FERC-725B, (Final Rule in RM18-20) Mandatory Reliability Standards for Critical Infrastructure Protection [CIP] Reliability Standards)

Forms and Documents

Document Name	Status
RM18-20_725B Supporting Statement3-31-20.docx Supporting Statement A	2020-03-31
staff presentation01-23-20-E-20.pdf Supplementary Document	2020-02-11
RM18-20NERCPetition_20180918-5141.pdf Supplementary Document	2020-02-06
RM18-20news release_20200123-3046.pdf Supplementary Document	2020-02-06
18 CFR 40.pdf Supplementary Document	2018-05-02
16 USC 824(o).pdf Supplementary Document	2018-05-02

IC Document Collections

IC ID	Document Title	Status
239914	RM18-20, CIP-012-1 (one-time & ongoing averaged over Yrs. 1-3)	New
233614	RM17-13-000 Final Rule (Reliability Standard CIP-013-1 R1) (one-time averaged over Years 1-3)	Unchanged
233613	RM17-13-000 Final Rule (Reliability Standard CIP-013-1 R1-R4) (one-time averaged over Years 1-3)	Unchanged
233612	RM17-13-000 Final Rule (Reliability Standard CIP-013-1 R2) (ongoing)	Unchanged
231302	RM17-11-000 Final Rule (Reliability Standard CIP-003-7) (ongoing)	Unchanged
231300	RM17-11-000 Final Rule (Reliability Standard CIP-003-7) (one-time averaged Years 1-3)	Unchanged
181478	FERC-725B, Mandatory Reliability Standards for Critical Infrastructure Protection	Unchanged

ICR Details

OMB Control No: 1902-0248	ICR Reference No: 202002-1902-002
Status: Active	Previous ICR Reference No: 201810-1902-007
Agency/Subagency: FERC	Agency Tracking No: FERC-725B
Title: FERC-725B, (Final Rule in RM18-20) Mandatory Reliability Standards for Critical Infrastructure Protection [CIP] Reliability Standards)
Type of Information Collection: Revision of a currently approved collection	Common Form ICR:  No
Type of Review Request: Regular
OIRA Conclusion Action: Approved with change	Conclusion Date: 04/06/2020
	Date Received in OIRA: 02/13/2020
Terms of Clearance: Because the agency sought comments only on the changes associated with the regulation, the existing expiration date remains the same for this collection. In accordance with 5 CFR 1320, the information collection is approved. When submitting renewal packages for OMB Control No. 1902-0248, FERC should seek comments from the public on the burden associated with this collection and respond to those comments in its submission to OMB.

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	12/31/2021	36 Months From Approved	12/31/2021
Responses	224,800	0	223,362
Time Burden (Hours)	2,119,709	0	1,996,520
Cost Burden (Dollars)	0	0	0

---

Abstract: Final Rule in RM18-20. Pursuant to section 215(d)(2) of the Federal Power Act (FPA), the Commission approves Reliability Standard CIP-012-1 (Cyber Security – Communications between Control Centers). The North American Electric Reliability Corporation (NERC), the Commission-certified Electric Reliability Organization (ERO), submitted Reliability Standard CIP-012-1 for Commission approval in response to a Commission directive in Order No. 822. In Order No. 822, the Commission directed NERC, pursuant to section 215(d)(5) of the FPA, to develop modifications to the Reliability Standards to require responsible entities to implement controls to protect, at a minimum, communications links and sensitive bulk electric system data communicated between bulk electric system Control Centers “in a manner that is appropriately tailored to address the risks posed to the bulk electric system by the assets being protected (i.e., high, medium, or low impact).”

---

Authorizing Statute(s): US Code: 18 USC 824o Name of Law: Federal Power Act
   PL: Pub.L. 109 - 58 1211, Title XII, Subtitle A Name of Law: Energy Policy Act of 2005
  

Citations for New Statutory Requirements: None

---

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:
1902-AF64	Final or interim final rulemaking	85 FR 7197	02/07/2020

---

Federal Register Notices & Comments

Did the Agency receive public comments on this ICR? No

---

Number of Information Collection (IC) in this ICR: 7

IC Title	Form No.	Form Name
RM17-11-000 Final Rule (Reliability Standard CIP-003-7) (one-time averaged Years 1-3)
RM17-11-000 Final Rule (Reliability Standard CIP-003-7) (ongoing)
FERC-725B, Mandatory Reliability Standards for Critical Infrastructure Protection
RM17-13-000 Final Rule (Reliability Standard CIP-013-1 R2) (ongoing)
RM17-13-000 Final Rule (Reliability Standard CIP-013-1 R1-R4) (one-time averaged over Years 1-3)
RM17-13-000 Final Rule (Reliability Standard CIP-013-1 R1) (one-time averaged over Years 1-3)
RM18-20, CIP-012-1 (one-time & ongoing averaged over Yrs. 1-3)

---

ICR Summary of Burden

	Total Approved	Previously Approved	Change Due to New Statute	Change Due to Agency Discretion	Change Due to Adjustment in Estimate	Change Due to Potential Violation of the PRA
Annual Number of Responses	224,800	223,362	0	1,438	0	0
Annual Time Burden (Hours)	2,119,709	1,996,520	0	123,189	0	0
Annual Cost Burden (Dollars)	0	0	0	0	0	0

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Miscellaneous Actions

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: Consistent with the directive in Order No. 822, Reliability Standard CIP-012-1 improves upon the currently-effective Critical Infrastructure Protection (CIP) Reliability Standards to mitigate cyber security risks associated with communications between bulk electric system Control Centers. Specifically, Reliability Standard CIP-012-1 supports situational awareness and reliable bulk electric system operations by requiring responsible entities to protect the confidentiality and integrity of Real-time Assessment and Real-time monitoring data transmitted between bulk electric system Control Centers. Accordingly, the Commission approves Reliability Standard CIP-012-1 because it is largely responsive to the Commission’s directive in Order No. 822 and improves the cyber security posture of responsible entities.

---

Annual Cost to Federal Government: $4,832

Does this IC contain surveys, censuses, or employ statistical methods? No

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.     No

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.     No

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? No

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? No

Is this ICR related to the Pandemic Response? Uncollected

---

Common Form ICR:  No

---

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).

The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:

(a) It is necessary for the proper performance of agency functions;

(b) It avoids unnecessary duplication;

(c) It reduces burden on small entities;

(d) It uses plain, coherent, and unambiguous language that is understandable to respondents;

(e) Its implementation will be consistent and compatible with current reporting and recordkeeping practices;

(f) It indicates the retention periods for recordkeeping requirements;

(g) It informs respondents of the information called for under 5 CFR 1320.8 (b)(3) about:

(i) Why the information is being collected;

(ii) Use of information;

(iii) Burden estimate;

(iv) Nature of response (voluntary, required for a benefit, or mandatory);

(v) Nature and extent of confidentiality; and

(vi) Need to display currently valid OMB control number;

(h) It was developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected.

(i) It uses effective and efficient statistical survey methodology (if applicable); and

(j) It makes appropriate use of information technology.

If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.

Certification Date: 02/13/2020

---