Power & Pipes

In an order issued on April 17, the Federal Energy Regulatory Commission (FERC) agreed to defer implementation of certain cybersecurity and operational reliability standards administered by the North American Electric Reliability Corporation (NERC) that had important compliance milestones later this year, including the suite of supply chain risk management standards that have been under development for several years and were set to take effect on July 1. The move by FERC is intended to provide some measure of relief from impending compliance burdens and to allow electric utilities to focus their resources on responding to the coronavirus (COVID-19) pandemic.

Earlier this month, NERC requested that FERC approve the implementation delays for the standards listed below, citing significant uncertainties regarding the response to and recovery from the COVID-19 pandemic. NERC emphasized that the requested delays would not adversely impact reliability and would allow for utilities to continue dedicating their efforts and resources to maintaining the safety of their workforces and communities and ensuring the reliability of the grid.

Industry participants largely supported NERC’s request. Although the industry has spent months (and, in the case of the supply chain requirements, several years) preparing for the impending compliance deadlines, some entities have been forced to reassign compliance-focused personnel on other more critical day-to-day tasks in response to COVID-19.

FERC agreed with NERC and industry commenters, and approved implementation delays of three to six months for the following reliability standards:

• CIP-005-6/CIP-010-3/CIP-013-1 (the Supply Chain Standards): The Supply Chain Standards will require electric utilities to develop a plan to mitigate supply chain cybersecurity risks posed by vendor products and services, particularly during the vendor procurement process. Although the Supply Chain Standards apply only to utilities, vendor companies supporting supply chains for industrial control system assets and services in critical electric utility environments will need to adapt to the requirements and assist utilities in meeting their new compliance obligations. The Supply Chain Standards were approved in October 2018, but FERC allowed for an 18-month implementation period given the scope of the security objectives in those standards and the likelihood that utilities would need to make significant changes to already lengthy procurement processes. The latest FERC order deferring implementation of the Supply Chain Standards affords utilities three more months to prepare.
• PRC-002-2: The purpose of Reliability Standard PRC-002-2 is to require utilities to maintain adequate data to facilitate analysis of Bulk Electric System (BES) disturbances. The standard’s implementation plan required 50% compliance with several requirements by July 1, but that timeline has now been extended by six months.
• PRC-025-2: Like PRC-002-2, Reliability Standard PRC-025-2 is currently effective with a phased-in implementation plan. The standard requires utilities to set load-responsive relays for generation facilities. The implementation plan required entities to demonstrate compliance for certain categories’ relay settings by July 1, but that deadline has also been extended by six months.
• PRC-027-1/PER-006-1: These standards were developed to replace currently effective Reliability Standard PRC-001-1.1(ii), which requires certain entities to coordinate with respect to their protection systems. PRC-027-1 will enhance some of the existing requirements for protection system coordination, while PER-006-1 will require targeted personnel training on protection system schemes. The October 2020 implementation for these new standards has also been pushed back six months. Currently effective PRC-001-1.1(ii) will not be retired until the new standards take effect.

This table summarizes the changes in compliance deadlines.

The order deferring implementation of these standards is FERC’s latest action in recognition of the need to ease regulatory burdens on regulated entities responding to the pandemic. Earlier this month, Chairman Neil Chatterjee announced that FERC will exercise prosecutorial discretion when addressing events arising during this emergency period.

We expect that regulators will continue to provide the industry with compliance and enforcement flexibility as the emergency progresses. Indeed, NERC has cautioned that circumstances during the pandemic and the subsequent recovery may warrant further reliability standard implementation delays.

Coronavirus COVID-19 Task Force

For our clients, we have formed a multidisciplinary Coronavirus COVID-19 Task Force to help guide you through the broad scope of legal issues brought on by this public health challenge. We also have launched a resource page to help keep you on top of developments as they unfold. If you would like to receive a daily digest of all new updates to the page, please subscribe now to receive our COVID-19 alerts.