FERC-725, Justification for Non-Substantive Change

FERC-725 (OMB Control No. 1902-0225)

Justification for Non-Material or Non-Substantive Change

to the FERC-725 Information Collection

At the time of the RM15-14-002 Final Rule’s issuance, the FERC-725 information collection was under review for an unrelated Commission activity. Commission staff submitted these requirements due to the RM15-14-002 Final Rule under FERC-725(1A) (OMB Control No. 1902-0289), an intentionally temporary (placeholder) information collection number. Administratively, Commission staff was required to submit the revision in the amount of 1 response for 1 hour of estimated burden due to ROCIS constraints for new/temporary information collections. Regardless, these requirements will be incorporated in FERC-725 within this nonsubstantive change request and add no additional burden because FERC-725 already covers development of new standards. Once the FERC-725 nonsubstantive change request is approved, Commission staff will move to discontinue the FERC-725(1A) information collection.

Accordingly, the Commission considers the incorporation of this into FERC-725 as non-material or non-substantive.

History of FERC-725(1A) and Relationship to FERC-725. In the Final Rule in Docket No. RM15-14-000 issued on 7/21/2016¹, the Federal Energy Regulatory Commission (Commission or FERC) directed NERC to develop a new or modified Reliability Standard for supply chain risk management for industrial control system hardware, software, and computing and networking services associated with bulk electric system operations. NERC was directed to develop a forward-looking, objective-based Reliability Standard to provide security controls for supply chain management for industrial control system hardware, software, and services associated with bulk electric system operations.² The new or modified Reliability Standard addressed the following security objectives, (1) software integrity and authenticity; (2) vendor remote access; (3) information system planning; and (4) vendor risk management and procurement controls. In making this directive, the Commission did not require NERC to impose any specific controls nor does the Commission require NERC to propose “one-size-fits-all” requirements. The new or modified Reliability Standard required responsible entities to meet the four objectives, or some equally efficient and effective set of objectives, while providing flexibility to responsible entities as to how to meet those objectives.

The new or modified Reliability Standard was intended to mitigate the risks to bulk electric system facilities, systems, and equipment, which, if destroyed, degraded, or otherwise rendered unavailable as a result of a cybersecurity incident, would affect the reliable operation of the Bulk-Power System. The Commission found that the record supports the development of mandatory requirements for the protection of the aspects of the supply chain that are within the control of responsible entities.

There was no additional reporting or recordkeeping burden associated with this Final Rule. The requirement for NERC to develop, revise, or update Reliability Standards was already incorporated into the FERC-725 information collection (Certification of Electric Reliability Organization; Procedures for Electric Reliability Standards). The OMB-approved FERC-725 information collection includes the burden, reporting, and record-keeping requirements associated with:

• Reliability Standards Development

• Reliability Assessments

• Self-Assessment and ERO Application

• Reliability Compliance

• Stakeholder Survey

• Other Reporting.

1 The Final Rule is posted in FERC’s eLibrary at https://elibrary-backup.ferc.gov/idmws/common/OpenNat.asp?fileID=14313608. The News Release (for the Final Rule in Docket No. RM15-14-002) is posted at https://elibrary-backup.ferc.gov/idmws/common/OpenNat.asp?fileID=14313458.

2 Revised Critical Infrastructure Protection Reliability Standards, Notice of Proposed Rulemaking, 80 Fed. Reg. 43,354 (July 22, 2015), 152 FERC ¶ 61,054, at P 66 (2015) (NOPR).