Reliability Standard EOP-004-4

EOP-004-4 – Event Reporting

A. Introduction
1.

Title:

Event Reporting

2.

Number:

EOP-004-4

3.

Purpose: To improve the reliability of the Bulk Electric System by requiring the
reporting of events by Responsible Entities.

4.

Applicability:
4.1. Functional Entities: For the purpose of the Requirements and the EOP-004
Attachment 1 contained herein, the following Functional Entities will be
collectively referred to as “Responsible Entity.”
4.1.1. Reliability Coordinator
4.1.2. Balancing Authority
4.1.3. Transmission Owner
4.1.4. Transmission Operator
4.1.5. Generator Owner
4.1.6. Generator Operator
4.1.7. Distribution Provider

5.

Effective Date: See the Implementation Plan for EOP-004-4.

B. Requirements and Measures
R1.

Each Responsible Entity shall have an event reporting Operating Plan in accordance
with EOP-004-4 Attachment 1 that includes the protocol(s) for reporting to the
Electric Reliability Organization and other organizations (e.g., the Regional Entity,
company personnel, the Responsible Entity’s Reliability Coordinator, law
enforcement, or governmental authority). [Violation Risk Factor: Lower] [Time
Horizon: Operations Planning]

M1. Each Responsible Entity will have a dated event reporting Operating Plan that includes
protocol(s) and each organization identified to receive an event report for event types
specified in EOP-004-4 Attachment 1 and in accordance with the entity responsible for
reporting.
R2.

Each Responsible Entity shall report events specified in EOP-004-4 Attachment 1 to
the entities specified per their event reporting Operating Plan by the later of 24 hours
of recognition of meeting an event type threshold for reporting or by the end of the
Responsible Entity’s next business day (4 p.m. local time will be considered the end of
the business day). [Violation Risk Factor: Medium] [Time Horizon: Operations
Assessment]

Page 1 of 14

EOP-004-4 – Event Reporting

M2. Each Responsible Entity will have as evidence of reporting an event to the entities
specified per their event reporting Operating Plan either a copy of the completed
EOP-004-4 Attachment 2 form or a DOE-OE-417 form; and some evidence of submittal
(e.g., operator log or other operating documentation, voice recording, electronic mail
message, or confirmation of facsimile) demonstrating that the event report was
submitted by the later of 24 hours of recognition of meeting an event type threshold
for reporting or by the end of the Responsible Entity’s next business day (4 p.m. local
time will be considered the end of the business day).

C. Compliance
1.

Compliance Monitoring Process
1.1. Compliance Enforcement Authority:
“Compliance Enforcement Authority” means NERC or the Regional Entity, or any
entity as otherwise designated by an Applicable Governmental Authority, in
their respective roles of monitoring and/or enforcing compliance with
mandatory and enforceable Reliability Standards in their respective
jurisdictions.
1.2. Evidence Retention:
The Responsible Entity shall keep data or evidence to show compliance as
identified below unless directed by its Compliance Enforcement Authority to
retain specific evidence for a longer period of time as part of an investigation:
The following evidence retention periods identify the period of time an entity is
required to retain specific evidence to demonstrate compliance. For instances
where the evidence retention period specified below is shorter than the time
since the last audit, the Compliance Enforcement Authority may ask an entity to
provide other evidence to show that it was compliant for the full time period
since the last audit.
•
•

Each Responsible Entity shall retain the current Operating Plan plus each
version issued since the last audit for Requirement R1, and Measure M1.
Each Responsible Entity shall retain evidence of compliance since the last
audit for Requirement R2 and Measure M2.

If a Responsible Entity is found non-compliant, it shall keep information related
to the non-compliance until mitigation is complete and approved or for the
duration specified above, whichever is longer.
The Compliance Enforcement Authority shall keep the last audit records and all
requested and submitted subsequent audit records.

Page 2 of 14

EOP-004-4 – Event Reporting

1.3. Compliance Monitoring and Enforcement Program
As defined in the NERC Rules of Procedure, “Compliance Monitoring and
Enforcement Program” refers to the identification of the processes that will be
used to evaluate data or information for the purpose of assessing performance
or outcomes with the associated Reliability Standard.

Page 3 of 14

EOP-004-4 – Event Reporting

Violation Severity Levels
R#

R1.

Violation Severity Levels

Lower VSL

Moderate VSL

High VSL

Severe VSL

The Responsible Entity had
an event reporting Operating
Plan, but failed to include
one applicable event type.

The Responsible Entity had
an event reporting Operating
Plan, but failed to include
two applicable event types.

The Responsible Entity had
an event reporting Operating
Plan, but failed to include
three applicable event types.

The Responsible Entity had
an event reporting Operating
Plan, but failed to include
four or more applicable
event types.
OR
The Responsible Entity failed
to have an event reporting
Operating Plan.

R2.

The Responsible Entity
submitted an event report
(e.g., written or verbal) to all
required recipients up to 24
hours after the timing
requirement for submittal.
OR
The Responsible Entity failed
to submit an event report
(e.g., written or verbal) to
one entity identified in its
event reporting Operating
Plan within 24 hours or by
the end of the next business
day, as applicable.

The Responsible Entity
submitted an event report
(e.g., written or verbal) to all
required recipients more
than 24 hours but less than
or equal to 48 hours after
the timing requirement for
submittal.

The Responsible Entity
submitted an event report
(e.g., written or verbal) to all
required recipients more
than 48 hours but less than
or equal to 72 hours after
the timing requirement for
submittal.

OR

OR

The Responsible Entity failed
to submit an event report
(e.g., written or verbal) to
two entities identified in its
event reporting Operating
Plan within 24 hours or by

The Responsible Entity failed
to submit an event report
(e.g., written or verbal) to
three entities identified in its
event reporting Operating
Plan within 24 hours or by

The Responsible Entity
submitted an event report
(e.g., written or verbal) to all
required recipients more
than 72 hours after the
timing requirement for
submittal.
OR
The Responsible Entity failed
to submit an event report
(e.g., written or verbal) to
four or more entities
identified in its event
reporting Operating Plan
within 24 hours or by the

Page 4 of 14

EOP-004-4 – Event Reporting

R#

Violation Severity Levels

Lower VSL

Moderate VSL

High VSL

Severe VSL

the end of the next business
day, as applicable.

the end of the next business
day, as applicable.

end of the next business day,
as applicable.
OR
The Responsible Entity failed
to submit a report for an
event in EOP-004-4
Attachment 1.

D. Regional Variances
None.

E. Associated Documents

Link to the Implementation Plan and other important associated documents.

Page 5 of 14

EOP-004-4 – Event Reporting

EOP-004 - Attachment 1: Reportable Events
NOTE: Under certain adverse conditions (e.g. severe weather, multiple events) it may not be possible to report the damage caused
by an event and issue a written event report within the timing in the standard. In such cases, the affected Responsible Entity shall
notify parties per Requirement R2 and provide as much information as is available at the time of the notification. Submit reports to
the ERO via one of the following: e-mail: [email protected], Facsimile 404-446-9770 or Voice: 404-446-9780, select
Option 1.
Submit EOP-004 Attachment 2 (or DOE-OE-417) pursuant to Requirements R1 and R2.
Rationale for Attachment 1:
System-wide voltage reduction to maintain the continuity of the BES: The TOP is operating the system and is the only entity that
would implement system-wide voltage reduction.
Complete loss of Interpersonal Communication and Alternative Interpersonal Communication capability at a BES control center: To
align EOP-004-4 with COM-001-2.1. COM-001-2.1 defined Interpersonal Communication for the NERC Glossary of Terms as: “Any
medium that allows two or more individuals to interact, consult, or exchange information.” The NERC Glossary of Terms defines
Alternative Interpersonal Communication as: “Any Interpersonal Communication that is able to serve as a substitute for, and does
not utilize the same infrastructure (medium) as, Interpersonal Communication used for day-to-day operation.”
Complete loss of monitoring or control capability at a BES control center: Language revisions to: “Complete loss of monitoring or
control capability at a BES control center for 30 continuous minutes or more” provides clarity to the “Threshold for Reporting” and
better aligns with the ERO Event Analysis Process.

Event Type
Damage or destruction of
a Facility

Entity with Reporting
Responsibility
RC, BA, TOP

Threshold for Reporting
Damage or destruction of a Facility within its Reliability
Coordinator Area, Balancing Authority Area or Transmission
Operator Area that results in action(s) to avoid a BES Emergency.

Page 6 of 14

EOP-004-4 – Event Reporting

Event Type

Entity with Reporting
Responsibility

Threshold for Reporting

Damage or destruction of
its Facility

TO, TOP, GO, GOP, DP

Damage or destruction of its Facility that results from actual or
suspected intentional human action.
It is not necessary to report theft unless it degrades normal
operation of its Facility.

Physical threats to its
Facility

TO, TOP, GO, GOP, DP

Physical threat to its Facility excluding weather or natural disaster
related threats, which has the potential to degrade the normal
operation of the Facility.
OR
Suspicious device or activity at its Facility.

Physical threats to its BES
control center

RC, BA, TOP

Physical threat to its BES control center, excluding weather or
natural disaster related threats, which has the potential to
degrade the normal operation of the control center.
OR
Suspicious device or activity at its BES control center.

Public appeal for load
reduction resulting from a
BES Emergency

BA

Public appeal for load reduction to maintain continuity of the
BES.

System-wide voltage
reduction resulting from a
BES Emergency

TOP

System-wide voltage reduction of 3% or more.

Firm load
sheddingresulting from a
BES Emergency

Initiating RC, BA, or TOP

Firm load shedding ≥ 100 MW (manual or automatic).

Page 7 of 14

EOP-004-4 – Event Reporting

Event Type

Entity with Reporting
Responsibility

Threshold for Reporting

BES Emergency resulting
in voltage deviation on a
Facility

TOP

A voltage deviation of =/> 10% of nominal voltage sustained for ≥
15 continuous minutes.

Uncontrolled loss of firm
load resulting from a BES
Emergency

BA, TOP, DP

Uncontrolled loss of firm load for ≥ 15 minutes from a
single incident:
≥ 300 MW for entities with previous year’s peak
demand ≥ 3,000 MW
OR
≥ 200 MW for all other entities

System separation
(islanding)

RC, BA, TOP

Each separation resulting in an island ≥ 100 MW

Generation loss

BA

Total generation loss, within one minute, of:
≥ 2,000 MW in the Eastern, Western, or Quebec Interconnection
OR
≥ 1,400 MW in the ERCOT Interconnection
Generation loss will be used to report Forced Outages not
weather patterns or fuel supply unavailability for dispersed
power producing resources.

Page 8 of 14

EOP-004-4 – Event Reporting

Event Type

Entity with Reporting
Responsibility

Threshold for Reporting

Complete loss of off-site
power to a nuclear
generating plant (grid
supply)

TO, TOP

Complete loss of off-site power (LOOP) affecting a nuclear
generating station per the Nuclear Plant Interface Requirements

Transmission loss

TOP

Unexpected loss within its area, contrary to design, of three or
more BES Facilities caused by a common disturbance (excluding
successful automatic reclosing).

Unplanned evacuation of
its BES control center

RC, BA, TOP

Unplanned evacuation from its BES control center facility for 30
continuous minutes or more.

Complete loss of
Interpersonal
Communication and
Alternative Interpersonal
Communication capability
at its staffed BES control
center

RC, BA, TOP

Complete loss of Interpersonal Communication and Alternative
Interpersonal Communication capability affecting its staffed BES
control center for 30 continuous minutes or more.

Complete loss of
monitoring or control
capability at its staffed
BES control center

RC, BA, TOP

Complete loss of monitoring or control capability at its staffed
BES control center for 30 continuous minutes or more.

Page 9 of 14

EOP-004-4 – Event Reporting

EOP-004 - Attachment 2: Event Reporting Form
EOP-004 Attachment 2: Event Reporting Form
Use this form to report events. The Electric Reliability Organization will accept the DOE OE-417 form
in lieu of this form if the entity is required to submit an OE-417 report. Submit reports to the ERO via
one of the following: e-mail: [email protected], Facsimile 404-446-9770 or voice: 404-4469780, Option 1. Also submit to other applicable organizations per Requirement R1 “… (e.g., the
Regional Entity, company personnel, the Responsible Entity’s Reliability Coordinator, law
enforcement, or Applicable Governmental Authority).”

Task
1.

2.

3.
4.

Comments

Entity filing the report include:
Company name:
Name of contact person:
Email address of contact person:
Telephone Number:
Submitted by (name):
Date and Time of recognized event.
Date: (mm/dd/yyyy)
Time: (hh:mm)
Time/Zone:
Did the event originate in your system?

Yes 

No

Unknown 

Event Identification and Description:
(Check applicable box)
 Damage or destruction of a Facility
 Physical threat to its Facility

Written description (optional):

 Physical threat to its BES control center
 BES Emergency:
 firm load shedding
 public appeal for load reduction
 System-wide voltage reduction
 voltage deviation on a Facility
 uncontrolled loss of firm load
 System separation (islanding)
 Generation loss
 Complete loss of off-site power to a nuclear
generating plant (grid supply)
 Transmission loss
 Unplanned evacuation of its BES control
center
 Complete loss of Interpersonal
Communication and Alternative Interpersonal
Communication capability at its staffed BES
control center
 Complete loss of monitoring or control
capability at its staffed BES control center

Page 10 of 14

EOP-004-4 – Event Reporting

Version History
Version

Date

2

Action

Merged CIP-001-2a Sabotage
Reporting and EOP-004-1
Disturbance Reporting into EOP004-2 Event Reporting; Retire CIP001-2a Sabotage Reporting and
Retired EOP-004-1 Disturbance
Reporting.

2

November 7,
2012

Adopted by the NERC Board of
Trustees

2

June 20, 2013

FERC approved

3

November 13, Adopted by the NERC Board of
2014
Trustees

3

November 19, FERC Order issued approving EOP2015
004-3. Docket No. RM15-13-000.

4

February 9,
2017

Adopted by the NERC Board of
Trustees

Change Tracking

Revision to entire standard
(Project 2009-01)

Replaced references to
Special protection System
and SPS with Remedial Action
Scheme and RAS

Revised

Page 11 of 14

Supplemental Material

Guideline and Technical Basis
Multiple Reports for a Single Organization
For entities that have multiple registrations, the requirement is that these entities will only
have to submit one report for any individual event. For example, if an entity is registered as a
Reliability Coordinator, Balancing Authority and Transmission Operator, the entity would only
submit one report for a particular event rather submitting three reports as each individual
registered entity.
Law Enforcement Reporting
The reliability objective of EOP-004-4 is to improve the reliability of the Bulk Electric System by
requiring the reporting of events by Responsible Entities. Certain outages, such as those due to
vandalism and terrorism, may not be reasonably preventable. These are the types of events
that should be reported to law enforcement. Entities rely upon law enforcement agencies to
respond to and investigate those events which have the potential to impact a wider area of the
BES. The inclusion of reporting to law enforcement enables and supports reliability principles
such as protection of Bulk Electric System from malicious physical attack. The importance of
BES awareness of the threat around them is essential to the effective operation and planning to
mitigate the potential risk to the BES.
Stakeholders in the Reporting Process
•
•
•
•
•
•
•
•
•
•
•
•

Industry
NERC (ERO), Regional Entity
FERC
DOE
NRC
DHS – Federal
Homeland Security- State
State Regulators
Local Law Enforcement
State or Provincial Law Enforcement
FBI
Royal Canadian Mounted Police (RCMP)

The above stakeholders have an interest in the timely notification, communication and
response to an incident at a Facility. The stakeholders have various levels of accountability and
have a vested interest in the protection and response to ensure the reliability of the BES.

Page 12 of 14

Supplemental Material
Example of Reporting Process including Law
Enforcement
Entity Experiencing An Event in Attachment 1

Report to Law Enforcement ?

Refer to Ops Plan for Reporting

NO

YES

Refer to Ops Plan for communicating
Communicate to
to law enforcement
Law
Enforcement

Report Event to ERO,
Reliability Coordinator

Notification Protocol to
State Agency Law
Enforcement

ERO conducts
investigation

*

State Agency Law
Enforcement coordinates
as appropriate with FBI

ERO
Events Analysis

Criminal act
invoking
federal
jurisdiction ?

ERO Reports Applicable
Events to FERC Per Rules
of Procedure

NO

YES

State Agency Law
Enforcement
Investigates

State Agency Law
Enforcement
notifies FBI
FBI Responds and
makes notification
to DHS

*

Canadian entities will follow law enforcement protocols applicable in
their jurisdictions

Page 13 of 14

Supplemental Material
Potential Uses of Reportable Information
General situational awareness, correlation of data, trend identification, and identification of
potential events of interest for further analysis in the ERO Event Analysis Process are a few
potential uses for the information reported under this standard. The standard requires
Functional Entities to report the incidents and provide information known at the time of the
report. Further data gathering necessary for analysis is provided for under the ERO Event
Analysis Program and the NERC Rules of Procedure. The NERC Rules of Procedure (section 800)
provide an overview of the responsibilities of the ERO in regards to analysis and dissemination
of information for reliability. Jurisdictional agencies (which may include DHS, FBI, NERC, RE,
FERC, Provincial Regulators, and DOE) have other duties and responsibilities.

Page 14 of 14