Search
`
November 15, 2024

FERC Finalizes Cyber Controls on Portable Devices

By Rich Heidorn Jr.

FERC on Thursday approved rules to prevent malware from infecting “low impact” computer systems through transient electronic devices such as laptops and thumb drives (RM17-11, Order 843).

The order approves a requirement outlined in the commission’s October Notice of Proposed Rulemaking directing NERC to modify reliability standard CIP-003-7 to mitigate the risk of malicious code that could result from third-party devices that frequently connect to and disconnect from low-impact systems. (See FERC Seeks Cyber Controls on Portable Devices; Sets GMD Plans.)

The commission reiterated the concerns it raised in the NOPR that the NERC standard “lacks a clear requirement to mitigate the risk of malicious code” that could result from third-party transient devices. “Accordingly, we direct NERC to develop a modification to the reliability standard to provide the needed clarity. Such modification will better ensure that registered entities clearly understand their mitigation obligations and, thus, improve individual entity mitigation plans,” the commission said.

bulk electric system (BES), cybersecurity, North American Elecrtric Reliability Corp. (NERC), Federal Energy Regulatory Commission (FERC), transient devices, RM17-11, FERC Order 843
| © RTO Insider

However, the commission declined to adopt a proposal requiring NERC to “provide clear, objective criteria for electronic access controls” for low-impact systems. NERC tiers its cybersecurity requirements based on classifications of high-, medium- and low-impact Bulk Electric System (BES) cyber systems.

The commission said comments from NERC and others convinced it that the reliability standard already “provides a clear security objective that establishes compliance expectations.”

Instead, FERC ordered NERC to conduct a study within 18 months to assess the implementation of the standard to determine whether the electronic access controls adopted by responsible entities “provide adequate security.” The study was proposed in a joint filing by the American Public Power Association, Edison Electric Institute and National Rural Electric Cooperative Association, identified in the order as “trade associations.”

Reversal

NERC said that the standard requires responsible entities to “document the necessity of its inbound and outbound electronic access permissions and provide justification of the need for such access.”

The trade associations, Electric Consumers Resource Council (ELCON) and Transmission Access Policy Study Group said the proposal would be burdensome and ineffective. While it “appreciates the value establishing more tangible criteria for adequate low-impact BES cyber system controls … the additional requirements that the commission proposes would do nothing to harden a low-impact facility against the rapid evolution in cyber warfare,” ELCON said.

The trade associations urged a risk-based approach to allow responsible entities to focus their resources on assets that have a higher impact on reliability.

“Given NERC’s statements, we believe that there will be adequate measures to assess compliance with reliability standard CIP-003-7,” FERC concluded. “We expect responsible entities to be able to provide a technically sound explanation as to how their electronic access controls meet the security objective.”

Mitigation of Malicious Code

The trade associations and ELCON also opposed the NOPR’s proposal to require responsible entities to prevent malicious code from entering their systems via transient electronic devices used by contractors and other third parties. The trade groups said risk mitigation is implicitly required under Section 5 of the standard.

But FERC said the standard doesn’t go far enough. “While commenters agree that, at least implicitly, the mitigation of malicious code is an obligation, the lack of a clear requirement could lead to confusion in both the development of a compliance plan and in the implementation of a compliance plan,” the commission said. “In addition, although NERC contends that the proposed directive may not be necessary, NERC agrees that modifying reliability standard CIP-003-7 to address the mitigation of malicious code explicitly could clarify compliance obligations.”

FERC said the new standard also will improve reliability by requiring responsible entities to have a policy for declaring and responding to “exceptional circumstances” — defined by NERC as a natural disaster, civil unrest or a situation that threatens to impact BES reliability or presents a risk of injury or death.

FERC Outlines Gas Pipeline Rule Review

By Rich Heidorn Jr.

FERC will open a 60-day comment period on potential changes to its policy statement on the permitting of natural gas pipelines, acknowledging that it may have to reconsider how it balances project benefits against adverse consequences in light of the shale gas revolution, global warming concerns and other changes since it last considered the issue in 1999.

All five commissioners said Thursday they welcomed the Notice of Inquiry (PL18-1), which FERC Chairman Kevin McIntyre had promised at his first meeting in December. (See FERC to Review Gas Pipeline Approval Process.)

But given the increasing contentiousness over pipeline expansions, it’s unlikely the commission will find consensus on all issues on which the NOI seeks comment. (See FERC Whipsawed on Pipeline Policy in House Hearing.)

Flashpoints

The biggest flashpoint may be the debate over how the commission evaluates the greenhouse gas impacts of new pipelines under the Natural Gas Act (NGA) and National Environmental Policy Act (NEPA). The NOI also noted “increased concerns” by landowners and communities affected by proposed projects as the total miles of interstate pipelines approved by the commission annually hit a peak of 2,739 miles last year.

Another point of contention could be calls for speedier pipeline approvals. The NOI says the commission “is committed to carrying out” President Trump’s executive order 13807, which calls for completion of all federal environmental reviews and permitting processes for infrastructure projects within two years.

FERC natural gas pipelines
| National Fuel Gas Co.

“The commission’s aim in this proceeding is the same as in the policy statement: ‘to appropriately consider the enhancement of competitive transportation alternatives, the possibility of over building, the avoidance of unnecessary disruption of the environment and the unneeded exercise of eminent domain,’” FERC said.

McIntyre said the commission’s issuance of the NOI does not mean FERC will ultimately change its current procedures. He said it will apply the current rules to pending applications on a case-by-case basis during the inquiry. “The commission will consider only generic issues and will not consider any comments that refer to open, contested commission proceedings,” the NOI warned.

1999 Policy Statement

The 1999 policy statement followed moves to reduce regulation and increase competition in the industry under the Natural Gas Policy Act of 1978 and FERC Order 436, which allowed local distribution companies and industrial customers to buy gas directly from producers or merchants and transport their gas on interstate pipelines.

The policy statement said the commission will consider whether a proposed project’s anticipated public benefits outweigh its adverse effects on economic interests. If so, the commission then analyzes the project’s environmental impacts in reaching a conclusion on whether a project is required by the public convenience and necessity.

Four Topics of Inquiry

The commission asked for comments on four topics:

  • The reliance on precedent agreements to demonstrate project need, and how contracts with pipeline affiliates should be treated (e.g., “Should the commission examine whether the proposed project meets market demand, enhances resilience or reliability, promotes competition among natural gas companies, or enhances the functioning of gas markets?”);
  • Landowner interests and the use of eminent domain (e.g., “Should applicants take additional measures to minimize the use of eminent domain?”);
  • The evaluation of alternatives and environmental effects under NEPA and the NGA (e.g., “Are there any environmental impacts that the commission does not currently consider in its cumulative impact analysis that could be captured with a broader regional evaluation?”); and
  • The efficiency and effectiveness of the commission’s certificate processes (e.g., “Should certain aspects of the commission’s application review process (i.e., pre-filing, post-filing and post-order-issuance) be shortened, performed concurrently with other activities or eliminated to make the overall process more efficient?”).

Comments will be due within 60 days of the publication of the NOI in the Federal Register.

FERC OKs PJM Plan for State Carveouts on EE Resources

By Rory D. Sweeney

FERC on Tuesday approved PJM’s proposed rules for implementing restrictions imposed on energy efficiency resources (EERs) by state or local regulators that are authorized by the commission to restrict their sale in the RTO’s markets (ER18-870).

The commission simultaneously denied rehearing of a related order it issued in December that asserted the commission had “exclusive authority” over the participation of energy efficiency in wholesale markets while preserving a carveout it approved earlier for Kentucky utilities (EL17-75-001).

FERC PJM Energy Efficiency
FERC Headquarters | © RTO Insider

The order was prompted by a June 2017 petition by Advanced Energy Economy for a declaratory order that FERC — and not state or local regulators — has authority over how EERs participate in wholesale markets. FERC sided with AEE in the December order. (See FERC Claims Jurisdiction on EE, OKs Ky. Opt-Out.)

PJM Plan

PJM’s plan creates a verification process to ensure that all EERs offered and cleared in the RTO’s capacity market comply with any restrictions that may be imposed by a relevant electric retail regulatory authority (RERRA). It also helps sellers of EERs that cleared in a prior PJM capacity market auction but are subsequently restricted from participation in the market by a RERRA.

The RTO will post a FERC-authorized notice of a RERRA’s restrictions. Sellers in the capacity market will be required to itemize EERs located within a RERRA’s boundaries and submit the list to PJM, which will distribute lists of EERs to relevant electric distribution companies. The EDCs will be required to proactively affirm compliance with PJM before the EERs can participate.

EERs are different from demand response resources, PJM explained, because they are eligible to participate unless a RERRA restricts them. In contrast, DR is ineligible to participate unless a RERRA affirmatively permits them.

EERs that are made ineligible by RERRA regulations after they’ve cleared an auction may obtain replacement capacity or elect to be relieved of the capacity commitments.

“Such a rule protects sellers of EERs from being assessed deficiency charges or Capacity Performance nonperformance charges,” the commission explained.

Rehearing Denial

Several parties — including FirstEnergy, several public power groups and several Midwestern transmission and distribution utilities — requested rehearing or clarification of the commission’s December ruling on exclusive authority. They alleged that FERC overreached in pre-empting state authority to oversee EERs.

“We find that the commission’s authority to determine which resources are eligible to participate in the wholesale markets is a fundamental component of the regulation of the wholesale markets,” the commission responded, drawing a distinction between state authority to procure renewable energy and FERC’s authority over EERs.

“Our determinations here do not prevent states from regulating retail sales of electricity, even when such regulation incidentally affects areas within the commission’s domain,” the commission said.

However, the commission said it also disagreed with American Municipal Power, the American Public Power Association, National Rural Electric Cooperative Association and Public Power Association of New Jersey “that state and local restrictions on EER participation in wholesale markets is a valid exercise of state and local authority over retail electric service. A provision directly restricting retail customers’ participation in organized wholesale electricity markets, even if contained in the terms of retail service, nonetheless intrudes on the commission’s jurisdiction over the wholesale markets.”

FERC specifically declined to address whether its conclusion is based on the “field pre-emption” or “conflict pre-emption” under the Supremacy Clause of the Constitution.

“Because we conclude that the question of which resources may participate in wholesale markets is fundamental to the regulation thereof, we need not specifically address whether Congress ‘occupied’ the relevant field or whether a state law arrogating that authority to the state merely ‘stands as an obstacle’ to the commission’s responsibilities under the [Federal Power Act],” FERC explained.

FERC Rejects Rehearing on SPP Cost Allocation Reviews

By Tom Kleckner

FERC on Thursday denied a challenge by Sunflower Electric Power and Mid-Kansas Electric to the commission’s 2017 order allowing SPP to change its regional cost allocation review (RCAR) analysis from at least once every three years to once every six years (ER17-2229).

The commission said Sunflower and Mid-Kansas reiterated arguments they made in protesting the original order, when they said problems with the RCAR’s study assumptions, analysis and results made it unreasonable to decrease its frequency. The commission ruled their concerns as being out of scope. (See FERC Approves 6-Year Cycle for SPP RCAR Review.)

In rejecting the request, FERC said SPP’s decision to lengthen the review cycle “is further supported by SPP’s desire to avoid the expense of the RCAR analysis and by the fact that a vast majority of SPP zones have been at or above a 1-to-1 benefit-to-cost ratio.”

SPP RCAR Regional Cost Allocation Review
Current SPP Transmission Pricing Zones I KCP&L

The commission said the companies failed to back up their claim that SPP’s Regional State Committee would be unresponsive to members facing an imbalance in cost allocation, or that they would need to conduct a study to request relief through the revised Tariff. “Parties could use existing data and studies to support a request,” FERC said.

“Further … SPP has in the past taken action to address stakeholder concerns related to cost allocation, and we expect it will respond in a like manner if presented with evidence the allocation has become inequitable,” the commission said. It noted the RTO had said “no individual transmission owners would be required to conduct a study prior to requesting that SPP perform an RCAR analysis.”

FERC also found no merit to Sunflower and Mid-Kansas’ argument that $7.8 billion in current base plan projects and expected increases in transmission investment suggests that the frequency of the RCAR analysis should remain at three years. The commission said that SPP was able to show that, compared to prior periods, “the overall pace of increase of transmission costs within the SPP footprint has slowed.”

Stakeholders approved a task force’s proposal to institute a six-year planning cycle in April 2017. The task force said the change would save SPP manpower and consulting costs. (See “RSC Approves Six-Year Cost Allocation Review,” SPP Regional State Committee Briefs.)

SPP RCAR Regional Cost Allocation Review
| MGN Photo

SPP’s cost allocation methodology, the “Highway/Byway” method, assigns 100% of all 300-kV+ transmission upgrades to zones on a regional basis.

The most recent regional cost review (RCAR II), released in July 2016, showed an overall 2.46:1 benefit-cost ratio for projects approved since June 2010 under the Highway/Byway methodology — a big increase from RCAR I, which showed a 1.39:1 ratio. Only one transmission zone was below the 0.80 threshold established by the Regional Allocation Review Task Force.

SPP said it took about 2,100 employee hours and more than $417,000 in payments to consultants to complete that review. The two RCARs have cost more than $1.5 million in consulting fees, and each study has taken at least six months to complete, according to the RTO.

Settlement on Abandoned East Coast Tx Line Wins FERC OK

By Amanda Durish Cook

FERC has approved a settlement between PJM, Exelon and the Illinois Commerce Commission over abandonment costs for the canceled Mid-Atlantic Power Pathway (MAPP) transmission project.

Under the uncontested settlement accepted by FERC on Thursday, Exelon subsidiary Baltimore Gas and Electric’s pricing zone will bear more costs of the project while the Commonwealth Edison zone’s responsibility will not exceed $75,000 — less than half of the costs it was originally assigned. FERC said PJM must disburse refunds if the ComEd zone has already paid more than $75,000 (ER17-1016-001).

FERC CC TXU Corp. natural gas pipelines
| Pepco Holdings Inc.

Proposed more than a decade ago, the $1.05 billion, 500-kV MAPP project would have extended about 230 miles from northeastern Virginia through southern Maryland and Delaware, crossing beneath the Chesapeake Bay and Choptank River to southwestern New Jersey.

In 2009, PJM assigned BGE two baseline upgrades for the project, but the RTO’s Board of Managers canceled the project in 2012, saying it was no longer needed to maintain reliability. The line was originally included in PJM’s 2007 Regional Transmission Expansion Plan.

Early last year, PJM submitted Tariff revisions on BGE’s behalf so the utility could recover about $1.2 million in abandoned plant costs.

The ICC protested, arguing that ComEd should not have to bear the costs of a canceled line that never stood to benefit its Midwestern territory. ComEd’s zone stood to incur 13.43% of the cost of BGE’s upgrades under PJM’s postage stamp cost allocation methodology.

“Given that MAPP is a canceled project, the ComEd zone does not derive any benefits from the MAPP project. … The load in the ComEd zone did not contribute to the reliability factors that caused PJM to add the MAPP project to the RTEP in the first place. The beneficiaries and cost causers of the MAPP project are located on the East Coast and that is where the commission should allocate the costs,” the ICC wrote.

The ICC also pointed to rulings by the 7th U.S. Circuit Court of Appeals, which twice remanded FERC’s approval of PJM’s regionwide postage stamp cost allocation for new 500-kV+ transmission projects (See Despite Lengthy Negotiations, PJM Cost Allocation Settlement Still Finds Detractors.) The 7th Circuit said that PJM’s high-voltage lines are “all located in PJM’s eastern region, primarily benefit that region and should not be allowed to shift a grossly disproportionate share of their costs to western utilities on which the eastern projects will confer only future, speculative and limited benefits.”

FERC OKs MISO TMEP Cost Recovery Schedule

By Amanda Durish Cook

FERC on Tuesday approved MISO’s proposed cost recovery schedules for its new category of smaller interregional transmission projects with PJM. The commission did not order any changes (ER18-867).

The commission said the tariff schedules for MISO and its transmission owners for recovery of costs on targeted market efficiency projects (TMEPs) is effective April 18.

FERC said the schedules “help to ensure that the transmission owners that construct TMEPs, whether located in MISO or PJM, will have the opportunity to recover the costs of doing so.”

The approved schedules assign MISO’s share of the project costs to all transmission pricing zones that receive a congestion contribution benefit from the project of at least $5,000 or 1% of the total share per zone. Any zones that don’t meet the $5,000/1% threshold would have their costs reallocated to the remaining zones that do. FERC approved MISO’s TMEP cost allocation methodology in October.

TMEPs are small interregional transmission projects meant to address historical congestion along MISO and PJM’s seams.

The RTOs’ boards approved the first TMEP portfolio last year, consisting of five congestion-relieving upgrades in Illinois, Indiana, Michigan and Ohio. The projects, which have individual $20 million cost caps, will coincidentally cost $20 million combined. On average, the projects’ costs will be allocated 69% to PJM and 31% to MISO based on projected benefits, which are expected to reach $100 million.

TMEP cost allocation
| © RTO Insider

Regulators from MISO South challenged the recovery schedules, as they similarly challenged MISO’s regional cost allocation plan. The Arkansas, Louisiana, Mississippi and Texas public service commissions, and the New Orleans City Council, asked FERC to require MISO clarify that the TMEP schedules do not apply to South. They also wanted a commitment that MISO will create a new TMEP cost allocation methodology before the December expiration of the five-year transition period that limits cost-sharing in South.

FERC said the regulators’ requests were beyond the scope of the proceeding. The commission said last month in a separate docket that MISO has already committed to filing a new regional cost-sharing method for its share of TMEP costs after the transition period. (See Rehearing Denied on MISO South Cost Allocation.)

The Mississippi PSC had also argued for a four-year limit on TMEP cost recovery; FERC declined to order such a provision.

New TMEPs in 2019?

At an April 18 MISO Planning Advisory Committee meeting, Eric Thoms, manager of interregional planning and coordination, said MISO and PJM are evaluating the need for a new TMEP study this year.

Thoms said that MISO is leaning in favor of a study, as the RTOs have experienced about $500 million in congestion payments on more than 200 market-to-market flowgates from 2016 to 2017.

“All indications are at this point that it would be prudent to proceed with a TMEP study this year,” Thoms said.

By May, the RTOs will also make an announcement on whether they will begin a traditional two-year coordinated system plan study to identify more expensive seams projects. The RTOs have yet to approve a major seams transmission project under their interregional market efficiency project category.

MISO Rebuts NERC Findings on Gas Risks

By Amanda Durish Cook

MISO on Wednesday challenged a 2017 NERC assessment that found two areas in the RTO would “experience transmission challenges during an extreme event” involving a disruption of natural gas delivery.

Late last year, NERC released the results of an assessment that studied 24 “geographic clusters” that contain more than 2,000 MW of gas-fired generation and said 18 of them “demonstrated the need for additional follow-up and analysis, based on power flow and stability issues” of the “extreme cases” it ran. (See NERC: Natural Gas Dependence Alters Reliability Planning.)

MISO NERC natural gas
| NERC

“Most of the risks were on the East Coast or in the Southwest, but there were two in MISO,” Senior Policy Studies Engineer Jordan Bakke said, referring to an area on the Missouri-Illinois border and the Amite South load pocket in southeast Louisiana.

MISO told the April 18 Planning Advisory Committee meeting that those two areas have access to alternative fuel sources and are not at risk of N-1 contingencies.

“We think the method employed in this study was not the most optimal. … These risks that were found are not necessarily reasonable in MISO,” Bakke said. “MISO has assessed the two regions and found that they were not single-source … issues, and do not account for a generator’s ability to procure fuel from an alternate pipeline connection.”

Bakke said MISO, which has discussed the study results with NERC, will proceed with its own usual natural gas analyses, though it plans to add a feature to verify that dual-fuel units can access their second source of fuel. By November, MISO also plans to release results of an in-progress study on the impact that large gas pipeline contingencies may have on its system. (See “Sign-of-the-Times Studies,” MISO in 2018: Storage, Software, Settlements and Studies.)

MISO said it has been studying natural gas disruptions as part of its reliability planning since 2015 and currently uses 31 gas contingencies to evaluate “transmission needs and system risk.” MISO has repeatedly reported that only one planning scenario — the long-term loss of the largest natural gas pipeline for the entire summer peak season —would “slightly” elevate a regional loss-of-load risk.

Minnesota Public Utilities Commissioner Matt Schuerger asked if NERC’s assessment or MISO analyses had any merit when considering the natural gas generation outages during the extreme cold that hit the RTO in January. MISO staff said virtually all the gas generation outages involved generators with interruptible transportation, and little of the generation experiencing outages had back-up fuel plans.

UPDATED: NY Task Force Briefed on Carbon Charge Mechanics

By Michael Kuser

NYISO on Monday presented two options for pricing carbon emissions in the ISO’s wholesale market, saying the approach the ISO favors would not require changes to its commitment/dispatch software or the frequency of settlements.

“The cost of carbon will be known ahead of time, will be known to market participants,” said ISO staffer Nathaniel Gilbraith, who delivered the report to the Integrating Public Policy Task Force (IPPTF), which is jointly run by NYISO and the state’s Department of Public Service. The April 16 discussion was part of issue “Track 2” in the group’s five-track effort to price carbon emissions.

The ISO’s preferred approach would have suppliers embed the carbon charges into their all-in day-ahead and real-time energy offers, as they currently do with emissions costs under the Regional Greenhouse Gas Initiative.

Under the second approach, suppliers would submit emissions information for each segment of energy offers (start-up, no-load and incremental energy in dollars per megawatt-hour) with the ISO incorporating the information to calculate a carbon shadow price. It would require software changes. [Editor’s Note: An earlier version of this article incorrectly stated that neither approach would require software changes.]

Under both options, the ISO would dispatch units as it currently does to minimize production costs subject to system constraints. In either case, carbon charges might also need to be trued up, Gilbraith said.

The carbon price for generators subject to RGGI would be the social cost of carbon determined by the New York Public Service Commission minus the RGGI price. Generators not subject to RGGI, such as fossil fuel plants of less than 25 MW, would pay the full social cost.

The ISO could estimate emissions for the generators but would prefer to let suppliers self-report, said IPPTF co-chair Nicole Bouchez, NYISO principal economist. “We thought it made sense to have the companies who have the best information about their plants to do all that math instead of the ISO having to do, by necessity, approximations of it,” she said.

Another complexity is that emissions vary based on a plant’s heat rate, fuel type and where in the output range they are, she said.

“In order to really know the carbon output, you need to know the exact heat rate as well as the fuel that’s being used at that moment and what the carbon content of the fuel is,” Bouchez said. “Then there’s the question of start-up and no-load carbon emissions as well.”

Bouchez walked stakeholders through the ISO’s current bid and settlement process and how it might change under a carbon pricing regime.

Besides the current day-ahead and real-time market settlements, ““the carbon charge would introduce an additional generator settlement line item, which is based on the actual emissions that day times the applicable price in dollars per ton,” Bouchez said. “[This] gives the dollar carbon charges that would be charged to that generator, and that is based on the actual physical output of the plant.”

Loads would continue to pay the applicable locational-based marginal price (LBMP) for energy withdrawals. The process would also create a carbon charge “residual,” a dollar amount to be paid to load-serving entities to minimize the increase in retail electricity prices. The allocation of residuals will be discussed at a future task force meeting.

Price Transparency

Couch White attorney Michael Mager, who represents a coalition of large industrial, commercial and institutional energy customers known as “Multiple Intervenors,” asked what would be included in the market price. “Would the final market price be the LBMP plus carbon adder, minus the amount that’s passed back to load-serving entities? What would be transparent and public for every hour?”

Because many end-use customers have supplier contracts based on the market prices, “I think the customers are going to want to know that any money that’s passed back to LSEs at the wholesale level actually gets passed back to the consumers at the retail level, so I think they’re going to need transparency in terms of that price as well,” Mager said.

“The LBMP is still going to exist as the primary cost of a unit of energy,” Gilbraith said. “Similar to today, there are other associated charges, uplift or whatnot, that are allocated to loads. The joint staff team will be working through in June a proposal on how to allocate the carbon residuals back, and that’s a great issue to bring up in that venue, what data and what is made public through that process and at what level of granularity.”

Real-time Emissions

“These calculations are going to be done separately for day-ahead and real-time, and so all of this charging and reconciliation would be done separately for each market. Is that accurate?” asked Howard Fromer, director of market policy for PSEG Power New York.

NYISO IPPTF carbon
| NYISO

“Day-ahead and real-time LMBPs will continue to exist as they do today, and so they will be developed based on day-ahead and real-time offers,” Gilbraith responded. “However, energy is only physically produced pursuant to a real-time schedule, so the only way a bill [for the carbon charge] will occur is … based upon a real-time schedule. … It’s based on actual, physical electricity production and the emissions associated with that production.”

The task force next meets on April 23 at NYISO headquarters.

FERC Finalizes Cyber Controls on Portable Devices

FERC Finalizes Cyber Controls on Portable Devices

By Rich Heidorn Jr.

FERC on Thursday approved rules to prevent malware from infecting “low impact” computer systems through transient electronic devices such as laptops and thumb drives (RM17-11, Order 843).

The order approves a requirement outlined in the commission’s October Notice of Proposed Rulemaking directing NERC to modify reliability standard CIP-003-7 to mitigate the risk of malicious code that could result from third-party devices that frequently connect to and disconnect from low-impact systems. (See FERC Seeks Cyber Controls on Portable Devices; Sets GMD Plans.)

The commission reiterated the concerns it raised in the NOPR that the NERC standard “lacks a clear requirement to mitigate the risk of malicious code” that could result from third-party transient devices. “Accordingly, we direct NERC to develop a modification to the reliability standard to provide the needed clarity. Such modification will better ensure that registered entities clearly understand their mitigation obligations and, thus, improve individual entity mitigation plans,” the commission said.

However, the commission declined to adopt a proposal requiring NERC to “provide clear, objective criteria for electronic access controls” for low-impact systems. NERC tiers its cybersecurity requirements based on classifications of high-, medium- and low-impact Bulk Electric System (BES) cyber systems.

The commission said comments from NERC and others convinced it that the reliability standard already “provides a clear security objective that establishes compliance expectations.”

Instead, FERC ordered NERC to conduct a study within 18 months to assess the implementation of the standard to determine whether the electronic access controls adopted by responsible entities “provide adequate security.” The study was proposed in a joint filing by the American Public Power Association, Edison Electric Institute and National Rural Electric Cooperative Association, identified in the order as “trade associations.”

Reversal

NERC said that the standard requires responsible entities to “document the necessity of its inbound and outbound electronic access permissions and provide justification of the need for such access.”

The trade associations, Electric Consumers Resource Council (ELCON) and Transmission Access Policy Study Group said the proposal would be burdensome and ineffective. While it “appreciates the value establishing more tangible criteria for adequate low-impact BES cyber system controls … the additional requirements that the commission proposes would do nothing to harden a low-impact facility against the rapid evolution in cyber warfare,” ELCON said.

The trade associations urged a risk-based approach to allow responsible entities to focus their resources on assets that have a higher impact on reliability.

“Given NERC’s statements, we believe that there will be adequate measures to assess compliance with reliability standard CIP-003-7,” FERC concluded. “We expect responsible entities to be able to provide a technically sound explanation as to how their electronic access controls meet the security objective.”

Mitigation of Malicious Code

The trade associations and ELCON also opposed the NOPR’s proposal to require responsible entities to prevent malicious code from entering their systems via transient electronic devices used by contractors and other third parties. The trade groups said risk mitigation is implicitly required under Section 5 of the standard.

But FERC said the standard doesn’t go far enough. “While commenters agree that, at least implicitly, the mitigation of malicious code is an obligation, the lack of a clear requirement could lead to confusion in both the development of a compliance plan and in the implementation of a compliance plan,” the commission said. “In addition, although NERC contends that the proposed directive may not be necessary, NERC agrees that modifying reliability standard CIP-003-7 to address the mitigation of malicious code explicitly could clarify compliance obligations.”

FERC said the new standard also will improve reliability by requiring responsible entities to have a policy for declaring and responding to “exceptional circumstances” — defined by NERC as a natural disaster, civil unrest or a situation that threatens to impact BES reliability or presents a risk of injury or death.

FERC Whipsawed on Pipeline Policy in House Hearing

By Rich Heidorn Jr.

WASHINGTON — Congress will be watching FERC’s review of its policy on licensing natural gas pipelines very closely if the commission’s appearance before the House Energy Subcommittee on Tuesday is any indication.

FERC natural gas pipelines
Congress will be watching FERC’s review of its policy on licensing natural gas pipelines very closely. | © RTO Insider

Any changes FERC makes are unlikely to please all members, however.

At a hearing attended by all five FERC commissioners, both Republican and Democratic representatives complained that the commission has been too willing to approve pipeline projects and insensitive to landowners in their paths. Others, however, said the commission must speed up its approval process.

FERC natural gas pipelines
FERC Commissioners left to right: McIntyre, LaFleur, Chatterjee and Powelson | © RTO Insider

Energy and Commerce Committee Chairman Greg Walden (R-Ore.) said he hopes the commission’s review of its 1999 policy statement on certifying new interstate pipelines, announced in December, will “result in more efficient and timely decisions.” (See FERC to Review Gas Pipeline Approval Process.) FERC Chairman Kevin McIntyre said the commission will outline its plans for the review at Thursday’s open meeting (PL18-1).

Walden cited reports that New England relied on two LNG shipments from Russia to get through the winter, fuming: “While cross-border trade with our neighbors in Canada and Mexico may be a win-win, we should never have to be reliant on the Russians for imports again.”

FERC natural gas pipelines
Pallone (D-N.J.) | © RTO Insider

Speaking next, Rep. Frank Pallone (D-N.J.), the committee’s ranking member, said that he is concerned that ratepayers will be billed for unneeded projects and that landowners have no way to fight them. He called on the commission to conduct regional reviews of pipeline needs rather than evaluating each project individually.

Rep. Leonard Lance (R-N.J.), who is not a member of the subcommittee, attended the hearing nonetheless to tell the commission of his complaints over its approval in January of the PennEast pipeline project in Pennsylvania and New Jersey. The New Jersey attorney general went to court last month to prevent the project developer from condemning more than 20 properties acquired under open-space and farmland preservation programs.

Lance also questioned whether FERC was conducting “robust economic analysis” in using contracts with pipeline affiliates as evidence of a project’s need.

“It’s my considered judgment that this [project] is not in the best interests of the United States and certainly not in the best interests of New Jersey,” Lance said.

FERC natural gas pipelines
Griffith (R-Va.) | © RTO Insider

Rep. Morgan Griffith (R-Va.) said “the frustration level in Virginia is so high” over FERC’s pipeline reviews that he has teamed up with Democratic Sen. Tim Kaine (D-Va.) on legislation he said would increase the transparency of FERC’s licensing process (H.R. 2893, S. 1314). “Tim Kaine and I don’t generally agree,” he noted.

Griffith complained that surveyors for a pipeline appeared unannounced in his district recently and said the commission had rejected his request for additional public hearings to make travel to the sessions less burdensome for his constituents. He suggested putting two or more pipelines into the same corridor to minimize impacts on landowners. “FERC can do a better job,” he said.

LNG Exports

Rep. Pete Olson (R-Texas) said some Gulf Coast LNG projects have fallen behind schedule because of delays in receiving FERC approvals. “I’ve heard rumors that FERC has only six to eight employees [responsible] for approving these … permits. I’ve heard you actually approached the [Department of Energy] for new [employees] to help out with the backlog of approving LNG permits,” he said. “Is that true?”

McIntyre did not answer the LNG staffing question but acknowledged the commission is planning to add staff to the Office of Energy Projects to process LNG and pipeline applications.

“It’s consuming an enormous amount of attention and manpower within the agency,” he said. “If there’s any suggestion that we are somehow not giving it our full effort right now, I can assure you that is not the case at all.”

The pipeline review was just one of the issues the committee addressed during the three-hour hearing, which Walden said was the first with the full commission since 2015. Also discussed were the commission’s grid resilience inquiry, the financial struggles of coal and nuclear generation, the Public Utility Regulatory Policies Act, cybersecurity, and last week’s technical conference on distributed energy resources. (See related story, Ready to Act on DERs, FERC Tells Congress.)