RM17-12 Reliability Standard EOP-008-2

EOP-008-2 – Loss of Control Center Functionality

A. Introduction
1.

Title:

Loss of Control Center Functionality

2.

Number:

EOP-008-2

3.

Purpose: Ensure continued reliable operations of the Bulk Electric System (BES) in
the event that a control center becomes inoperable.

4.

Applicability:
4.1. Functional Entities:
4.1.1. Reliability Coordinator
4.1.2. Transmission Operator
4.1.3. Balancing Authority

5.

Effective Date: See the Implementation Plan for EOP-008-2.

6.

Standard-Only Definition: None

B. Requirements and Measures
R1.

Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
have a current Operating Plan describing the manner in which it continues to meet its
functional obligations with regard to the reliable operations of the BES in the event
that its primary control center functionality is lost. This Operating Plan for backup
functionality shall include: [Violation Risk Factor = Medium] [Time Horizon =
Operations Planning]
1.1. The location and method of implementation for providing backup functionality.
1.2. A summary description of the elements required to support the backup
functionality. These elements shall include:
1.2.1. Tools and applications to ensure that System Operators have situational
awareness of the BES.
1.2.2. Data exchange capabilities.
1.2.3. Interpersonal Communications.
1.2.4. Power source(s).
1.2.5. Physical and cyber security.
1.3. An Operating Process for keeping the backup functionality consistent with the
primary control center.
1.4. Operating Procedures, including decision authority, for use in determining when
to implement the Operating Plan for backup functionality.
1.5. A transition period between the loss of primary control center functionality and
the time to fully implement the backup functionality that is less than or equal to
two hours.

EOP-008-2 – Loss of Control Center Functionality

1.6. An Operating Process describing the actions to be taken during the transition
period between the loss of primary control center functionality and the time to
fully implement backup functionality elements identified in Requirement R1, Part
1.2. The Operating Process shall include:
1.6.1. A list of all entities to notify when there is a change in operating
locations.
1.6.2. Actions to manage the risk to the BES during the transition from primary
to backup functionality, as well as during outages of the primary or
backup functionality.
1.6.3. Identification of the roles for personnel involved during the initiation and
implementation of the Operating Plan for backup functionality.
M1. Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
have a dated, current, and in effect Operating Plan for backup functionality in
accordance with Requirement R1, in electronic or hardcopy format.
R2.

Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
have a copy of its current Operating Plan for backup functionality available at its
primary control center and at the location providing backup functionality. [Violation
Risk Factor = Lower] [Time Horizon = Operations Planning]

M2. Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
have a dated, current, and in effect copy of its Operating Plan for backup functionality
in accordance with Requirement R2, in electronic or hardcopy format, available at its
primary control center and at the location providing backup functionality.
R3.

Each Reliability Coordinator shall have a backup control center facility (provided
through its own dedicated backup facility or at another entity’s control center staffed
with certified Reliability Coordinator operators when control has been transferred to
the backup facility) that provides the functionality required for maintaining
compliance with all Reliability Standards are applicable to the primary control center
functionality. To avoid requiring a tertiary facility, a backup facility is not required
during: [Violation Risk Factor = High] [Time Horizon = Operations Planning]
•

Planned outages of the primary or backup facilities of two weeks or less

•

Unplanned outages of the primary or backup facilities

M3. Each Reliability Coordinator shall provide dated evidence that it has a backup control
center facility (provided through its own dedicated backup facility or at another
entity’s control center staffed with certified Reliability Coordinator operators when
control has been transferred to the backup facility) that provides the functionality
required for maintaining compliance with all Reliability Standards that are applicable
to the primary control center functionality in accordance with Requirement R3.
R4.

Each Balancing Authority and Transmission Operator shall have backup functionality
(provided either through a facility or contracted services staffed by applicable
certified operators when control has been transferred to the backup functionality

EOP-008-2 – Loss of Control Center Functionality

location) that includes monitoring, control, logging, and alarming sufficient for
maintaining compliance with all Reliability Standards that are applicable to a
Balancing Authority’s and Transmission Operator’s primary control center
functionality. To avoid requiring tertiary functionality, backup functionality is not
required during: [Violation Risk Factor = High] [Time Horizon = Operations Planning]
•

Planned outages of the primary or backup functionality of two weeks or less

•

Unplanned outages of the primary or backup functionality

M4. Each Balancing Authority and Transmission Operator shall provide dated evidence
that its backup functionality (provided either through a facility or contracted services
staffed by applicable certified operators when control has been transferred to the
backup functionality location) includes monitoring, control, logging, and alarming
sufficient for maintaining compliance with all Reliability Standards that are applicable
to a Balancing Authority’s or Transmission Operator’s primary control center
functionality in accordance with Requirement R4.
R5.

Each Reliability Coordinator, Balancing Authority, and Transmission Operator, shall
annually review and approve its Operating Plan for backup functionality. [Violation
Risk Factor = Medium] [Time Horizon = Operations Planning]
5.1. An update and approval of the Operating Plan for backup functionality shall take
place within sixty calendar days of any changes to any part of the Operating Plan
described in Requirement R1.

M5. Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
have evidence that its dated, current, and in effect Operating Plan for backup
functionality, in electronic or hardcopy format, has been reviewed and approved
annually and that it has been updated within sixty calendar days of any changes to
any part of the Operating Plan described in Requirement R1 in accordance with
Requirement R5.
R6.

Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
have primary and backup functionality that do not depend on each other for the
control center functionality required to maintain compliance with Reliability
Standards. [Violation Risk Factor = Medium] [Time Horizon = Operations Planning]

M6. Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
have dated evidence that its primary and backup functionality do not depend on each
other for the control center functionality required to maintain compliance with
Reliability Standards in accordance with Requirement R6.
R7. Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
conduct and document results of an annual test of its Operating Plan that
demonstrates: [Violation Risk Factor = Medium] [Time Horizon = Operations Planning]
7.1. The transition time between the simulated loss of primary control center
functionality and the time to fully implement the backup functionality.
7.2. The backup functionality for a minimum of two continuous hours.

EOP-008-2 – Loss of Control Center Functionality

M7. Each Reliability Coordinator, Balancing Authority, and Transmission Operator shall
provide evidence such as dated records, that it has completed and documented its
annual test of its Operating Plan for backup functionality, in accordance with
Requirement R7.
R8.

Each Reliability Coordinator, Balancing Authority, and Transmission Operator that has
experienced a loss of its primary or backup functionality and that anticipates that the
loss of primary or backup functionality will last for more than six calendar months
shall provide a plan to its Regional Entity within six calendar months of the date when
the functionality is lost, showing how it will re-establish primary or backup
functionality. [Violation Risk Factor = Medium] [Time Horizon = Operations Planning]

M8. Each Reliability Coordinator, Balancing Authority, and Transmission Operator that has
experienced a loss of their primary or backup functionality and that anticipates that
the loss of primary or backup functionality will last for more than six calendar months
shall provide evidence that a plan has been submitted to its Regional Entity within six
calendar months of the date when the functionality is lost showing how it will reestablish primary or backup functionality in accordance with Requirement R8.

EOP-008-2 – Loss of Control Center Functionality

C. Compliance
1.

Compliance Monitoring Process
1.1. Compliance Enforcement Authority:
“Compliance Enforcement Authority” means NERC or the Regional Entity, or any
entity as otherwise designated by an Applicable Governmental Authority, in
their respective roles of monitoring and/or enforcing compliance with
mandatory and enforceable Reliability Standards in their respective
jurisdictions.
1.2. Evidence Retention:
The following evidence retention period(s) identify the period of time an entity
is required to retain specific evidence to demonstrate compliance. For instances
where the evidence retention period specified below is shorter than the time
since the last audit, the Compliance Enforcement Authority may ask an entity to
provide other evidence to show that it was compliant for the full-time period
since the last audit.
The applicable entity shall keep data or evidence to show compliance as
identified below unless directed by its Compliance Enforcement Authority to
retain specific evidence for a longer period of time as part of an investigation.
•

Each Reliability Coordinator, Balancing Authority, and Transmission
Operator shall retain its dated, current, in effect Operating Plan for backup
functionality plus all issuances of the Operating Plan for backup
functionality since its last compliance audit in accordance with
Measurement M1.

•

Each Reliability Coordinator, Balancing Authority, and Transmission
Operator shall retain a dated, current, in effect copy of its Operating Plan
for backup functionality, with evidence of its last issue, available at its
primary control center and at the location providing backup functionality,
for the current year, in accordance with Measurement M2.

•

Each Reliability Coordinator shall retain dated evidence for the time period
since its last compliance audit, that it has demonstrated that it has a
backup control center facility (provided through its own dedicated backup
facility or at another entity’s control center staffed with certified Reliability
Coordinator operators when control has been transferred to the backup
facility) in accordance with Requirement R3 that provides the functionality
required for maintaining compliance with all Reliability Standards that are
applicable to the primary control center functionality in accordance with
Measurement M3.

•

Each Balancing Authority and Transmission Operator shall retain dated
evidence for the time period since its last compliance audit, that it has
demonstrated that it’s backup functionality (provided either through a
facility or contracted services staffed by applicable certified operators

EOP-008-2 – Loss of Control Center Functionality

when control has been transferred to the backup functionality location) in
accordance with Requirement R4 includes monitoring, control, logging, and
alarming sufficient for maintaining compliance with all Reliability Standards
that are applicable to a Balancing Authority’s and Transmission Operator’s
primary control center functionality in accordance with Measurement M4.
•

Each Reliability Coordinator, Balancing Authority, and Transmission
Operator, shall retain evidence for the time period since its last compliance
audit, that its dated, current, in effect Operating Plan for backup
functionality, has been reviewed and approved annually and that it has
been updated within sixty calendar days of any changes to any part of the
Operating Plan described in Requirement R1 in accordance with
Measurement M5.

•

Each Reliability Coordinator, Balancing Authority, and Transmission
Operator shall retain dated evidence for the current year and for any
Operating Plan for backup functionality in effect since its last compliance
audit, that its primary and backup functionality do not depend on each
other for the control center functionality required to maintain compliance
with Reliability Standards in accordance with Measurement M6.

•

Each Reliability Coordinator, Balancing Authority, and Transmission
Operator shall retain evidence for the current calendar year and the
previous calendar years, such as dated records, that it has tested its
Operating Plan for backup functionality, in accordance with Measurement
M7.

•

Each Reliability Coordinator, Balancing Authority, and Transmission
Operator that has experienced a loss of their primary or backup
functionality and that anticipates that the loss of primary or backup
functionality would last for more than six calendar months shall retain
evidence for the current in effect document and any such documents in
effect since its last compliance audit that a plan has been submitted to its
Regional Entity within six calendar months of the date when the
functionality is lost showing how it will re-establish primary or backup
functionality in accordance with Measurement M8.

1.3. Compliance Monitoring and Enforcement Program
As defined in the NERC Rules of Procedure, “Compliance Monitoring and
Enforcement Program” refers to the identification of the processes that will be
used to evaluate data or information for the purpose of assessing performance
or outcomes with the associated Reliability Standard.

EOP-008-2 – Loss of Control Center Functionality

Violation Severity Levels
R#

R1.

Violation Severity Levels

Lower VSL

Moderate VSL

High VSL

Severe VSL

The responsible entity had a
current Operating Plan for
backup functionality, but the
plan was missing one of the
requirement’s six parts
(Requirement R1, Parts 1.1
through 1.6).

The responsible entity had a
current Operating Plan for
backup functionality, but the
plan was missing two of the
requirement’s six parts
(Requirement R1, Parts 1.1
through 1.6).

The responsible entity had a
current Operating Plan for
backup functionality, but the
plan was missing three of
the requirement’s six parts
(Requirement R1, Parts 1.1
through 1.6).

The responsible entity had a
current Operating Plan for
backup functionality, but the
plan was missing four or
more of the requirement’s
six parts (Requirement R1,
Parts 1.1 through 1.6)
OR
The responsible entity did
not have a current Operating
Plan for backup
functionality.

R2.

N/A

The responsible entity did
N/A
not have a copy of its
current Operating Plan for
backup functionality
available in at least one of its
control locations.

The responsible entity did
not have a copy of its
current Operating Plan for
backup functionality at any
of its locations.

R3.

N/A

N/A

The Reliability Coordinator
does not have a backup
control center facility
(provided through its own
dedicated backup facility or
at another entity’s control

N/A

Page 7 of 13

EOP-008-2 – Loss of Control Center Functionality

R#

Violation Severity Levels

Lower VSL

Moderate VSL

High VSL

Severe VSL
center staffed with certified
Reliability Coordinator
operators when control has
been transferred to the
backup facility) that provides
the functionality required for
maintaining compliance with
all Reliability Standards that
are applicable to the primary
control center functionality.

R4.

N/A

N/A

N/A

The responsible entity does
not have backup
functionality (provided
either through a facility or
contracted services staffed
by applicable certified
operators when control has
been transferred to the
backup functionality
location) that includes
monitoring, control, logging,
and alarming sufficient for
maintaining compliance with
all Reliability Standards that
are applicable to a Balancing
Authority’s and
Transmission Operator’s

Page 8 of 13

EOP-008-2 – Loss of Control Center Functionality

R#

Violation Severity Levels

Lower VSL

Moderate VSL

High VSL

Severe VSL
primary control center
functionality.

The responsible entity did
not update and approve its
Operating Plan for backup
functionality for more than
60 calendar days and less
than or equal to 70 calendar
days after a change to any
part of the Operating Plan
described in Requirement
R1.

The responsible entity did
not update and approve its
Operating Plan for backup
functionality for more than
70 calendar days and less
than or equal to 80 calendar
days after a change to any
part of the Operating Plan
described in Requirement
R1.

The responsible entity did
not update and approve its
Operating Plan for backup
functionality for more than
80 calendar days and less
than or equal to 90 calendar
days after a change to any
part of the Operating Plan
described in Requirement
R1.

The responsible entity did
not have evidence that its
Operating Plan for backup
functionality was annually
reviewed and approved.
OR,

R6.

N/A

N/A

N/A

The responsible entity has
primary and backup
functionality that do depend
on each other for the control
center functionality required
to maintain compliance with
Reliability Standards.

R7.

The responsible entity
conducted an annual test of

The responsible entity
conducted an annual test of

The responsible entity
conducted an annual test of

The responsible entity did
not conduct an annual test

R5.

The responsible entity did
not update and approve its
Operating Plan for backup
functionality for more than
90 calendar days after a
change to any part of the
Operating Plan described in
Requirement R1.

Page 9 of 13

EOP-008-2 – Loss of Control Center Functionality

R#

Violation Severity Levels

Lower VSL

R8.

Moderate VSL

High VSL

its Operating Plan for backup its Operating Plan for backup
functionality, but it did not
functionality, but the test
document the results.
was for less than 1.5
continuous hours but more
OR,
than or equal to 1
The responsible entity
continuous hour.
conducted an annual test of
its Operating Plan for backup
functionality, but the test
was for less than two
continuous hours but more
than or equal to 1.5
continuous hours.

its Operating Plan for backup
functionality, but the test did
not assess the transition
time between the simulated
loss of its primary control
center and the time to fully
implement the backup
functionality

The responsible entity
experienced a loss of its
primary or backup
functionality and anticipated
that the loss of primary or
backup functionality would
last for more than six
calendar months and
provided a plan to its

The responsible entity
experienced a loss of its
primary or backup
functionality and anticipated
that the loss of primary or
backup functionality would
last for more than six
calendar months provided a
plan to its Regional Entity

The responsible entity
experienced a loss of its
primary or backup
functionality and anticipated
that the loss of primary or
backup functionality would
last for more than six
calendar months provided a
plan to its Regional Entity

OR,
The responsible entity
conducted an annual test of
its Operating Plan for backup
functionality, but the test
was for less than 1
continuous hour but more
than or equal to 0.5
continuous hours.

Severe VSL
of its Operating Plan for
backup functionality.
OR,
The responsible entity
conducted an annual test of
its Operating Plan for backup
functionality, but the test
was for less than 0.5
continuous hours.

The responsible entity
experienced a loss of its
primary or backup
functionality and anticipated
that the loss of primary or
backup functionality would
last for more than six
calendar months, but did not
submit a plan to its Regional

Page 10 of 13

EOP-008-2 – Loss of Control Center Functionality

R#

Violation Severity Levels

Lower VSL

Moderate VSL

High VSL

Severe VSL

Regional Entity showing how
it will re-establish primary or
backup functionality but the
plan was submitted more
than six calendar months but
less than or equal to seven
calendar months after the
date when the functionality
was lost.

showing how it will reestablish primary or backup
functionality but the plan
was submitted in more than
seven calendar months but
less than or equal to eight
calendar months after the
date when the functionality
was lost.

showing how it will reestablish primary or backup
functionality but the plan
was submitted in more than
eight calendar months but
less than or equal to nine
calendar months after the
date when the functionality
was lost.

Entity showing how it will reestablish primary or backup
functionality for more than
nine calendar months after
the date when the
functionality was lost.

D. Regional Variances
None.

E. Associated Documents

Link to the Implementation Plan and other important associated documents.

Page 11 of 13

EOP-008-2 – Loss of Control Center Functionality

Version History
Version

Date

Action

1

2009 - 2010

Project 2006-04: Revisions

1

August 5, 2010

Project 2006-04: Adopted by
the Board

1

April 21, 2011

Project 2006-04: FERC Order
issued approving EOP-008-1
(approval effective June 27,
2011)

1

July 1, 2013

Project 2006-04: Updated
VRFs and VSLs based on June
24, 2013 approval

2

July 9, 2017

Adopted by the NERC Board of
Trustees

Change Tracking

Major re-write to accommodate
changes noted in project file

Revised

Page 12 of 13

Supplemental Material

Rationale

Rationale for Requirement R1: The phrase "data exchange capabilities" is replacing “data
communications in Requirement R1, Part 1.2.2 for the following reasons:
COM-001-1 (no longer enforceable) covered telecommunications, which could be viewed as
covering both voice and data. COM-001-2.1 (currently enforceable) focuses on "Interpersonal
Communication" and does not address data.
The topic of data exchange has historically been covered in the IRO / TOP Standards. Most
recently the revisions to the standards that came out of Project 2014-03 Revisions to TOP and
IRO Standards use the phrase "data exchange capabilities." The rationale included in the IRO002-4 standard discusses the need to retain the topic of data exchange, as it is not addressed in
the COM standards.

Page 13 of 13