RM18-20-000 NOPR supporting statement

FERC-725B (OMB Control No. 1902-0248)

Notice of Proposed Rulemaking (issued 4/18/2019) in Docket RM18-20-000

RIN: 1902-AF64

Supporting Statement for

FERC-725B (Mandatory Reliability Standards for Critical Infrastructure Protection [CIP] Reliability Standards)

as modified by the Notice of Proposed Rulemaking in Docket RM18-20-000

The Federal Energy Regulatory Commission (Commission or FERC) requests that the Office of Management and Budget (OMB) review the proposed revisions to the FERC-725B information collection (Mandatory Reliability Standards for Critical Infrastructure Protection [CIP] Reliability Standards) as established by the Notice of Proposed Rulemaking (NOPR) in RM18-20-000.

1. CIRCUMSTANCES THAT MAKE THE COLLECTION OF INFORMATION NECESSARY

On August 8, 2005, The Electricity Modernization Act of 2005, which is Title XII of the Energy Policy Act of 2005 (EPAct 2005), was enacted into law. EPAct 2005 added a new Section 215¹ to the Federal Power Act (FPA), which requires a Commission-certified Electric Reliability Organization (ERO) to develop mandatory and enforceable Reliability Standards, which are subject to Commission review and approval. Once approved, the Reliability Standards may be enforced by the ERO, subject to Commission oversight. In 2006, the Commission certified the North American Electric Reliability Corporation (NERC) as the ERO pursuant to FPA section 215.²

Pursuant to section 215(d)(2) of the Federal Power Act (FPA),³ the Commission proposes to approve Reliability Standard CIP-012-1 (Cyber Security – Communications between Control Centers). The North American Electric Reliability Corporation (NERC), the Commission-certified Electric Reliability Organization (ERO), submitted the proposed Reliability Standard for Commission approval in response to a Commission directive in Order No. 822.⁴ Specifically, pursuant to section 215(d)(5) of the FPA, the Commission directed NERC to develop modifications to require responsible entities to implement controls to protect, at a minimum, communications links and sensitive bulk electric system data communicated between bulk electric system Control Centers “in a manner that is appropriately tailored to address the risks posed to the bulk electric system by the assets being protected (i.e., high, medium, or low impact).”⁵

2. HOW, BY WHOM, AND FOR WHAT PURPOSE THE INFORMATION IS TO BE USED AND THE CONSEQUENCES OF NOT COLLECTING THE INFORMATION

Proposed Reliability Standard CIP-012-1 is intended to augment the currently-effective Critical Infrastructure Protection (CIP) Reliability Standards to mitigate cybersecurity risks associated with communications between bulk electric system Control Centers.⁶ Specifically, proposed Reliability Standard CIP-012-1 supports situational awareness and reliable bulk electric system operations by requiring responsible entities to protect the confidentiality and integrity of Real-time Assessment and Real-time monitoring data transmitted between bulk electric system Control Centers.⁷ Accordingly, the Commission proposes to determine that proposed Reliability Standard CIP-012-1 is largely responsive to the Commission’s directive in Order No. 822.

3. DESCRIBE ANY CONSIDERATION OF THE USE OF IMPROVED TECHNOLOGY TO REDUCE BURDEN AND TECHNICAL OR LEGAL OBSTACLES TO REDUCING BURDEN.

The use of current or improved technology and the medium are not covered in Reliability Standards, and are therefore left to the discretion of each respondent. We think that nearly all of the respondents are likely to make and keep related records in an electronic format. The compliance portals allow documents developed by the registered entities to be attached and uploaded to the Regional Entity’s portal. Compliance data can also be submitted by filling out data forms on the portals. These portals are accessible through an internet browser password-protected user interface.

4. DESCRIBE EFFORTS TO IDENTIFY DUPLICATION AND SHOW SPECIFICALLY WHY ANY SIMILAR INFORMATION ALREADY AVAILABLE CANNOT BE USED OR MODIFIED FOR USE FOR THE PURPOSE(S) DESCRIBED IN INSTRUCTION NO. 2

Filing requirements are periodically reviewed as OMB review dates arise or as the Commission may deem necessary in carrying out its regulatory responsibilities under the FPA in order to eliminate duplication and ensure that filing burden is minimized. There are no similar sources for information available that can be used or modified for these reporting purposes.

5. METHODS USED TO MINIMIZE BURDEN IN COLLECTION OF INFORMATION INVOLVING SMALL ENTITIES

The Commission estimates one-time and ongoing increases in reporting burden on variety of NERC-registered entities (including Reliability Coordinators, Generator Operators, Generator Owners, Interchange Coordinators, Transmission Operators, Balancing Authorities, Transmission Owners) due to the changes in the revised Reliability Standards, with no other increase in the cost of compliance (when compared with the current standards). Approximately 585 of the 714 affected entities are expected to meet the SBA’s definition for a small entity. ⁸

The Reliability Standards do not contain provisions for minimizing the burden of the collection for small entities. All the requirements in the Reliability Standards apply to every applicable entity. However, small entities generally can reduce their burden by taking part in a joint registration organization or a coordinated function registration. These options allow an entity the ability to share its compliance burden with other similar entities. Detailed information regarding these options is available in NERC’s Rules of Procedure at Section 1502, Paragraph 2, available at NERCs website.

6. CONSEQUENCE TO FEDERAL PROGRAM IF COLLECTION WERE CONDUCTED LESS FREQUENTLY

The consequences of not collecting the data associated with these Reliability Standards will result in an unmitigated risk from communications links and sensitive bulk electric system data communicated between bulk electric system Control Centers of the NERC registered entities which operate the bulk electric system.

7. EXPLAIN ANY SPECIAL CIRCUMSTANCES RELATING TO THE INFORMATION COLLECTION

FERC-725B information collection has no special circumstances.

8. DESCRIBE EFFORTS TO CONSULT OUTSIDE THE AGENCY: SUMMARIZE PUBLIC COMMENTS AND THE AGENCY'S RESPONSE TO THESE COMMENTS

Each FERC rulemaking (both proposed and final rules) is published in the Federal Register thereby providing public utilities and licensees, state commissions, Federal agencies, and other interested parties an opportunity to submit data, views, comments or suggestions concerning the proposed collections of data.

The NOPR was published⁹ in the Federal Register on 4/24/2019.

9. EXPLAIN ANY PAYMENT OR GIFTS TO RESPONDENTS

No payments or gifts have been made to respondents.

10. DESCRIBE ANY ASSURANCE OF CONFIDENTIALITY PROVIDED TO RESPONDENTS

According to the NERC Rules of Procedure¹⁰, “…a Receiving Entity shall keep in confidence and not copy, disclose, or distribute any Confidential Information or any part thereof without the permission of the Submitting Entity, except as otherwise legally required.” This serves to protect confidential information submitted to NERC or Regional Entities.

Responding entities do not submit the information collected due to the Reliability Standards to FERC. Rather, they submit the information to NERC, the regional entities, or maintain it internally. Since there are no submissions made to FERC, FERC provides no specific provisions in order to protect confidentiality.

11. PROVIDE ADDITIONAL JUSTIFICATION FOR ANY QUESTIONS OF A SENSITIVE NATURE, SUCH AS SEXUAL BEHAVIOR AND ATTITUDES, RELIGIOUS BELIEFS, AND OTHER MATTERS THAT ARE COMMONLY CONSIDERED PRIVATE

This collection does not contain any questions of a sensitive nature.

12. ESTIMATED BURDEN OF COLLECTION OF INFORMATION

NERC’s Reliability Standards CIP-012-1 will result in one-time and ongoing increases to burden in the reporting requirements imposed on Reliability Coordinators, Generator Operators, Generator Owners, Interchange Coordinators/Authorities, Transmission Operators, Balancing Authorities, and Transmission Owners.

The burden of the current versions of the standards, which are being supplemented, is approved under FERC-725B. The new, proposed version of the standard (also being submitted in the FERC-725B information collection) will impose a burden in addition to the existing burden. The additional estimated burden and cost for FERC-725B due to these proposed standards in the NOPR in RM18-20-000 follow:

Annual Changes Proposed by the NOPR in Docket No. RM18-20-000
	No. of Respondents (1)	No. of Responses11 per Respondent (2)	Total No. of Responses (1) X (2) = (3)	Avg. Burden Hrs. & Cost Per Response12 (4)	Total Annual Burden Hours & Total Annual Cost (3) X (4) = 5
Implementation of Documented Plan(s) (Requirement R1)13	714	1	714	128 hrs.; $10,496	91,392 hrs.; $7,494,144
Document Identification of Security Protection (Requirement R1.1)12	714	1	714	40 hrs.; $3,280	28,560 hrs.; $2,341,920
Identification of Security Protection Application (if owned by same Responsible Entity) (Requirement R1.2)12	714	1	714	20 hrs.; $1,640	14,280 hrs.; $1,170,960
Identification of Security Protection Application (if not owned by same Responsible Entity) (Requirement R1.3)12	714	1	714	160 hrs.; $13,120	14,240 hrs.; $9,367,680
Maintaining Compliance (ongoing)	714	1	714	83 hrs.; $6,806	59,262 hrs.; $4,859,484
Total (one-time)			2,856		148,472 hrs.; $12,174,704
Total (ongoing)			714		59,262 hrs.; $4,859,484
TOTAL			3,570		207,734 hrs.; $17,034,188

The one-time burden for the FERC-725B information collection will be averaged over three years:

148,472 hours ÷ 3 = 49,491 hours/year over three years

The number of one-time responses for the FERC-725B information collection is also averaged over three years:

2,856 responses ÷ 3 = 952 responses/year

The responses and burden for one-time and ongoing burden for Years 1-3 will total respectively as follows:

• Year 1: 1,666 responses [952 responses (one-time) + 714 responses (ongoing)]; 108,753 hours [49,491 hours (one-time) + 59,262 hours (ongoing)]

• Year 2: 1,666 responses [952 responses (one-time) + 714 responses (ongoing)]; 108,753 hours [49,491 hours (one-time) + 59,262 hours (ongoing)]

• Year 3: 1,666 responses [952 responses (one-time) + 714 responses (ongoing)]; 108,753 hours [49,491 hours (one-time) + 59,262 hours (ongoing)]

For submission in ROCIS, the average annual response and burden hour totals for Years 1-3 are:

• Responses: 1,666/year¹⁴

• Burden: 108,753 hours/year¹⁵

The paperwork burden estimate includes costs associated with the initial development of a policy to address requirements relating to: (1) developing the documented plans to protect the communications links and sensitive bulk electric system data communicated between bulk electric system Control Centers; (2) developing and documenting the identification of security protection ; (3 developing and documenting maintaining compliance . Further, the estimate reflects the assumption that costs incurred in year 1 will pertain to plan and procedure development, while costs in years 2 and 3 will reflect the burden associated with maintaining the protection of the communications links and sensitive bulk electric system data .

13. ESTIMATE OF THE TOTAL ANNUAL COST BURDEN TO RESPONDENTS

There are no start-up or other non-labor costs.

Total Capital and Start-up cost: $0

Total Operation, Maintenance, and Purchase of Services: $0

All of the costs in the NOPR are associated with burden hours (labor) and described in Questions #12 and #15 in this supporting statement.

14. ESTIMATED ANNUALIZED COST TO FEDERAL GOVERNMENT

Any involvement by the Commission is covered under the FERC-725 (OMB Control No. 1902-0255). The data are not submitted to FERC.

The Commission does incur the costs associated with obtaining OMB clearance for FERC-725B collection under the Paperwork Reduction Act (PRA). The PRA Administrative Cost is a Federal Cost associated with preparing, issuing, and submitting materials necessary to comply with the PRA for rulemakings, orders, or any other vehicle used to create, modify, extend, or discontinue an information collection. This average annual cost includes requests for extensions, all associated rulemakings and orders, other changes to the collection, and associated publications in the Federal Register. FERC estimates the annual cost for this effort to be $4,931.00.

FERC-725B	Number of Employees (FTEs)	Estimated Annual Federal Cost
Analysis of Filings	0	$0
Processing of Filings	0	$0
Paperwork Reduction Act Administrative Cost		$4,931
TOTAL		$4,931

15. REASONS FOR CHANGES IN BURDEN INCLUDING THE NEED FOR ANY INCREASE

In Order No. 822, the Commission directed NERC to, among other things, develop modifications to the CIP Reliability Standards to require responsible entities to implement controls to protect, at a minimum, communications links and sensitive bulk electric system data communicated between bulk electric system Control Centers “in a manner that is appropriately tailored to address the risks posed to the bulk electric system by the assets being protected (i.e., high, medium, or low impact).” The Commission explained that Control Centers associated with responsible entities, including reliability coordinators, balancing authorities, and transmission operators, must be capable of receiving and storing a variety of bulk electric system data from their interconnected entities in order to adequately perform their reliability functions. The Commission, therefore, determined that “additional measures to protect both the integrity and availability of sensitive bulk electric system data are warranted.”

NERC posits that the proposed Reliability Standard CIP-012-1 “requires Responsible Entities to develop and implement a plan to address the risks posed by unauthorized disclosure (confidentiality) and unauthorized modification (integrity) of Real-time Assessment and Real-time monitoring data while being transmitted between applicable Control Centers.” The required plan must include the following: (1) identification of security protections; (2) identification of where the protections are applied; and (3) identification of the responsibilities of each entity in case a Control Center is owned or operated by different responsible entities.

A summary of the burden added to FERC-725B information collection due to the NOPR in RM18-20-000 follows:

FERC-725B	Total Request	Previously Approved	Change due to Adjustment in Estimate	Change Due to Agency Discretion
Annual Number of Responses	225,028	223,362	0	1,666
Annual Time Burden16	2,105,273	1,996,520	0	108,753
Annual Cost Burden ($)	$0	$0	$0	$0

16. TIME SCHEDULE FOR THE PUBLICATION OF DATA

There are no tabulating, statistical or tabulating analysis or publication plans for the collection of information.

17. DISPLAY OF THE EXPIRATION DATE

The expiration date is displayed in a table posted on ferc.gov at http://www.ferc.gov/docs-filing/info-collections.asp.

18. EXCEPTIONS TO THE CERTIFICATION STATEMENT

There are no exceptions.

1 16 U.S.C. 824o.

2 North American Electric Reliability Corp., 116 FERC ¶ 61,062, order on reh’g & compliance, 117 FERC ¶ 61,126 (2006), aff’d sub nom. Alcoa, Inc. v. FERC, 564 F.3d 1342 (D.C. Cir. 2009).

3 16 U.S.C. 824o(d)(2).

4 Revised Critical Infrastructure Protection Reliability Standards, Order No. 822, 154 FERC ¶ 61,037, at P 53, order denying reh’g, Order No. 822-A, 156 FERC ¶ 61,052 (2016).

5 16 U.S.C. 824o(d)(5); Order No. 822, 154 FERC ¶ 61,037 at P 53.

6 Control Center is defined as One or more facilities hosting operating personnel that monitor and control the Bulk Electric System (BES) in real-time to perform the reliability tasks, including their associated data centers, of: 1) a Reliability Coordinator, 2) a Balancing Authority, 3) a Transmission Operator for transmission Facilities at two or more locations, or 4) a Generator Operator for generation Facilities at two or more locations..” Glossary of Terms Used in NERC Reliability Standards (NERC Glossary), http://www.nerc.com/files/glossary_of_terms.pdf. The acronym BES refers to the bulk electric system.

7 Real-time Assessment is defined in the NERC Glossary while Real-time monitoring is not.

8 Public utilities may fall under one of several different categories, each with a size threshold based on the company’s number of employees, including affiliates, the parent company, and subsidiaries. For the analysis in this NOPR, we are using a 500 employee threshold due to each affected entity falling within the role of Electric Bulk Power Transmission and Control (NAISC Code: 221121).

9 84 FR 17105

10 Section 1502, Paragraph 2, available at NERCs website

11 We consider the filing of an application to be a “response.”

12 The loaded hourly wage figure (includes benefits) is based on the average of the occupational categories for 2017 found on the Bureau of Labor Statistics website (http://www.bls.gov/oes/current/naics2_22.htm):

Information Security Analysts (Occupation Code: 15-1122): $42.84

Computer and Mathematical (Occupation Code: 15-0000): $44.02

Legal (Occupation Code: 23-0000): $143.68

Computer and Information Systems Managers (Occupation Code: 11-3021): $96.51

These various occupational categories’ wage figures are averaged and weighted equally as follows: ($42.84/hour + $44.02/hour + $143.68/hour + $96.51/hour) ÷ 4 = $81.76/hour. The resulting wage figure is rounded to $82.00/hour for use in calculating wage figures in the NOPR in Docket No. RM18-20-000.

13 This is a one-time reporting requirement.

14 (932 responses/year [one-time] + 714 responses/year [ongoing]) = 1,666 responses/year

15 (49,491 hours/year [one-time] + 59,262 hours/year [ongoing]) = 108,753 hours/year

16 The units of measurement applied to “annual time burden” are hours.

7