associated with the asset.  This is probably not a “one size fits all”.

Santee Cooper, Segment(s) 1, 3, 5, 6, 7/11/2019

- 0 - 0

Bruce Reimer, Manitoba Hydro , 1, 7/11/2019

- 0 - 0

Thomas Savin, 7/11/2019

- 0 - 0

Tim Womack, Puget Sound Energy, Inc., 3, 7/11/2019

- 0 - 0

Tennessee Valley Authority, Segment(s) 1, 3, 5, 6, 10/18/2018

- 0 - 0

Larry Snow, On Behalf of: Cogentrix Energy Power Management, LLC, NPCC, SERC, RF, Segments 5

- 0 - 0

Alex Ybarra, 7/12/2019

- 0 - 0

Dominion, Segment(s) 3, 5, 1, 4/6/2017

- 0 - 0

Kevin Salsbury, Berkshire Hathaway - NV Energy, 5, 7/15/2019

- 0 - 0

Roger Fradenburgh, On Behalf of: Nicholas Lauriat, Network and Security Technologies, 1

- 0 - 0

Please refer to comments from the MRO NERC Standards Review Forum (NSRF).

Andy Fuhrman, On Behalf of: Theresa Allard, Minnkota Power Cooperative Inc., 1

- 0 - 0

Tony Skourtas, Los Angeles Department of Water and Power, 3, 7/15/2019

- 0 - 0

Sandra Revnell, On Behalf of: Wolverine Power Supply Cooperative, Inc., , Segments 1

- 0 - 0

The proposed timeframe is not in line with prior practice. 12 months has been prior practice. RF is not aware of any entity having difficulty with this timeframe.

Anthony Jablonski, ReliabilityFirst , 10, 7/16/2019

- 0 - 0

The 24-month timeframe is appropriate because it is commensurate with the initial implementation plan of CIP-002-5.1a. The 24-month timeframe allows sufficient time for entities to implement compliance measures for changes that the entity did not originally have scoped for compliance (e.g., budget cycles, procurement timeframes, and documentation).

Richard Jackson, U.S. Bureau of Reclamation, 1, 7/16/2019

- 0 - 0

Chinedu Ochonogor, 7/16/2019

- 0 - 0

Tho Tran, On Behalf of: Lee Maurer, Oncor Electric Delivery, 1

- 0 - 0

Nick Batty, On Behalf of: Nick Batty, , Segments 4

- 0 - 0

FirstEnergy, Segment(s) 4, 3, 5, 6, 9/5/2018

- 0 - 0

No however I am willing to agree that all changes, regardless if Planned or Unplanned, should be treated equally.  If Unplanned changes allow an entity two years to become compliant then NERC should not descriminate against those that have Planned changes.  Both should be allowed two years to become compliant.  Fairness!

 

 

Marty Hostler, Northern California Power Agency, 5, 7/16/2019

- 0 - 0

The entity has no prior expectation for implementing either Medium or High Impact requirements prior to the notification from the Planning Coordinator or Transmission Planner or Reliability Coordinator, etc. or that a parent organization has purchased a generating facility that is now being placed under your control in an existing Control Center.  In this regard, it is unrealistic for the entity to coordinate and implement an effective and robust CIP program in a rushed manner.  Furthermore, cyber assets need to be specified, ordered, configured, and installed, training programs developed after a full suite of procedures are drafted, and above all, a secure network infrastructure created to protect the most important cyber assets.  These activities presume funding is made available for an unbudgeted project in the current year.  On the whole, a project of this type requires at least a year for a thoughtful specification, budgeting, and implementation.  So the 24 months proposal is entirely adequate.

Gerry Adamski, Cogentrix Energy Power Management, LLC, 5, 7/16/2019

- 0 - 0

Example: The compliance obligations for a Medium Impact Control Center are substantial and greatly exceed the Low Impact requirements. One can easily envision a GO repowering wind turbines and pushing a TOP’s Control Center over 1500 MW (Criteria 2.11 and 2.13). Assuming each is a different Responsible Entity, the TOP will have significant work to do upon notification from the GO of this unplanned change.

- 0 - 0

We agree with 24 months for the implementation of requirements for unplanned changes.  Unplanned changes can have significant impacts and place substantial demands on technical resources, depending upon the scope of the unplanned changes.

RSC no Dominion annd Con Ed, Segment(s) 10, 2, 4, 5, 7, 3, 1, 0, 6, 7/17/2019

- 0 - 0

Pam Feuerstein, Intermountain REA, 3, 7/17/2019

- 0 - 0

ITC concurs with comments submitted by EEI:

"EEI member companies support the SDT’s proposed 24-month implementation period for unplanned changes.  Unplanned changes can have significant impacts on internal company processes and associated capital budgets, which can take as long as 12 months for approval before the funds can be allocated.  We also note that unplanned changes, including recategorizing of control centers from Low Impact to Medium Impact, represent a major effort that places substantial demands on scarce technical resources.  Moreover, a 24-month Implementation period is not without Industry precedent for compliance with substantial changes involving CIP Standards.  In FERC Order 791 (Ref. 145 FERC 61,160; Docket No. RM13-5-000: Version 5 Critical Infrastructure Protection Standards; Issued November 22, 2013) the Industry was afforded a 24-month implementation period to ensure entity compliance was achieved for High and Medium Impact BES Cyber Systems.  While we recognize that the transition to CIP Version 5 was a significant Industry effort, the efforts to transition a control center (worst case) from Low Impact to Medium Impact could represent similar challenges for entities that only have Low Impact BES Cyber Systems."

Stephanie Burns, On Behalf of: Michael Moltane, International Transmission Company Holdings Corporation, 1

- 0 - 0

We agree with the 24 months for implementation but are concerned about potential issues surrounding Attachment 1, Criterion 2.6.  The concern is if a facility has an IROL that only lasts for 18 months, will the entity that owns that facility be required to have Medium Impact controls?  It doesn’t seem to make sense if the IROL is less than, or even just barely more than, the implementation time-period to require Medium Impact controls.  Our suggestion would be to add the following language to Attachment 1, Criterion 2.6: Generation at a single plant location or Transmission Facilities at a single station or substation location that are identified by its Reliability Coordinator, Planning Coordinator, or Transmission Planner as critical to the derivation of Interconnection Reliability Operating Limits (IROLs) and their associated contingencies for a time-period greater than 36 months.”  This helps to avoid a situation where a utility would have the costly requirement to add Medium Impact controls to a facility that has a temporary IROL or an IROL that will be mitigated and not exist after the 24 month implementation period.

FMPA, Segment(s) , 1/18/2019

- 0 - 0

Larry Heckert, Alliant Energy Corporation Services, Inc., 4, 7/17/2019

- 0 - 0

Comments: We agree with the 24 months for implementation but are concerned about potential issues surrounding Attachment 1, Criterion 2.6.  The concern is if a facility has an IROL that only lasts for 18 months, will the entity that owns that facility be required to have Medium Impact controls?  It doesn’t seem to make sense if the IROL is less than, or even just barely more than, the implementation time-period to require Medium Impact controls.  Our suggestion would be to add the following language to Attachment 1, Criterion 2.6: Generation at a single plant location or Transmission Facilities at a single station or substation location that are identified by its Reliability Coordinator, Planning Coordinator, or Transmission Planner as critical to the derivation of Interconnection Reliability Operating Limits (IROLs) and their associated contingencies for a time-period greater than 36 months.”  This helps to avoid a situation where a utility would have the costly requirement to add Medium Impact controls to a facility that has a temporary IROL or an IROL that will be mitigated and not exist after the 24 month implementation period.

Larry Watt, Lakeland Electric, 1, 7/17/2019

- 0 - 0

We support the comments provided by the FMPA:

We agree with the 24 months for implementation but are concerned about potential issues surrounding Attachment 1, Criterion 2.6.  The concern is if a facility has an IROL that only lasts for 18 months, will the entity that owns that facility be required to have Medium Impact controls?  It doesn’t seem to make sense if the IROL is less than, or even just barely more than, the implementation time-period to require Medium Impact controls.  Our suggestion would be to add the following language to Attachment 1, Criterion 2.6: Generation at a single plant location or Transmission Facilities at a single station or substation location that are identified by its Reliability Coordinator, Planning Coordinator, or Transmission Planner as critical to the derivation of Interconnection Reliability Operating Limits (IROLs) and their associated contingencies for a time-period greater than 36 months.”  This helps to avoid a situation where a utility would have the costly requirement to add Medium Impact controls to a facility that has a temporary IROL or an IROL that will be mitigated and not exist after the 24 month implementation period.

Patricia Boody, Lakeland Electric, 3, 7/17/2019

- 0 - 0

sean erickson, Western Area Power Administration, 1, 7/17/2019

- 0 - 0

24 months would not allow for the time necessary to get required budget and implementation required. IID is recommending that 36 months would be a more adequate time to fund and implement necessary requirements.

Jesus Sammy Alcaraz, On Behalf of: Imperial Irrigation District, , Segments 1, 3, 5, 6

- 0 - 0

Spencer Tacke, Modesto Irrigation District, 4, 7/17/2019

- 0 - 0

EEI member companies support the SDT’s proposed 24-month implementation period for unplanned changes.  Unplanned changes can have significant impacts on internal company processes and associated capital budgets, which can take as long as 12 months for approval before the funds can be allocated.  We also note that unplanned changes, including recategorizing of control centers from Low Impact to Medium Impact, represent a major effort that places substantial demands on scarce technical resources.  Moreover, a 24-month Implementation period is not without Industry precedent for compliance with substantial changes involving CIP Standards.  In FERC Order 791 (Ref. 145 FERC 61,160; Docket No. RM13-5-000: Version 5 Critical Infrastructure Protection Standards; Issued November 22, 2013) the Industry was afforded a 24-month implementation period to ensure entity compliance was achieved for High and Medium Impact BES Cyber Systems.  While we recognize that the transition to CIP Version 5 was a significant Industry effort, the efforts to transition a control center (worst case) from Low Impact to Medium Impact could represent similar challenges for entities that only have Low Impact BES Cyber Systems.

Mark Gray, On Behalf of: Edison Electric Institute, NA - Not Applicable, Segments NA - Not Applicable

- 0 - 0

While Texas RE appreciates timeframes around planned and unplanned changes, the language is vague and will cause confusion.  The Implementation Plan and the Effective Date section should work together.  Texas RE recommends using the verbiage from the Implementation Plan rather than the use of the new term “first period” from the Effective Date section.  This appears to be the first time this term has been used in the context of effective dates and with no explanation, there could be confusion as to when and how long the first period is.

 

The Implementation Plan, on the other hand, states: Responsible Entities shall initially comply with the periodic requirements in CIP-002-6, Requirement R2 within 15 calendar months of their performance of Requirement R2 under CIP-002-5.1a.  Texas RE prefers this verbiage than the “first period” term as it is more clear and would be consistent with how Implementation Plans have been written in the past.

Additionally, Texas RE suggests defining planned and unplanned changes to reduce ambiguity and vagueness.  Texas RE recommends that entities have 24 months from the identification of a change.  As written, it is unclear how long in the future a change is known could be considered an unplanned change.  For example, Footnote 2, example 1, points to Criterion 2.3 which states planning horizon of more than a year.  If it is under a year, do entities have 24 months to come into compliance?  If it is over a year, do entities get 24 months from that date to come into compliance?  If unplanned asset is identified as coming after 24 months, it should be treated as planned.  In example 4, entities should know far in advance whether there will be additional load.  How far in advance is considered planned?

Rachel Coyne, Texas Reliability Entity, Inc., 10, 7/17/2019

- 0 - 0

Becky Webb, Exelon, 6, 7/17/2019

- 0 - 0

Eric Smith, 7/17/2019

- 0 - 0

For the reasons outlined in questions 2 and 3, we also do not agree with the 24 months for implementation of unplanned changes.  In particular, we believe that the SDT should adopt the language included in the Version 5 Implementation Plan that states “For unplanned changes resulting in a higher categorization, the responsible entity shall comply with all applicable requirements…according to the following timelines, following the identification and categorization of the affected BES Cyber System.”  This language necessarily recognizes that all timeframes for CIP-002 start with the performance of the annual CIP-002 process.

Andrea Barclay, Georgia System Operations Corporation, 4, 7/17/2019

- 0 - 0

Westar and Kansas City Power & Light Co. support and incorporate by reference Edison Electric Institute's response to Question 4.

Westar-KCPL, Segment(s) 1, 3, 5, 6, 12/18/2018

- 0 - 0

No comment

Leonard Kula, Independent Electricity System Operator, 2, 7/17/2019

- 0 - 0

Neville Bowen, Ocala Utility Services, 3, 7/17/2019

- 0 - 0

ACES Standard Collaborations, Segment(s) 1, 3, 5, 7/17/2019

- 0 - 0

Duke Energy, Segment(s) 1, 5, 6, 3, 7/17/2019

- 0 - 0

Patrick Wells, OGE Energy - Oklahoma Gas and Electric Co., 5, 7/17/2019

- 0 - 0

OPG concurs with the RSC comment.

Constantin Chitescu, Ontario Power Generation Inc., 5, 7/17/2019

- 0 - 0

PG&E believes the 24 month time-frame is sufficient to apply the necessary Requirement changes when the impact rating goes from low to medium, or medium to high.  While PG&E has not experienced changes in impact rating that would elevate a BCS impact rating, our experience on the application of the Requirements for medium and high BCS does not suggest a longer time-frame would be necessary.

Michael Johnson, On Behalf of: Marco Rios, Pacific Gas and Electric Company, 1,3,5

- 0 - 0

Teresa Cantwell, Lower Colorado River Authority, 5, 7/17/2019

- 0 - 0

Trey Melcher, 7/17/2019

- 0 - 0

Ameren agrees with the EEI in response to this question. 

David Jendras, Ameren - Ameren Services, 3, 7/17/2019

- 0 - 0

Minnesota Power supports EEI's comments.

Jamie Monette, Allete - Minnesota Power, Inc., 1, 7/17/2019

- 0 - 0

LaTroy Brumfield, American Transmission Company, LLC, 1, 7/17/2019

- 0 - 0

Southern Company proposes the following modifications:

“For an unplanned change resulting in a new BES Cyber System or a higher categorization for an existing BES Cyber System, the new or changed categorization to the BES Cyber System shall become effective 30 calendar months from the date of notification or detection of the unplanned change. By that time, the Responsible Entity must apply all CIP Reliability Standard requirements applicable to its new or changed categorization to the new or existing BES Cyber System.

 

For unplanned changes resulting in a higher categorization for an existing BES Cyber System, the prior lower categorization shall remain effective until 30 calendar months from the date of notification or detection of the unplanned change.

 

For requirements that contain periodic obligations, initial performance of those new obligations following a planned change shall occur within the first period prescribed in the requirement, either 1) following the date the new BES Cyber System could adversely impact the BES, or 2) the date the existing BES Cyber System meets the new impact criteria in Attachment 1. Initial performance of those new obligations following an unplanned change shall occur within the first period prescribed in the requirement after 30 calendar months from the date of notification or detection of the unplanned change.”

 

Southern believes that “unplanned changes” should be handled equivalently as those in TPL-001-4 R2.7.3 where a situation outside the Planner’s control occurs and an unexpected Corrective Action Plan (CAP) is required.  The TPL standard accepts some risk such as non-consequential load loss until a CAP is in place.  In the case of unplanned changes impacting compliance with the CIP Standards, a CAP or other plan could be developed and used to either proceed with increasing a facility’s BES Cyber System(s) and associated BES Cyber Asset’s impact classification to  Medium Impact and moving to more CIP required controls, or alternatively to implement transmission system modifications (similar to segregating generating plant unit controls) that reduce risk and exposure by maintaining those BES Cyber System impact classifications at the low level. Southern requests the SDT consider and propose language allowing an Entity the flexibility to identify transmission improvements or system changes to remove or reduce the risk and exposure to the BES that accompanies unplanned changes, as well as provide the requisite time to make those improvements or changes that would help retain the associated BES Cyber Systems at a low impact classification rather than an Entity being required to enter into a long term financial and compliance burden if they were to rise from Low Impact to Medium Impact.

 

For example, the financial and compliance burden with having to comply with CIP Standards requirements applicable to Medium Impact BES Cyber Systems is tremendous, and can be compounded for an Entity in the event of unplanned changes that increase the impact classification of BES Cyber Systems. In those instances where an Entity choses to make Transmission system improvements or modifications to keep applicable BES Cyber System in a Low Impact classification, but those improvements or changes will take 32 months to complete, from a risk-based perspective, what benefit or reduction of risk is provided should an entity have to make such a financial and organizational investment to comply with the CIP requirements applicable to Medium Impact BES Cyber Systems for only 2 months?

 

Southern requests the SDT consider that if a CAP or other plan developed as a result of an unplanned change includes steps to increase BES Cyber System impact ratings from Low Impact (or out of scope) to Medium Impact, the implementation time should be 30 months.  This is an infrequent activity, but this time is warranted with the tremendous amount of Transmission work already being planned, and the additional time required to clarify notification/detection, scope of work, obtain budget dollars, schedule design disciplines, procure material, and complete construction for a very rare occurrence.   

 

If a CAP or other plan is developed as a result of an unplanned change and is intended to include a transmission system modification, then more than 30 months may be needed to plan for and make the subsequent Transmission system modifications depending on the scope of the project.  Southern recommends the SDT consider a process be available to Registered Entities to have the flexibility to implement a CAP or other plan that is shared with the ERO and tracked to completion as a mitigating measure for reducing BES exposure and risk by keeping BES Cyber System impact classifications at the Low Impact level.

 

For changes to BES Cyber System impact classifications associated with Control Centers, the compliance obligations for a Control Center containing Low Impact BES Cyber Systems compared to one that now has Medium Impact BES Cyber Systems as a result of an unplanned change are substantially different and greatly exceed the Low Impact requirements. For instance, should a Generation Owner decide to repower wind turbines and push a TOP’s Control Center over 1500 MW, the TOP will have significant work to do upon notification from the GO of this unplanned change. For such an unplanned change, 30 months is warranted in order for the TOP to meet the financial and compliance burdens of having a BES Cyber System(s) with increased impact classifications.

 

In each of the examples above, Southern asserts that the requested 30 months will allow for a more thorough review of all potential solutions. 

 

Southern Company, Segment(s) 1, 3, 5, 6, 7/17/2019

- 0 - 0

Please see comments submitted by the Edison Electric Institute

Kenya Streeter, Edison International - Southern California Edison Company, 6, 7/17/2019

- 0 - 0

Hot Answers

Please see response to Question 4.

Daniela Hammons, CenterPoint Energy Houston Electric, LLC, 1, 7/17/2019

- 0 - 0

“Please see comments submitted by the Edison Electric Institute” 

Ayman Samaan, On Behalf of: Ayman Samaan, , Segments 1, 3, 5, 6

- 0 - 0

Other Answers

Stacy Lee, On Behalf of: City of College Station, , Segments 1

- 0 - 0

Kjersti Drott, Tri-State G and T Association, Inc., 1, 6/11/2019

- 0 - 0

Steven Rueckert, Western Electricity Coordinating Council, 10, 6/14/2019

- 0 - 0

Maryanne Darling-Reich, On Behalf of: Black Hills Corporation - MRO, WECC - Segments 1, 3, 5, 6

- 0 - 0

Ginger Mercier, On Behalf of: Prairie Power, Inc. - SERC - Segments 1, 3

- 0 - 0

To ensure a successful implementation of the revised standard, we recommend that the revised standard become effective the first day of the first calendar quarter that is twenty-four (24) calendar months after the effective date of the applicable governmental authority’s order approving the standard.

Jeanne Kurzynowski, On Behalf of: CMS Energy - Consumers Energy Company - RF - Segments 1, 3, 4, 5

- 0 - 0

Leanna Lamatrice, 7/5/2019

- 0 - 0

Public Utility District No. 1 of Chelan County, Segment(s) 3, 1, 5, 6, 11/29/2018

- 0 - 0

Val Ridad, Silicon Valley Power - City of Santa Clara, 3, 7/8/2019

- 0 - 0

Sandra Pacheco, Silicon Valley Power - City of Santa Clara, 5, 7/8/2019

- 0 - 0

DTE Energy - DTE Electric, Segment(s) 5, 4, 3, 2/27/2017

- 0 - 0

None

Aaron Cavanaugh, On Behalf of: Bonneville Power Administration, WECC, Segments 1, 3, 5, 6

- 0 - 0

Neil Swearingen, On Behalf of: Salt River Project, WECC, Segments 1, 3, 5, 6

- 0 - 0

Medium Impact compliance obligations greatly exceed those for Low Impact, with Control Centers being the most extreme case. The time allotted for meeting these obligations needs to be sufficient, especially for any Responsible Entities not previously required to comply with CIP-004 through CIP-011.

The proposed 24 months is consistent with the implementation plan passed for CIP-003 through CIP-009  version 2 and 3 standards for Responsible Entities in Category 1 that had not previously identified Critical Cyber Assets and thus had no previous exposure to these standards.

Given the addition since then of standards CIP-010, CIP-011, and upcoming CIP-013, and that Responsible Entities will likely have to wait until their next fiscal year to budget for any needed equipment and additional personnel, 36 months may be more appropriate.

MRO NSRF, Segment(s) 3, 4, 5, 6, 1, 2, 7/19/2017

- 0 - 0

Lana Smith, San Miguel Electric Cooperative, Inc., 5, 7/10/2019

- 0 - 0

Either the implementation timeline needs to be increased or the Implementation Plan for the effective date of the standard needs to be increased.

Santee Cooper, Segment(s) 1, 3, 5, 6, 7/11/2019

- 0 - 0

We think completing compliance tasks within 24 months is a reasonable timeframe for the revisions to Criterion 2.12 resulting in a higher impact level categorization of a BES Cyber System (from low impact to medium impact).

Bruce Reimer, Manitoba Hydro , 1, 7/11/2019

- 0 - 0

Thomas Savin, 7/11/2019

- 0 - 0

Tim Womack, Puget Sound Energy, Inc., 3, 7/11/2019

- 0 - 0

Tennessee Valley Authority, Segment(s) 1, 3, 5, 6, 10/18/2018

- 0 - 0

Larry Snow, On Behalf of: Cogentrix Energy Power Management, LLC, NPCC, SERC, RF, Segments 5

- 0 - 0

Alex Ybarra, 7/12/2019

- 0 - 0

Dominion, Segment(s) 3, 5, 1, 4/6/2017

- 0 - 0

Kevin Salsbury, Berkshire Hathaway - NV Energy, 5, 7/15/2019

- 0 - 0

Roger Fradenburgh, On Behalf of: Nicholas Lauriat, Network and Security Technologies, 1

- 0 - 0

Please refer to comments from the MRO NERC Standards Review Forum (NSRF).

Andy Fuhrman, On Behalf of: Theresa Allard, Minnkota Power Cooperative Inc., 1

- 0 - 0

The proposed timeframe aligns with the 15 calendr month cycle in CIP-002-5.1a R2.

Tony Skourtas, Los Angeles Department of Water and Power, 3, 7/15/2019

- 0 - 0

Sandra Revnell, On Behalf of: Wolverine Power Supply Cooperative, Inc., , Segments 1

- 0 - 0

The proposed timeframes are consistent with good business practice and with good security practice.

Anthony Jablonski, ReliabilityFirst , 10, 7/16/2019

- 0 - 0

Reclamation recommends the following changes to the proposed implementation plan:

Initial Performance of Periodic Requirements - Reclamation recommends CIP-002-6 become effective no earlier than 24 months after the applicable governmental entity’s order approving the standard to allow entities flexibility to determine the appropriate implementation.

Reclamation agrees with the Phased-in Implementation Date for CIP-002-6, Requirement R1, Attachment 1 Criterion 2.12. A longer implementation period may be needed if the revisions to Criterion 2.12 result in a higher impact level categorization of a BES Cyber System.

Reclamation agrees that any references to Planned or Unplanned Changes in Implementation Plans for any version of any CIP Reliability Standard (i.e. CIP-002 through CIP-014) shall be retired upon the effective date of Reliability Standard CIP-002-6.

Reclamation agrees that Reliability Standard CIP-002-5.1a shall be retired immediately prior to the effective date of Reliability Standard CIP-002-6 in the particular jurisdiction in which the revised standard is becoming effective.

Richard Jackson, U.S. Bureau of Reclamation, 1, 7/16/2019

- 0 - 0

Chinedu Ochonogor, 7/16/2019

- 0 - 0

Tho Tran, On Behalf of: Lee Maurer, Oncor Electric Delivery, 1

- 0 - 0

Nick Batty, On Behalf of: Nick Batty, , Segments 4

- 0 - 0

FirstEnergy, Segment(s) 4, 3, 5, 6, 9/5/2018

- 0 - 0

No.  I am willing to agree to have Transmission Owners that have been inadvertently categorizated as medium impact allowed to immediately be recategorized to low impact.  Two-years should be the standard implemention time frame for the rest of the industry if their rating is to increase.  Also I thought the STB was suppose to redefine Control Centers, we had alot of discussion but I don't recall seeing any results. 

 

Marty Hostler, Northern California Power Agency, 5, 7/16/2019

- 0 - 0

Please see response to Q4.

Gerry Adamski, Cogentrix Energy Power Management, LLC, 5, 7/16/2019

- 0 - 0

Medium Impact compliance obligations greatly exceed those for Low Impact, with Control Centers being the most extreme case. The time allotted for meeting these obligations needs to be sufficient, especially for any Responsible Entities not previously required to comply with CIP-004 through CIP-011.

     The proposed 24 months is consistent with the implementation plan passed for CIP-003 through CIP-009  version 2 and 3 standards for Responsible Entities in Category 1 that had not previously identified Critical Cyber Assets and thus had no previous exposure to these standards.

     Given the addition since then of standards CIP-010, CIP-011, and upcoming CIP-013, and that Responsible Entities will likely have to wait until their next fiscal year to budget for any needed equipment and additional personnel, 36 months may be more appropriate.

- 0 - 0

We like the Implementation Plan as is.

We agree with 24 months for the implementation of requirements for unplanned changes.  Unplanned changes can have significant impacts and place substantial demands on technical resources, depending upon the scope of the unplanned changes.

RSC no Dominion annd Con Ed, Segment(s) 10, 2, 4, 5, 7, 3, 1, 0, 6, 7/17/2019

- 0 - 0

Pam Feuerstein, Intermountain REA, 3, 7/17/2019

- 0 - 0

ITC concurs with comments submitted by EEI:

"EEI member companies support the timeframes provided within the SDT’s Implementation Plan and believe that the time allocated is necessary due to substantial company efforts necessary for transitioning from a Low Impact to Medium Impact.  A more detailed explanation of why we feel a 24-month implementation period for unplanned changes is necessary is provided in our response to question 4 (above)."

Stephanie Burns, On Behalf of: Michael Moltane, International Transmission Company Holdings Corporation, 1

- 0 - 0

FMPA, Segment(s) , 1/18/2019

- 0 - 0

Given the addition of standards CIP-010, CIP-011, and upcoming CIP-013, and that Responsible Entities will likely have to wait until their next fiscal year to budget for any needed equipment and additional personnel, 36 months may be more appropriate.

Larry Heckert, Alliant Energy Corporation Services, Inc., 4, 7/17/2019

- 0 - 0

Larry Watt, Lakeland Electric, 1, 7/17/2019

- 0 - 0

Patricia Boody, Lakeland Electric, 3, 7/17/2019

- 0 - 0

no comment

sean erickson, Western Area Power Administration, 1, 7/17/2019

- 0 - 0

IID is proposing a 12 month effective date after approval due to budget needs if an impact rating on facility were to change.

Jesus Sammy Alcaraz, On Behalf of: Imperial Irrigation District, , Segments 1, 3, 5, 6

- 0 - 0

Transmission Line Impact Criteria should be based on the Short Circuit MVA (6,000 MVA or greater) , and not on arbitrary weighting factors.

Spencer Tacke, Modesto Irrigation District, 4, 7/17/2019

- 0 - 0

EEI member companies support the timeframes provided within the SDT’s Implementation Plan and believe that the time allocated is necessary due to substantial company efforts necessary for transitioning from a Low Impact to Medium Impact.  A more detailed explanation of why we feel a 24-month implementation period for unplanned changes is necessary is provided in our response to question 4 (above).

Mark Gray, On Behalf of: Edison Electric Institute, NA - Not Applicable, Segments NA - Not Applicable

- 0 - 0

Texas RE has two main concerns with the Implementation Plan as written: planned and unplanned changes, and the retirement of CIP-002-5.1a.  Regarding the first matter, the Implementation Plan has this statement: “Planned or Unplanned Changes  Any references to Planned or Unplanned Changes in Implementation Plans for any version of any CIP Reliability Standard (i.e. CIP-002 through CIP-014) shall be retired upon the effective date of Reliability Standard CIP-002-6.”  Since planned and unplanned changes are mentioned in other Reliability Standards, Texas RE is concerned of the implications of this statement.  For example, CIP-013-1 has planned and unplanned changes referenced with exact timelines: “For planned changes resulting in a higher categorization, the responsible entity shall comply with all applicable requirements in CIP-005-6, CIP-010-3, and CIP-013-1 on the update of the identification and categorization of the affected BES Cyber System.

For unplanned changes resulting in a higher categorization, the responsible entity shall comply with all applicable requirements in CIP-005-6, CIP-010-3, and CIP-013-1 according to a specific timeline, following the identification and categorization of the affected BES Cyber System.  The unplanned timelines for FERC approved CIP-013-1 are different from those proposed in CIP-002-6.  The Implementation Plan for CIP-002-6 should not affect the Implementation Plan for CIP-013-1, since CIP-013-1 is approved by FERC.

Alternatively, the SDT could embark on a project to define planned and unplanned changes in the NERC Glossary as suggested in Texas RE’s comment to #4.  This would include an analysis to determine which standards currently use those terms and how those terms are used. Having a clear definition would reduce the ambiguity and vagueness of those terms.

Second, the Implementation Plan contains the following statement regarding the phased-in Implementation Date for CIP-002-6, Requirement R1, Attachment 1 Criterion 2.12: ”If the revisions to Criterion 2.12 result in a higher impact level categorization of a BES Cyber System (from low impact to medium impact), the Responsible Entity shall not be required to identify that BES Cyber System as medium impact nor apply the requirements throughout the CIP standards applicable to the higher categorization until 24 months after the effective date of CIP-002-6. Until that time, the Responsible Entity shall continue to identify that BES Cyber System under CIP-002-5.1a, Requirement R1, Part 1.3.”  Since CIP-002-5.1a is being proposed to be retired immediately prior to the effective date of CIP-002-6, Texas RE is concerned there may be a gap in that 24 month time period.

Rachel Coyne, Texas Reliability Entity, Inc., 10, 7/17/2019

- 0 - 0

Becky Webb, Exelon, 6, 7/17/2019

- 0 - 0

Eric Smith, 7/17/2019

- 0 - 0

We do not believe that the revisions in CIP-002 can be implemented “immediately” following FERC approval.  In order to demonstrate compliance with CIP-002, responsible entities have been expected to provide evidence of the consideration and application of each and every criterion in Attachment 1 even when they do not change the impact categorization of any BES Cyber Systems.  The modifications to criterion 2.12 are substantial.  Even in the case where the newly modified criteria does not change the categorization of any BES Cyber Systems, time is needed in order to assess the new criterion and apply it against our systems.  Additionally, time is needed to update process documentation.  The Implementation Plan provides a 24 month implementation interval where the modified criterion increases the impact rating of a BES Cyber System.  We recommend that the same length of time be provided to all responsible entities.

Andrea Barclay, Georgia System Operations Corporation, 4, 7/17/2019

- 0 - 0

Westar and Kansas City Power & Light Co. support and incorporate by reference Edison Electric Institute's response to Question 5.

Westar-KCPL, Segment(s) 1, 3, 5, 6, 12/18/2018

- 0 - 0

IESO agrees with the proposed Implementation Plan (a)

Leonard Kula, Independent Electricity System Operator, 2, 7/17/2019

- 0 - 0

Neville Bowen, Ocala Utility Services, 3, 7/17/2019

- 0 - 0

It is an appropriate timeframe to implement.

ACES Standard Collaborations, Segment(s) 1, 3, 5, 7/17/2019

- 0 - 0

Duke Energy, Segment(s) 1, 5, 6, 3, 7/17/2019

- 0 - 0

Patrick Wells, OGE Energy - Oklahoma Gas and Electric Co., 5, 7/17/2019

- 0 - 0

OPG concurs with the RSC comment.

Constantin Chitescu, Ontario Power Generation Inc., 5, 7/17/2019

- 0 - 0

1) The immediate nature of the effective date will allow those Entities with medium impact Transmission Control Centers that in reality should have been designated as low impact, immediate relief, with the ability to appropriately adjust their programs. 

2)  The phased in implementation of 24 months for conditions resulting in a higher impact rating (low to medium) is sufficient based on PG&E experiences. 

3) The inclusion of the “planned” and “unplanned” conditions within CIP-002-6 is a welcomed improvement over the separate document used with the original CIP Version 5 Standards.

Michael Johnson, On Behalf of: Marco Rios, Pacific Gas and Electric Company, 1,3,5

- 0 - 0

Entities should identify the facility according to CIP-002-6 criteria, and not go back to CIP-002-5.1a. Their documentation needs to provide if a higher categorization was determined, along with the date, and if it is planned or unplanned. Otherwise, there is more room for confusion and compliance risks.

Teresa Cantwell, Lower Colorado River Authority, 5, 7/17/2019

- 0 - 0

Trey Melcher, 7/17/2019

- 0 - 0

Ameren agrees with the EEI in response to this question. 

David Jendras, Ameren - Ameren Services, 3, 7/17/2019

- 0 - 0

Minnesota Power supports EEI's comments.

Jamie Monette, Allete - Minnesota Power, Inc., 1, 7/17/2019

- 0 - 0

LaTroy Brumfield, American Transmission Company, LLC, 1, 7/17/2019

- 0 - 0

Southern Company asserts that the 30-month timeframe is needed for a significant change such as a Control Center containing Low Impact BES Cyber Systems being reclassified as having Medium Impact BES Cyber Systems.  Southern requests the SDT propose a 30-month implementation period, rather than 24 months, to align with the following proposed edits:

“…medium impact nor apply the requirements throughout the CIP standards applicable to the higher categorization until 24 months after the effective date of CIP-002-6…”

to

“…medium impact nor apply the requirements throughout the CIP standards applicable to the higher categorization until 30 months after the effective date of CIP-002-6…”.

For entities who only currently have Low Impact Control Centers, maintaining compliance throughout the transition and beyond would require a substantial increase in budget allocation, manpower and planning, all of which take time. 

Southern Company, Segment(s) 1, 3, 5, 6, 7/17/2019

- 0 - 0

Please see comments submitted by the Edison Electric Institute

Kenya Streeter, Edison International - Southern California Edison Company, 6, 7/17/2019

- 0 - 0

Hot Answers

Daniela Hammons, CenterPoint Energy Houston Electric, LLC, 1, 7/17/2019

- 0 - 0

“Please see comments submitted by the Edison Electric Institute” 

Ayman Samaan, On Behalf of: Ayman Samaan, , Segments 1, 3, 5, 6

- 0 - 0

Other Answers

Stacy Lee, On Behalf of: City of College Station, , Segments 1

- 0 - 0

Kjersti Drott, Tri-State G and T Association, Inc., 1, 6/11/2019

- 0 - 0

Although WECC agrees with the proposed modifications to CIP-002-6, some TO entities may wish to move sooner to reclassify their TOCCs as low impact BES Assets under the revised Impact Rating Criterion 2.12. A provision should be made to allow for such early adopters, as WECC recognizes the minimal risk to the reliability and security of the BES by such a reclassification to a lower risk BCS category.     

Steven Rueckert, Western Electricity Coordinating Council, 10, 6/14/2019

- 1 - 0

Maryanne Darling-Reich, On Behalf of: Black Hills Corporation - MRO, WECC - Segments 1, 3, 5, 6

- 0 - 0

PPI agrees with WECC's comment to include a provision to allow for early TO adoption to reclassify TOCCs as low-impact under the revised Impact Rating Criteria 2.12.

Ginger Mercier, On Behalf of: Prairie Power, Inc. - SERC - Segments 1, 3

- 0 - 0

NO, WE DO NOT ARGEE. Please see Consumers Energy response for question #2.

Jeanne Kurzynowski, On Behalf of: CMS Energy - Consumers Energy Company - RF - Segments 1, 3, 4, 5

- 0 - 0

Leanna Lamatrice, 7/5/2019

- 0 - 0

Public Utility District No. 1 of Chelan County, Segment(s) 3, 1, 5, 6, 11/29/2018

- 0 - 0

Val Ridad, Silicon Valley Power - City of Santa Clara, 3, 7/8/2019

- 0 - 0

Sandra Pacheco, Silicon Valley Power - City of Santa Clara, 5, 7/8/2019

- 0 - 0

DTE Energy - DTE Electric, Segment(s) 5, 4, 3, 2/27/2017

- 0 - 0

Aaron Cavanaugh, On Behalf of: Bonneville Power Administration, WECC, Segments 1, 3, 5, 6

- 0 - 0

Neil Swearingen, On Behalf of: Salt River Project, WECC, Segments 1, 3, 5, 6

- 0 - 0

MRO NSRF, Segment(s) 3, 4, 5, 6, 1, 2, 7/19/2017

- 0 - 0

Lana Smith, San Miguel Electric Cooperative, Inc., 5, 7/10/2019

- 0 - 0

Santee Cooper, Segment(s) 1, 3, 5, 6, 7/11/2019

- 0 - 0

Bruce Reimer, Manitoba Hydro , 1, 7/11/2019

- 0 - 0

Thomas Savin, 7/11/2019

- 0 - 0

Tim Womack, Puget Sound Energy, Inc., 3, 7/11/2019

- 0 - 0

See comment on item 2.

Tennessee Valley Authority, Segment(s) 1, 3, 5, 6, 10/18/2018

- 0 - 0

Larry Snow, On Behalf of: Cogentrix Energy Power Management, LLC, NPCC, SERC, RF, Segments 5

- 0 - 0

Alex Ybarra, 7/12/2019

- 0 - 0

The language currently being proposed and commented upon in Q2 above is implemented, it could result in inefficient and expensive changes to the generator commissioning process.

Dominion, Segment(s) 3, 5, 1, 4/6/2017

- 0 - 0

Kevin Salsbury, Berkshire Hathaway - NV Energy, 5, 7/15/2019

- 0 - 0

Roger Fradenburgh, On Behalf of: Nicholas Lauriat, Network and Security Technologies, 1

- 0 - 0

Andy Fuhrman, On Behalf of: Theresa Allard, Minnkota Power Cooperative Inc., 1

- 0 - 0

Tony Skourtas, Los Angeles Department of Water and Power, 3, 7/15/2019

- 0 - 0

Sandra Revnell, On Behalf of: Wolverine Power Supply Cooperative, Inc., , Segments 1

- 0 - 0

Anthony Jablonski, ReliabilityFirst , 10, 7/16/2019

- 0 - 0

Reclamation recommends the simplified Impact Rating Criteria described in the response to Question 1 will provide a more cost-effective manner of categorizing BES Cyber Systems and their associated BES Cyber Assets by reducing the cost of implementing the standard and the overall impact of CIP-002-6 and allowing entities to reduce the time spent “review[ing] the identifications in Requirement R1 and its parts (and update[ing] them if there are changes identified) at least once every 15 calendar months.”

Richard Jackson, U.S. Bureau of Reclamation, 1, 7/16/2019

- 0 - 0

As expressed in AZPS’s response to Question 3 above, AZPS is concerned that the inclusion of the phrase “or with the Responsible Entity’s advance knowledge” in the definition of a Planned Change could be interpreted more broadly than was intended and, therefore, impose an undue burden on Registered Entities.  More specifically, where a change is occurring that may impact a Responsible Entity’s asset identification, but that is not being planned or performed by that Responsible Entity, the inclusion of the phrase “or with the Responsible Entity’s advance knowledge” assumes that such advance knowledge occurs far enough in advance of commercial operations for the impacted Responsible Entity to identify the impacts and implement compliance measures.  Such notification is not within the control of the impacted Responsible Entity and the implementing party may not fully realize or understand the impacts of its Planned Change on adjacent systems or facilities.  For these reasons, a Responsible Entity may not have knowledge of such impacts far enough in advance of commercial operations to implement the required compliance measures in a cost effective manner. 

If AZPS’s recommended revisions for Question 3 above are incorporated into the standard, AZPS would agree that the proposed modifications provide entities with flexibility to meet the reliability objectives in a cost effective manner. 

Chinedu Ochonogor, 7/16/2019

- 0 - 0

Tho Tran, On Behalf of: Lee Maurer, Oncor Electric Delivery, 1

- 0 - 0

Nick Batty, On Behalf of: Nick Batty, , Segments 4

- 0 - 0

FirstEnergy, Segment(s) 4, 3, 5, 6, 9/5/2018

- 0 - 0

No however I am will to agree that all changes regardless if Planned or Unplanned should be treated equally.  I don't believe any of the new Planned and Unplanned Changes language is necessary.   Additionally, I don't believe the proposal is cost effective or neceassary.  An agreement with Transmission Operators should have been negotiated.

Marty Hostler, Northern California Power Agency, 5, 7/16/2019

- 0 - 0

Yes if the definition of Unplanned Changes incorporates the suggested change for including a newly purchased generating facility being added to a Low Impact Control Center, which results in an elevated classification.  See reply to Q2 and Q3.

Gerry Adamski, Cogentrix Energy Power Management, LLC, 5, 7/16/2019

- 0 - 0

- 0 - 0

RSC no Dominion annd Con Ed, Segment(s) 10, 2, 4, 5, 7, 3, 1, 0, 6, 7/17/2019

- 0 - 0

Pam Feuerstein, Intermountain REA, 3, 7/17/2019

- 0 - 0

Stephanie Burns, On Behalf of: Michael Moltane, International Transmission Company Holdings Corporation, 1

- 0 - 0

FMPA, Segment(s) , 1/18/2019

- 0 - 0

Larry Heckert, Alliant Energy Corporation Services, Inc., 4, 7/17/2019

- 0 - 0

Larry Watt, Lakeland Electric, 1, 7/17/2019

- 0 - 0

Patricia Boody, Lakeland Electric, 3, 7/17/2019

- 0 - 0

Minor changes such as these tend to reverberate and translate into more work for entity’s to ingest, coordinate and respond

sean erickson, Western Area Power Administration, 1, 7/17/2019

- 0 - 0

Jesus Sammy Alcaraz, On Behalf of: Imperial Irrigation District, , Segments 1, 3, 5, 6

- 0 - 0

Spencer Tacke, Modesto Irrigation District, 4, 7/17/2019

- 0 - 0

Mark Gray, On Behalf of: Edison Electric Institute, NA - Not Applicable, Segments NA - Not Applicable

- 0 - 0

Texas RE does not have comments on this question.

Rachel Coyne, Texas Reliability Entity, Inc., 10, 7/17/2019

- 0 - 0

Becky Webb, Exelon, 6, 7/17/2019

- 0 - 0

Eric Smith, 7/17/2019

- 0 - 0

No, the proposed modifications substantially increase the cost of compliance over prior versions of the standard as they introduce unjustified and undirected modifications that substantially increase the burden of compliance from an annual obligation to an ongoing real-time obligation.  We propose instead that the SDT adopt the language in the existing approved Version 5 Implementation Plan.

Andrea Barclay, Georgia System Operations Corporation, 4, 7/17/2019

- 0 - 0

Westar and Kansas City Power & Light Co. support and incorporate by reference Edison Electric Institute's response to Question 6.

Westar-KCPL, Segment(s) 1, 3, 5, 6, 12/18/2018

- 0 - 0

Leonard Kula, Independent Electricity System Operator, 2, 7/17/2019

- 0 - 0

Neville Bowen, Ocala Utility Services, 3, 7/17/2019

- 0 - 0

We thank the SDT for allowing us to provide comments on these standards.

ACES Standard Collaborations, Segment(s) 1, 3, 5, 7/17/2019

- 0 - 0

Duke Energy, Segment(s) 1, 5, 6, 3, 7/17/2019

- 0 - 0

Patrick Wells, OGE Energy - Oklahoma Gas and Electric Co., 5, 7/17/2019

- 0 - 0

Constantin Chitescu, Ontario Power Generation Inc., 5, 7/17/2019

- 0 - 0

PG&E believes the modifications do provide sufficient flexibility in meeting the reliability objectives, but as noted in Questions 2 and 3, the subjective nature of “impact to the BES” and “meets the new impact criteria” needs to be addressed before final approval of the modifications. 

In addition to the comments provided in Questions 2 and 3, the use of “adversely impact the BES” and “the date the existing BES Cyber System meets the new impact criteria in Attachment 1” in the last paragraph of Section 5.1 on PDF page 2 have the same condition PG&E has noted for Questions 2 and 3.  The subjective nature of that text, will lead to differences in interpretations exposing an Entity to potential non-compliance.  As suggested in Questions 2 and 3, PG&E believes the creation of guidance, with examples on what would be considered “capable of impacting” which is the same as “adversely impact the BES” and “date the existing BES Cyber System meets the new impact criteria” for the different “asset” types in CIP-002 would help alleviate this condition.  PG&E also reiterates the statements in Questions 2 and 3 that they are willing to help in the drafting of that guidance.

Michael Johnson, On Behalf of: Marco Rios, Pacific Gas and Electric Company, 1,3,5

- 0 - 0

Teresa Cantwell, Lower Colorado River Authority, 5, 7/17/2019

- 0 - 0

Trey Melcher, 7/17/2019

- 0 - 0

Ameren will remain silent on this matter. 

David Jendras, Ameren - Ameren Services, 3, 7/17/2019

- 0 - 0

Minnesota Power will abstain from voting on this issue.

Jamie Monette, Allete - Minnesota Power, Inc., 1, 7/17/2019

- 0 - 0

LaTroy Brumfield, American Transmission Company, LLC, 1, 7/17/2019

- 0 - 0

The proposed modifications to CIP-002 will substantially increase the cost of compliance and represent an undue burden to registered entities as proposed.  They stand to change what is currently a periodic requirement to a real-time requirement. 

Southern Company, Segment(s) 1, 3, 5, 6, 7/17/2019

- 0 - 0

Please see comments submitted by the Edison Electric Institute

Kenya Streeter, Edison International - Southern California Edison Company, 6, 7/17/2019

- 0 - 0